Mozilla
Page 18 of 38 — Mozilla CVEs from a corpus of 3730, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-5130 | High | 8.8 | 2018-06-11 | When packets with a mismatched RTP payload type are sent in WebRTC connections, in some circumstances a potentially exploitable crash is triggered. This vulner… |
CVE-2018-5129 | High | 8.6 | 2018-06-11 | A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages. This can potentially allow for sandbo… |
CVE-2018-5128 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur when manipulating elements, events, and selection ranges during editor operations. This results in a potentially explo… |
CVE-2018-5127 | High | 8.8 | 2018-06-11 | A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script. This results in a potentially exploitable crash. This vulnerability… |
CVE-2018-5126 | Critical | 9.8 | 2018-06-11 | Memory safety bugs were reported in Firefox 58. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of the… |
CVE-2018-5125 | High | 8.8 | 2018-06-11 | Memory safety bugs were reported in Firefox 58 and Firefox ESR 52.6. Some of these bugs showed evidence of memory corruption and we presume that with enough ef… |
CVE-2018-5122 | Critical | 9.8 | 2018-06-11 | A potential integer overflow in the "DoCrypt" function of WebCrypto was identified. If a means was found of exploiting it, it could result in an out-of-bounds… |
CVE-2018-5121 | Medium | 5.3 | 2018-06-11 | Low descenders on some Tibetan characters in several fonts on OS X are clipped when rendered in the addressbar. When used as part of an Internationalized Domai… |
CVE-2018-5119 | Medium | 5.3 | 2018-06-11 | The reader view will display cross-origin content when CORS headers are set to prohibit the loading of cross-origin content by a site. This could allow access… |
CVE-2018-5118 | Medium | 5.3 | 2018-06-11 | The screenshot images displayed in the Activity Stream page displayed when a new tab is opened is created from the meta tags of websites. An issue was discover… |
CVE-2018-5117 | Medium | 5.3 | 2018-06-11 | If right-to-left text is used in the addressbar with left-to-right alignment, it is possible in some circumstances to scroll this text to spoof the displayed U… |
CVE-2018-5116 | Critical | 9.8 | 2018-06-11 | WebExtensions with the "ActiveTab" permission are able to access frames hosted within the active tab even if the frames are cross-origin. Malicious extensions… |
CVE-2018-5115 | High | 7.5 | 2018-06-11 | If an HTTP authentication prompt is triggered by a background network request from a page or extension, it is displayed over the currently loaded foreground pa… |
CVE-2018-5114 | Medium | 5.3 | 2018-06-11 | If an existing cookie is changed to be "HttpOnly" while a document is open, the original value remains accessible through script until that document is closed… |
CVE-2018-5113 | High | 7.5 | 2018-06-11 | The "browser.identity.launchWebAuthFlow" function of WebExtensions is only allowed to load content over "https:" but this requirement was not properly enforced… |
CVE-2018-5112 | High | 7.5 | 2018-06-11 | Development Tools panels of an extension are required to load URLs for the panels as relative URLs from the extension manifest file but this requirement was no… |
CVE-2018-5111 | Medium | 6.5 | 2018-06-11 | When the text of a specially formatted URL is dragged to the addressbar from page content, the displayed URL can be spoofed to show a different site than the o… |
CVE-2018-5110 | Medium | 5.3 | 2018-06-11 | If cursor visibility is toggled by script using from 'none' to an image and back through script, the cursor will be rendered temporarily invisible within Firef… |
CVE-2018-5109 | Medium | 5.3 | 2018-06-11 | An audio capture session can started under an incorrect origin from the site making the capture request. Users are still prompted to allow the request but the… |
CVE-2018-5108 | Medium | 4.3 | 2018-06-11 | A Blob URL can violate origin attribute segregation, allowing it to be accessed from a private browsing tab and for data to be passed between the private brows… |
CVE-2018-5107 | Medium | 5.3 | 2018-06-11 | The printing process can bypass local access protections to read files available through symlinks, bypassing local file restrictions. The printing process requ… |
CVE-2018-5106 | Medium | 5.3 | 2018-06-11 | Style editor traffic in the Developer Tools can be routed through a service worker hosted on a third party website if a user selects error links when these too… |
CVE-2018-5105 | High | 7.8 | 2018-06-11 | WebExtensions can bypass user prompts to first save and then open an arbitrarily downloaded file. This can result in an executable file running with local user… |
