449 matches found
CVE-2016-2825
Mozilla Firefox before 47.0 allows remote attackers to bypass the Same Origin Policy and modify the location.host property via an invalid data: URL...
PT-2016-2200
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 47.0 Description The issue allows remote attackers to bypass the Same Origin Policy and modify the location.host property via an invalid data: URL. This is related to insufficient access control in the browser...
CVE-2016-2817
The WebExtension sandbox feature in browser/components/extensions/ext-tabs.js in Mozilla Firefox before 46.0 does not properly restrict principal inheritance during chrome.tabs.create and chrome.tabs.update API calls, which allows remote attackers to conduct Universal XSS UXSS attacks via a craft...
CVE-2016-2817
The WebExtension sandbox feature in browser/components/extensions/ext-tabs.js in Mozilla Firefox before 46.0 does not properly restrict principal inheritance during chrome.tabs.create and chrome.tabs.update API calls, which allows remote attackers to conduct Universal XSS UXSS attacks via a craft...
CVE-2016-1940
CVE-2016-1940 affects Mozilla Firefox on Android (pre-44.0). A data: URL mishandling during shortcut opening or BOOKMARK/intent processing allows remote attackers to spoof the address bar. Affected: Firefox on Android before 44.0. Impact: address-bar spoofing. Mitigation: upgrade to Firefox 44.0 ...
CVE-2016-1940
Mozilla Firefox before 44.0 on Android allows remote attackers to spoof the address bar via a data: URL that is mishandled during 1 shortcut opening or 2 BOOKMARK intent processing...
CVE-2016-1940: Undefined Security Weakness
Mozilla Firefox before 44.0 on Android allows remote attackers to spoof the address bar via a data: URL that is mishandled during 1 shortcut opening or 2 BOOKMARK intent processing...
PT-2016-4932
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 44.0 on Android Description The issue allows remote attackers to spoof the address bar via a data: URL that is mishandled during shortcut opening or BOOKMARK intent processing. Recommendations For Mozilla...
Addressbar spoofing through stored data url shortcuts on Firefox for Android — Mozilla
Security researcher Muneaki Nishimura reported an issue with displayed URLs and bookmarks on Firefox for Android. If a data: URL is opened from a stored shortcut on the homescreen or from a BOOKMARK intent from another installed Android application, the addressbar continues to show the data: url...
Mozilla Firefox Same-Origin Policy Bypass Vulnerability (CNVD-2015-08332)
Mozilla Firefox and Firefox ESR are both browser products developed by the Mozilla Foundation in the U.S. Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox. A security vulnerability exists in Mozilla Firefox versions prior to 43.0 and Firefox ESR version...
Google Chrome Content Security Policy Access Restriction Bypass Vulnerability (CNVD-2015-07973)
Google Chrome is a web browser developed by the American company Google Google. A security vulnerability exists in the WebKit/Source/core/frame/csp/CSPSourceList.cpp file in the Content Security Policy CSP implementation of Google Chrome prior to version 47.0.2526.73 in the '...
SUSE-SU-2015:1476-1 Security update for MozillaFirefox, mozilla-nss
Mozilla Firefox was updated to version 38.2.1 ESR to fix several critical and non critical security vulnerabilities. - Firefox was updated to 38.2.1 ESR bsc943608 MFSA 2015-94/CVE-2015-4497 bsc943557 Use-after-free when resizing canvas element during restyling MFSA 2015-95/CVE-2015-4498 bsc943558...
CVE-2015-4498
The add-on installation feature in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to bypass an intended user-confirmation requirement by constructing a crafted data: URL and triggering navigation to an arbitrary http: or https: URL at a certain early poin...
CVE-2015-4498: Undefined Security Weakness
The add-on installation feature in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to bypass an intended user-confirmation requirement by constructing a crafted data: URL and triggering navigation to an arbitrary http: or https: URL at a certain early poin...
Mozilla Firefox and Firefox ESR Security Bypass Vulnerability
Mozilla Firefox and Firefox ESR are both browser products developed by the Mozilla Foundation in the U.S. Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox. A security vulnerability exists in the add-on installation feature of Mozilla Firefox versions...
Firefox ESR < 38.2.1 Multiple Vulnerabilities
The version of Mozilla Firefox ESR installed on the remote Windows host is prior to 38.2.1. It is, therefore, affected by the following vulnerabilities : - A use-after-free error exists when handling restyling operations during the resizing of canvas elements due to the canvas references being...
Firefox < 40.0.3 Multiple Vulnerabilities
The version of Mozilla Firefox installed on the remote Windows host is prior to 40.0.3. It is, therefore, affected by the following vulnerabilities : - A use-after-free error exists when handling restyling operations during the resizing of canvas elements due to the canvas references being...
firefox: multiple issues
CVE-2015-4497 use-after-free when resizing canvas element during restyling: Mozilla community member Jean-Max Reymond discovered a use-after-free vulnerability with a canvas element on a page. This occurs when a resize event is triggered in concert with style changes but the canvas references...
CVE-2015-4498
The add-on installation feature in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to bypass an intended user-confirmation requirement by constructing a crafted data: URL and triggering navigation to an arbitrary http: or https: URL at a certain early poin...