Mozilla
Page 17 of 38 — Mozilla CVEs from a corpus of 3730, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-12395 | High | 7.5 | 2019-02-28 | By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This would allow access… |
CVE-2018-12393 | High | 7.5 | 2019-02-28 | A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could resu… |
CVE-2018-12392 | Critical | 9.8 | 2019-02-28 | When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor ev… |
CVE-2018-12391 | High | 8.8 | 2019-02-28 | During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies. Because the problem is in… |
CVE-2018-12390 | Critical | 9.8 | 2019-02-28 | Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some of these bugs showed evidence of memory c… |
CVE-2018-12389 | High | 8.8 | 2019-02-28 | Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and w… |
CVE-2018-12388 | High | 8.8 | 2019-02-28 | Mozilla developers and community members reported memory safety bugs present in Firefox 62. Some of these bugs showed evidence of memory corruption and we pres… |
CVE-2018-18506 | Medium | 5.9 | 2019-02-05 | When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specif… |
CVE-2018-18505 | Critical | 10.0 | 2019-02-05 | An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server pa… |
CVE-2018-18504 | Critical | 9.8 | 2019-02-05 | A crash and out-of-bounds read can occur when the buffer of a texture client is freed while it is still in use during graphic operations. This results is a pot… |
CVE-2018-18503 | High | 8.8 | 2019-02-05 | When JavaScript is used to create and manipulate an audio buffer, a potentially exploitable crash may occur because of a compartment mismatch in some situation… |
CVE-2018-18502 | Critical | 9.8 | 2019-02-05 | Mozilla developers and community members reported memory safety bugs present in Firefox 64. Some of these bugs showed evidence of memory corruption and we pres… |
CVE-2018-18501 | Critical | 9.8 | 2019-02-05 | Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4. Some of these bugs showed evidence of memory c… |
CVE-2018-18500 | Critical | 9.8 | 2019-02-05 | A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream parser object being fre… |
CVE-2019-7317 | Medium | 5.3 | 2019-02-04 | png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute. |
CVE-2018-5188 | Critical | 9.8 | 2018-10-18 | Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8. Some of these bugs showed evidence of memory corruption and we presume that wit… |
CVE-2018-5187 | Critical | 9.8 | 2018-10-18 | Memory safety bugs present in Firefox 60 and Firefox ESR 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort tha… |
CVE-2018-5186 | Critical | 9.8 | 2018-10-18 | Memory safety bugs present in Firefox 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these cou… |
CVE-2018-5156 | Critical | 9.8 | 2018-10-18 | A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring. This can result in stream data being… |
CVE-2018-12387 | Critical | 9.1 | 2018-10-18 | A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes a… |
CVE-2018-12386 | High | 8.1 | 2018-10-18 | A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution… |
CVE-2018-12385 | High | 7.0 | 2018-10-18 | A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This is… |
CVE-2018-12383 | Medium | 5.5 | 2018-10-18 | If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because t… |
CVE-2018-12382 | Medium | 5.3 | 2018-10-18 | The displayed addressbar URL can be spoofed on Firefox for Android using a javascript: URI in concert with JavaScript to insert text before the loaded domain n… |
CVE-2018-12381 | Medium | 5.3 | 2018-10-18 | Manually dragging and dropping an Outlook email message into the browser will trigger a page navigation when the message's mail columns are incorrectly interpr… |
CVE-2018-12379 | High | 7.8 | 2018-10-18 | When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading to a potentially ex… |
CVE-2018-12378 | Critical | 9.8 | 2018-10-18 | A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload values to be stored… |
CVE-2018-12377 | Critical | 9.8 | 2018-10-18 | A use-after-free vulnerability can occur when refresh driver timers are refreshed in some circumstances during shutdown when the timer is deleted while still i… |
CVE-2018-12376 | Critical | 9.8 | 2018-10-18 | Memory safety bugs present in Firefox 61 and Firefox ESR 60.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort t… |
CVE-2018-12375 | High | 8.8 | 2018-10-18 | Memory safety bugs present in Firefox 61. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these cou… |
CVE-2018-12374 | Medium | 4.3 | 2018-10-18 | Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vulnerability affects… |
CVE-2018-12373 | Medium | 6.5 | 2018-10-18 | dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward. This vulnerability affects Thunderb… |
CVE-2018-12372 | Medium | 6.5 | 2018-10-18 | Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thu… |
CVE-2018-12370 | High | 8.8 | 2018-10-18 | In Reader View SameSite cookie protections are not checked on exiting. This allows for a payload to be triggered when Reader View is exited if loaded by a mali… |
CVE-2018-12369 | Critical | 9.8 | 2018-10-18 | WebExtensions bundled with embedded experiments were not correctly checked for proper authorization. This allowed a malicious WebExtension to gain full browser… |