CVE-2018-5104 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur during font face manipulation when a font face is freed while still in use, resulting in a potentially exploitable cra… |
CVE-2018-5103 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur during mouse event handling due to issues with multiprocess support. This results in a potentially exploitable crash… |
CVE-2018-5102 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur when manipulating HTML media elements with media streams, resulting in a potentially exploitable crash. This vulnerabi… |
CVE-2018-5101 | High | 7.5 | 2018-06-11 | A use-after-free vulnerability can occur when manipulating floating "first-letter" style elements, resulting in a potentially exploitable crash. This vulnerabi… |
CVE-2018-5100 | High | 7.5 | 2018-06-11 | A use-after-free vulnerability can occur when arguments passed to the "IsPotentiallyScrollable" function are freed while still in use by scripts. This results… |
CVE-2018-5099 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur when the widget listener is holding strong references to browser objects that have previously been freed, resulting in… |
CVE-2018-5098 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur when form input elements, focus, and selections are manipulated by script content. This results in a potentially explo… |
CVE-2018-5097 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur during XSL transformations when the source document for the transformation is manipulated by script content during the… |
CVE-2018-5096 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash. This vulnerability affe… |
CVE-2018-5095 | Critical | 9.8 | 2018-06-11 | An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 8 GB of RAM. This results in the u… |
CVE-2018-5094 | High | 7.5 | 2018-06-11 | A heap buffer overflow vulnerability may occur in WebAssembly when "shrinkElements" is called followed by garbage collection on memory that is now uninitialize… |
CVE-2018-5093 | High | 7.5 | 2018-06-11 | A heap buffer overflow vulnerability may occur in WebAssembly during Memory/Table resizing, resulting in a potentially exploitable crash. This vulnerability af… |
CVE-2018-5092 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur when the thread for a Web Worker is freed from memory prematurely instead of from memory in the main thread while canc… |
CVE-2018-5091 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur during WebRTC connections when interacting with the DTMF timers. This results in a potentially exploitable crash. This… |
CVE-2018-5090 | Critical | 9.8 | 2018-06-11 | Memory safety bugs were reported in Firefox 57. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of the… |
CVE-2018-5089 | Critical | 9.8 | 2018-06-11 | Memory safety bugs were reported in Firefox 57 and Firefox ESR 52.5. Some of these bugs showed evidence of memory corruption and we presume that with enough ef… |
CVE-2017-7848 | Medium | 5.3 | 2018-06-11 | RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird < 52.5.2. |
CVE-2017-7847 | Medium | 4.3 | 2018-06-11 | Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affects Thunderbird < 52.5.2. |
CVE-2017-7846 | High | 8.8 | 2018-06-11 | It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View -> Feed article -> Website" or in the standard… |
CVE-2017-7845 | High | 8.8 | 2018-06-11 | A buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library, used for WebGL content. This is due to an inco… |
CVE-2017-7844 | Medium | 6.5 | 2018-06-11 | A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image can be used to determine which pages a us… |
CVE-2017-7843 | High | 7.5 | 2018-06-11 | When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not… |
CVE-2017-7842 | Medium | 5.3 | 2018-06-11 | If a document's Referrer Policy attribute is set to "no-referrer" sometimes two network requests are made for "<link>" elements instead of one. One of these re… |
CVE-2017-7840 | Medium | 6.1 | 2018-06-11 | JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved bookmarks. If the resulting exported HTM… |
CVE-2017-7839 | Medium | 6.1 | 2018-06-11 | Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be… |
CVE-2017-7838 | Medium | 5.3 | 2018-06-11 | Punycode format text will be displayed for entire qualified international domain names in some instances when a sub-domain triggers the punycode display instea… |
CVE-2017-7837 | Medium | 5.3 | 2018-06-11 | SVG loaded through "<img>" tags can use "<meta>" tags within the SVG data to set cookies for that page. This vulnerability affects Firefox < 57. |
