Mozilla: Use-after-free in WebSockets during disconnection (MFSA 2017-19)

A use-after-free vulnerability can occur in WebSockets when the object holding the connection is freed before the disconnection operation is finished. This results in an exploitable crash. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox 55...

Mozilla: CSP directives improperly applied with sandbox flag in iframes (MFSA 2017-19)

When a page's content security policy CSP header contains a "sandbox" directive, other directives are ignored. This results in the incorrect enforcement of CSP. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox 55...

Mozilla Firefox and Firefox ESR for Windows Security Bypass Vulnerability

Mozilla Firefox for Windows is an open source web browser for the Windows platform from the Mozilla Foundation in the U.S. Firefox ESR for Windows is an extended support version of Firefox for the Windows platform. A security bypass vulnerability exists in Windows-based versions of Mozilla Firefo...

Mozilla Firefox and Firefox ESR Security Bypass Vulnerability (CNVD-2017-22578)

Mozilla Firefox and Firefox ESR are both browser products developed by the Mozilla Foundation in the U.S. Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox. A security bypass vulnerability exists in Mozilla Firefox versions prior to 55 and Firefox ESR...

Mozilla: Buffer overflow while painting non-displayable SVG (MFSA 2017-19)

A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox 55...

Mozilla: Use-after-free with marquee during window resizing

A use-after-free vulnerability can occur while re-computing layout for a "marquee" element during window resizing where the updated style object is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox...

Mozilla: Use-after-free resizing image elements (MFSA 2017-19)

A use-after-free vulnerability can occur when manipulating the DOM during the resize event of an image element. If these elements have been freed due to a lack of strong references, a potentially exploitable crash may occur when the freed elements are accessed. This vulnerability affects...

UBUNTU-CVE-2017-7787

Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to information disclosure. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox 55...

Mozilla Firefox and Firefox ESR Graphite 2 Out-of-Bounds Read Vulnerability

Mozilla Firefox and Firefox ESR are both browser products developed by the Mozilla Foundation in the U.S. Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox.Graphite is a suite of enterprise-class open source system monitoring tools data plotting written ...

Mozilla Firefox and Firefox ESR Forgery Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the U.S. Firefox ESR is an extended support version of Firefox. A forgery vulnerability exists in versions of Mozilla Firefox prior to 54 and Firefox ESR prior to 52.2. An attacker can exploit this vulnerability ...

Mozilla Firefox and Firefox ESR Graphite 2 Denial of Service Vulnerability (CNVD-2017-12542)

Mozilla Firefox and Firefox ESR are both browser products developed by the Mozilla Foundation in the U.S. Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox.Graphite is a suite of enterprise-class open source system monitoring tools data plotting written ...

Mozilla: Memory safety bugs fixed in Firefox 54 and Firefox ESR 52.2 (MFSA 2017-16)

Memory safety bugs were reported in Firefox 53 and Firefox ESR 52.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox 54, Firefox ESR 52.2, and Thunderbird...

Memory Corruption Vulnerability in Multiple Mozilla Products

Mozilla Firefox, Firefox ESR and Thunderbird are all developed by the Mozilla Foundation.Firefox is an open source web browser, Firefox ESR is an extended support version of Firefox.Thunderbird is a standalone email client from the Mozilla Thunderbird is a separate email client from Mozilla...

Denial of Service Vulnerability in Multiple Mozilla Products

Mozilla Firefox, Firefox ESR and Thunderbird are all developed by the Mozilla Foundation.Firefox is an open source web browser, Firefox ESR is an extended support version of Firefox.Thunderbird is a standalone email client from the Mozilla Thunderbird is a separate email client from Mozilla...

Cross-Site Scripting Vulnerability in Multiple Mozilla Products

Mozilla Firefox, Firefox ESR and Thunderbird are all developed by the Mozilla Foundation.Firefox is an open source web browser, Firefox ESR is an extended support version of Firefox.Thunderbird is a standalone email client from the Mozilla Thunderbird is a separate email client from Mozilla...

Over-the-border read vulnerability in multiple Mozilla products

Mozilla Firefox, Firefox ESR and Thunderbird are all developed by the Mozilla Foundation.Firefox is an open source web browser, Firefox ESR is an extended support version of Firefox.Thunderbird is a standalone email client from the Mozilla Thunderbird is a separate email client from Mozilla...

Memory misreference vulnerability in multiple Mozilla products (CNVD-2017-07055)

Mozilla Firefox, Firefox ESR and Thunderbird are all developed by the Mozilla Foundation.Firefox is an open source web browser, Firefox ESR is an extended support version of Firefox.Thunderbird is a standalone email client from the Mozilla Thunderbird is a separate email client from Mozilla...

Memory misreference vulnerability in multiple Mozilla products (CNVD-2017-07056)

Mozilla Firefox, Firefox ESR, and Firefox OS are all developed by the Mozilla Foundation in the U.S. Firefox is an open-source web browser; Firefox ESR is an extended-support version of Firefox; and Firefox OS is a set of mobile operating systems based on the Linux kernel and used in smartphones...

Mozilla: Use-after-free in text input selection (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability occurs during certain text input selection resulting in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

Mozilla: Out-of-bounds read during glyph processing (MFSA 2017-11, MFSA 2017-12)

An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitable crash and could allow an attacker to read otherwise inaccessible memory. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...