CVE-2018-12368 | High | 8.1 | 2018-10-18 | Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and h… |
CVE-2018-12367 | Medium | 4.3 | 2018-10-18 | In the previous mitigations for Spectre, the resolution or precision of various methods was reduced to counteract the ability to measure precise time intervals… |
CVE-2018-12366 | Medium | 6.5 | 2018-10-18 | An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value. This could leak private dat… |
CVE-2018-12365 | Medium | 6.5 | 2018-10-18 | A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction. Th… |
CVE-2018-12364 | High | 8.8 | 2018-10-18 | NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the targ… |
CVE-2018-12363 | High | 8.8 | 2018-10-18 | A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node… |
CVE-2018-12362 | High | 8.8 | 2018-10-18 | An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in a potentially exploi… |
CVE-2018-12361 | High | 8.8 | 2018-10-18 | An integer overflow can occur in the SwizzleData code while calculating buffer sizes. The overflowed value is used for subsequent graphics computations when th… |
CVE-2018-12360 | High | 8.8 | 2018-10-18 | A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by focusing that element. This results in a p… |
CVE-2018-12359 | High | 8.8 | 2018-10-18 | A buffer overflow can occur when rendering canvas content while adjusting the height and width of the canvas element dynamically, causing data to be written ou… |
CVE-2018-12358 | Medium | 4.3 | 2018-10-18 | Service workers can use redirection to avoid the tainting of cross-origin resources in some instances, allowing a malicious site to read responses which are su… |
CVE-2016-9069 | High | 7.8 | 2018-10-18 | A use-after-free in nsINode::ReplaceOrInsertBefore during DOM operations resulting in potentially exploitable crashes. This vulnerability affects Firefox < 50. |
CVE-2016-8635 | Medium | 5.3 | 2018-08-01 | It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack. An attacker could use this fla… |
CVE-2016-9574 | Medium | 5.9 | 2018-07-19 | nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA. |
CVE-2018-8024 | Medium | 5.4 | 2018-07-12 | In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and sta… |
CVE-2018-5185 | Medium | 6.5 | 2018-06-11 | Plaintext of decrypted emails can leak through by user submitting an embedded form. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8. |
CVE-2018-5184 | High | 7.5 | 2018-06-11 | Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8. |
CVE-2018-5183 | Critical | 9.8 | 2018-06-11 | Mozilla developers backported selected changes in the Skia library. These changes correct memory corruption issues including invalid buffer reads and writes du… |
CVE-2018-5182 | High | 7.5 | 2018-06-11 | If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specified local file will… |
CVE-2018-5181 | High | 7.5 | 2018-06-11 | If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child process the tab will open a local file corresp… |
CVE-2018-5180 | High | 7.5 | 2018-06-11 | A use-after-free vulnerability can occur during WebGL operations. While this results in a potentially exploitable crash, the vulnerability is limited because t… |
CVE-2018-5178 | High | 8.1 | 2018-06-11 | A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the us… |
CVE-2018-5177 | High | 7.5 | 2018-06-11 | A vulnerability exists in XSLT during number formatting where a negative buffer size may be allocated in some instances, leading to a buffer overflow and crash… |
CVE-2018-5176 | Medium | 6.1 | 2018-06-11 | The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links. If a JSON file contains malicious JavaScri… |
CVE-2018-5175 | Medium | 6.1 | 2018-06-11 | A mechanism to bypass Content Security Policy (CSP) protections on sites that have a "script-src" policy of "'strict-dynamic'". If a target website contains an… |
CVE-2018-5174 | High | 7.5 | 2018-06-11 | In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the "SEE_MASK_FLAG_NO_UI" flag associated with downloaded files and will not show any… |
CVE-2018-5173 | Medium | 5.3 | 2018-06-11 | The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed. This can be used to obscu… |
CVE-2018-5172 | Medium | 4.3 | 2018-06-11 | The Live Bookmarks page and the PDF viewer can run injected script content if a user pastes script from the clipboard into them while viewing RSS feeds or PDF… |
CVE-2018-5170 | Medium | 4.3 | 2018-06-11 | It is possible to spoof the filename of an attachment and display an arbitrary attachment name. This could lead to a user opening a remote attachment which is… |
CVE-2018-5169 | Medium | 6.5 | 2018-06-11 | If manipulated hyperlinked text with "chrome:" URL contained in it is dragged and dropped on the "home" icon, the home page can be reset to include a normally-… |
CVE-2018-5168 | Medium | 5.3 | 2018-06-11 | Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element. This could allow a m… |
CVE-2018-5167 | Medium | 4.3 | 2018-06-11 | The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks i… |
CVE-2018-5166 | High | 7.5 | 2018-06-11 | WebExtensions can use request redirection and a "filterReponseData" filter to bypass host permission settings to redirect network traffic and access content fr… |