CVE-2017-7836 | High | 7.8 | 2018-06-11 | The "pingsender" executable used by the Firefox Health Report dynamically loads a system copy of libcurl, which an attacker could replace. This allows for priv… |
CVE-2017-7835 | High | 7.3 | 2018-06-11 | Mixed content blocking of insecure (HTTP) sub-resources in a secure (HTTPS) document was not correctly applied for resources that redirect from HTTPS to HTTP… |
CVE-2017-7834 | Medium | 6.1 | 2018-06-11 | A "data:" URL loaded in a new tab did not inherit the Content Security Policy (CSP) of the original page, allowing for bypasses of the policy including the exe… |
CVE-2017-7833 | Medium | 5.3 | 2018-06-11 | Some Arabic and Indic vowel marker characters can be combined with Latin characters in a domain name to eclipse the non-Latin character with some font sets on… |
CVE-2017-7832 | Medium | 5.3 | 2018-06-11 | The combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute or grave, can be spoofed in the addressba… |
CVE-2017-7831 | Medium | 5.3 | 2018-06-11 | A vulnerability where the security wrapper does not deny access to some exposed properties using the deprecated "_exposedProps_" mechanism on proxy objects. Th… |
CVE-2017-7830 | Medium | 6.5 | 2018-06-11 | The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs… |
CVE-2017-7829 | Medium | 5.3 | 2018-06-11 | It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not displayed i… |
CVE-2017-7828 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur when flushing and resizing layout because the "PressShell" object has been freed while still in use. This results in a… |
CVE-2017-7827 | Critical | 9.8 | 2018-06-11 | Memory safety bugs were reported in Firefox 56. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of the… |
CVE-2017-7826 | Critical | 9.8 | 2018-06-11 | Memory safety bugs were reported in Firefox 56 and Firefox ESR 52.4. Some of these bugs showed evidence of memory corruption and we presume that with enough ef… |
CVE-2017-7825 | Medium | 5.3 | 2018-06-11 | Several fonts on OS X display some Tibetan and Arabic characters as whitespace. When used in the addressbar as part of an IDN this can be used for domain name… |
CVE-2017-7824 | Critical | 9.8 | 2018-06-11 | A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content. This is due to an incorrect value being… |
CVE-2017-7823 | Medium | 5.4 | 2018-06-11 | The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to behave as if the "allow-same-origin" keywo… |
CVE-2017-7822 | Medium | 5.3 | 2018-06-11 | The AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length of 1 according to the NIST Special Publication 800-38D specific… |
CVE-2017-7821 | Critical | 9.8 | 2018-06-11 | A vulnerability where WebExtensions can download and attempt to open a file of some non-executable file types. This can be triggered without specific user inte… |
CVE-2017-7820 | Medium | 5.3 | 2018-06-11 | The "instanceof" operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or an extension the web content can provide… |
CVE-2017-7819 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur in design mode when image objects are resized if objects referenced during the resizing have been freed from memory. T… |
CVE-2017-7818 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications (ARIA) elements within containers through the DOM. T… |
CVE-2017-7817 | Medium | 5.3 | 2018-06-11 | A spoofing vulnerability can occur when a page switches to fullscreen mode without user notification, allowing a fake address bar to be displayed. This allows… |
CVE-2017-7816 | Medium | 5.3 | 2018-06-11 | WebExtensions could use popups and panels in the extension UI to load an "about:" privileged URL, violating security checks that disallow this behavior. This v… |
CVE-2017-7815 | Medium | 5.3 | 2018-06-11 | On pages containing an iframe, the "data:" protocol can be used to create a modal dialog through Javascript that will have an arbitrary domains as the dialog's… |
CVE-2017-7814 | High | 7.8 | 2018-06-11 | File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its bl… |
CVE-2017-7813 | High | 8.2 | 2018-06-11 | Inside the JavaScript parser, a cast of an integer to a narrower type can result in data read from outside the buffer being parsed. This usually results in a n… |
CVE-2017-7812 | Medium | 5.3 | 2018-06-11 | If web content on a page is dragged onto portions of the browser UI, such as the tab bar, links can be opened that otherwise would not be allowed to open. This… |
