10027 matches found
CVE-2017-5448
An out-of-bounds write in "ClearKeyDecryptor" while decrypting some Clearkey-encrypted media content. The "ClearKeyDecryptor" code runs within the Gecko Media Plugin GMP sandbox. If a second mechanism is found to escape the sandbox, this vulnerability allows for the writing of arbitrary data with...
CVE-2017-5465
An out-of-bounds read while processing SVG content in "ConvolvePixel". This results in a crash and also allows for otherwise inaccessible memory being copied into SVG graphic content, which could then displayed. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and...
CVE-2016-9902
The CVE-2016-9902 entry concerns Mozilla Firefox/Firefox ESR where the Pocket toolbar button incorrectly accepts events from any origin without verifying the event source. The vulnerability arises from the button listening for events fired from its own pages but not validating the origin, enablin...
CVE-2017-7751
CVE-2017-7751 is a use-after-free vulnerability in Mozilla Firefox and Thunderbird associated with content viewer listeners, affecting Firefox versions before 54, ESR before 52.2, and Thunderbird before 52.2. The underlying issue is a memory safety flaw that can lead to a potentially exploitable ...
CVE-2017-5448
CVE-2017-5448 is an out-of-bounds write in ClearKeyDecryptor (Gecko Media Plugin sandbox). The issue allows writing arbitrary memory data, potentially causing a crash or remote code execution. Affected products include Firefox/Firefox ESR prior to patched versions; upstream advisories show fixes ...
CVE-2017-5467
CVE-2017-5467 affects Mozilla Firefox and Thunderbird, with memory corruption when drawing Skia content outside the clipping region. Affected: Firefox (<53) and Thunderbird (
CVE-2017-5396
CVE-2017-5396 describes a use-after-free vulnerability in the Media Decoder when handling media files, where certain events fire after the media elements are freed. The initial document indicates affected products include Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox
CVE-2016-5297
CVE-2016-5297 is an argument length checking error in JavaScript that can trigger integer overflows, affecting Mozilla Thunderbird <45.5, Firefox ESR <45.5, and Firefox
CVE-2017-5432
CVE-2017-5432 is a use-after-free in Firefox < 53 that can trigger a potentially exploitable crash during certain text-input selection. The vulnerability also affects related Mozilla products in older ESR/thunderbird branches (e.g., Thunderbird < 52.1; ESR
CVE-2017-5459
CVE-2017-5459 is a buffer overflow in the WebGL component triggerable by web content. Affected products include Mozilla Firefox (non-ESR) <53 and Thunderbird/Firefox ESR variants listed in the description (Thunderbird <52.1, Firefox ESR <45.9, Firefox ESR <52.1, Firefox
CVE-2017-7753
CVE-2017-7753 is an out-of-bounds read in the rendering path when applying style rules to pseudo-elements (e.g., ::first-line) using cached style data. Affected products/versions include Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox
CVE-2017-7845
CVE-2017-7845 is a concrete vulnerability: a buffer overflow in ANGLE’s Direct3D 9 path used for WebGL rendering can crash the process. It affects Windows, and is listed against Thunderbird < 52.5.2, Firefox ESR < 52.5.2, and Firefox
CVE-2017-7791
CVE-2017-7791: A data: protocol-based modal alert spoofing vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox
CVE-2017-5451
CVE-2017-5451 describes an address bar spoofing vulnerability via the onblur event, enabling a script to affect text display and make the loaded site appear different from what’s in the address bar. The issue affects Mozilla products including Thunderbird < 52.1, Firefox ESR < 52.1, and Fir...
CVE-2017-7768
CVE-2017-7768: Local privilege issue where an unprivileged user can read 32 bytes from any local file via Mozilla Maintenance Service by convincing it to read a status file from the Windows updater. Affected: Firefox ESR < 52.2 and Firefox
CVE-2017-7843
Summary (CVE-2017-7843) : In Firefox, Private Browsing mode could be exploited by a web worker to persist data in IndexedDB, enabling cross-session fingerprinting. Affected are Firefox ESR versions older than 52.5.2 and Firefox versions older than 57.0.1. The root cause is that IndexedDB remains ...
CVE-2017-5470
CVE-2017-5470 involves memory safety bugs reported in Firefox 53 and Firefox ESR 52.1, with memory corruption evidence that could enable arbitrary code execution. The entry covers affected versions Firefox < 54, Firefox ESR < 52.2, and Thunderbird
CVE-2016-5291
CVE-2016-5291 is a local-bypass vulnerability where a attacker could load arbitrary local content by abusing local shortcut files, bypassing same-origin policy in Mozilla Firefox and Thunderbird products. Public details in connected docs indicate affected versions include Thunderbird < 45.5, F...
CVE-2017-7804
CVE-2017-7804 involves the WindowsDllDetourPatcher destructor, which can be repurposed by malicious code in conjunction with other flaws to write arbitrary data to memory under attacker control on Windows. Public advisories for Mozilla Thunderbird and Firefox (MFSA 2017-18/19, MFSA 2017-20) descr...