CVE-2018-5165 | Medium | 5.3 | 2018-06-11 | In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected mode" is unchecked by default even though the Adobe Flash sandb… |
CVE-2018-5164 | Medium | 6.1 | 2018-06-11 | Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the "multipart/x-mixed-replace" MIME type. This could allow… |
CVE-2018-5163 | High | 8.1 | 2018-06-11 | If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able to replace the alternate data resources st… |
CVE-2018-5162 | High | 7.5 | 2018-06-11 | Plaintext of decrypted emails can leak through the src attribute of remote images, or links. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird… |
CVE-2018-5161 | Medium | 4.3 | 2018-06-11 | Crafted message headers can cause a Thunderbird process to hang on receiving the message. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 5… |
CVE-2018-5160 | High | 7.5 | 2018-06-11 | WebRTC can use a "WrappedI420Buffer" pixel buffer but the owning image object can be freed while it is still in use. This can result in the WebRTC encoder usin… |
CVE-2018-5159 | Critical | 9.8 | 2018-06-11 | An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-bounds wr… |
CVE-2018-5158 | High | 8.8 | 2018-06-11 | The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This Ja… |
CVE-2018-5157 | High | 7.5 | 2018-06-11 | Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer. This could allow the site to… |
CVE-2018-5155 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths. This results in a potentially exploitable crash. This vu… |
CVE-2018-5154 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths. This results in a potentially exploitable crash. T… |
CVE-2018-5153 | High | 7.5 | 2018-06-11 | If websocket data is sent with mixed text and binary in a single message, the binary data can be corrupted. This can result in an out-of-bounds read with the r… |
CVE-2018-5152 | Medium | 6.5 | 2018-06-11 | WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the si… |
CVE-2018-5151 | Critical | 9.8 | 2018-06-11 | Memory safety bugs were reported in Firefox 59. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of the… |
CVE-2018-5150 | Critical | 9.8 | 2018-06-11 | Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evidence of memory corruption and we presume… |
CVE-2018-5148 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one. Th… |
CVE-2018-5147 | Critical | 9.8 | 2018-06-11 | The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms. This vulnerabilit… |
CVE-2018-5146 | High | 8.8 | 2018-06-11 | An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox < 59.0.1, Firefox… |
CVE-2018-5145 | Critical | 9.8 | 2018-06-11 | Memory safety bugs were reported in Firefox ESR 52.6. These bugs showed evidence of memory corruption and we presume that with enough effort that some of these… |
CVE-2018-5144 | High | 7.3 | 2018-06-11 | An integer overflow can occur during conversion of text to some Unicode character sets due to an unchecked length parameter. This vulnerability affects Firefox… |
CVE-2018-5143 | Medium | 6.1 | 2018-06-11 | URLs using "javascript:" have the protocol removed when pasted into the addressbar to protect users from cross-site scripting (XSS) attacks, but if a tab chara… |
CVE-2018-5142 | Medium | 5.3 | 2018-06-11 | If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not properly display the… |
CVE-2018-5141 | High | 8.2 | 2018-06-11 | A vulnerability in the notifications Push API where notifications can be sent through service workers by web content without direct user interaction. This coul… |
CVE-2018-5140 | Medium | 5.3 | 2018-06-11 | Image for moz-icons can be accessed through the "moz-icon:" protocol through script in web content even when otherwise prohibited. This could allow for informa… |
CVE-2018-5138 | Medium | 5.3 | 2018-06-11 | A spoofing vulnerability can occur when a malicious site with an extremely long domain name is opened in an Android Custom Tab (a browser panel inside another… |
CVE-2018-5137 | High | 7.5 | 2018-06-11 | A legacy extension's non-contentaccessible, defined resources can be loaded by an arbitrary web page through script. This script does this by using a malicious… |
CVE-2018-5136 | High | 7.5 | 2018-06-11 | A shared worker created from a "data:" URL in one tab can be shared by another tab with a different origin, bypassing the same-origin policy. This vulnerabilit… |
CVE-2018-5135 | High | 7.5 | 2018-06-11 | WebExtensions can bypass normal restrictions in some circumstances and use "browser.tabs.executeScript" to inject scripts into contexts where this should not b… |
CVE-2018-5134 | High | 7.5 | 2018-06-11 | WebExtensions may use "view-source:" URLs to view local "file:" URL content, as well as content stored in "about:cache", bypassing restrictions that only allow… |
CVE-2018-5133 | Medium | 6.5 | 2018-06-11 | If the "app.support.baseURL" preference is changed by a malicious local program to contain HTML and script content, this content is not sanitized. It will be e… |
CVE-2018-5132 | Medium | 6.5 | 2018-06-11 | The Find API for WebExtensions can search some privileged pages, such as "about:debugging", if these pages are open in a tab. This could allow a malicious WebE… |
CVE-2018-5131 | Medium | 5.9 | 2018-06-11 | Under certain circumstances the "fetch()" API can return transient local copies of resources that were sent with a "no-store" or "no-cache" cache header instea… |