CVE-2017-7811 | Critical | 9.8 | 2018-06-11 | Memory safety bugs were reported in Firefox 55. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of the… |
CVE-2017-7810 | Critical | 9.8 | 2018-06-11 | Memory safety bugs were reported in Firefox 55 and Firefox ESR 52.3. Some of these bugs showed evidence of memory corruption and we presume that with enough ef… |
CVE-2017-7809 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur when an editor DOM node is deleted prematurely during tree traversal while still bound to the document. This results i… |
CVE-2017-7808 | Medium | 5.3 | 2018-06-11 | A content security policy (CSP) "frame-ancestors" directive containing origins with paths allows for comparisons against those paths instead of the origin. Thi… |
CVE-2017-7807 | High | 8.1 | 2018-06-11 | A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the domain. This has been addressed by requir… |
CVE-2017-7806 | High | 7.5 | 2018-06-11 | A use-after-free vulnerability can occur when the layer manager is freed too early when rendering specific SVG content, resulting in a potentially exploitable… |
CVE-2017-7805 | High | 7.5 | 2018-06-11 | During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases, the han… |
CVE-2017-7804 | High | 7.5 | 2018-06-11 | The destructor function for the "WindowsDllDetourPatcher" class can be re-purposed by malicious code in concert with another vulnerability to write arbitrary d… |
CVE-2017-7803 | High | 7.5 | 2018-06-11 | When a page's content security policy (CSP) header contains a "sandbox" directive, other directives are ignored. This results in the incorrect enforcement of C… |
CVE-2017-7802 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur when manipulating the DOM during the resize event of an image element. If these elements have been freed due to a lack… |
CVE-2017-7801 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur while re-computing layout for a "marquee" element during window resizing where the updated style object is freed while… |
CVE-2017-7800 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur in WebSockets when the object holding the connection is freed before the disconnection operation is finished. This res… |
CVE-2017-7799 | Medium | 6.1 | 2018-06-11 | JavaScript in the "about:webrtc" page is not sanitized properly being assigned to "innerHTML". Data on this page is supplied by WebRTC usage and is not under t… |
CVE-2017-7798 | High | 8.8 | 2018-06-11 | The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page source code. In the worst case, this could… |
CVE-2017-7797 | High | 7.5 | 2018-06-11 | Response header name interning does not have same-origin protections and these headers are stored in a global registry. This allows stored header names to be a… |
CVE-2017-7796 | Medium | 4.7 | 2018-06-11 | On Windows systems, the logger run by the Windows updater deletes the file "update.log" before it runs in order to write a new log of that name. The path to th… |
CVE-2017-7794 | High | 7.8 | 2018-06-11 | On Linux systems, if the content process is compromised, the sandbox broker will allow files to be truncated even though the sandbox explicitly only has read a… |
CVE-2017-7793 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability can occur in the Fetch API when the worker or the associated window are freed when still in use, resulting in a potentially expl… |
CVE-2017-7792 | Critical | 9.8 | 2018-06-11 | A buffer overflow will occur when viewing a certificate in the certificate manager if the certificate has an extremely long object identifier (OID). This resul… |
CVE-2017-7791 | Medium | 5.3 | 2018-06-11 | On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary domains following page navigation, spoo… |
CVE-2017-7790 | High | 7.5 | 2018-06-11 | On Windows systems, if non-null-terminated strings are copied into the crash reporter for some specific registry keys, stack memory data can be copied until a… |
CVE-2017-7789 | Medium | 5.3 | 2018-06-11 | If a server sends two Strict-Transport-Security (STS) headers for a single connection, they will be rejected as invalid and HTTP Strict Transport Security (HST… |
CVE-2017-7788 | Critical | 9.8 | 2018-06-11 | When an "iframe" has a "sandbox" attribute and its content is specified using "srcdoc", that content does not inherit the containing page's Content Security Po… |
CVE-2017-7787 | High | 7.5 | 2018-06-11 | Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page… |
CVE-2017-7786 | Critical | 9.8 | 2018-06-11 | A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements. This results in a potentially exploitable crash. This vulne… |