PT-2017-16476

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 51 Description The issue allows a malicious extension to install additional extensions without explicit user permission by modifying the CSP headers on sites with the appropriate permissions and using host requests to...

Security vulnerabilities fixed in Firefox 51 — Mozilla

JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. Use-after-free while manipulating XSL in XSLT documents A memory corruption vulnerability in Skia that can occur when using transforms to make gradients, resulting in a potential...

UBUNTU-CVE-2016-9075

An issue where WebExtensions can use the mozAddonManager API to elevate privilege due to privileged pages being allowed in the permissions list. This allows a malicious extension to then install additional extensions without explicit user permission. This vulnerability affects Firefox 50...

PT-2016-7642

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 50 Description The issue allows WebExtensions to elevate privilege using the mozAddonManager API, as privileged pages are permitted in the permissions list. This enables a malicious extension to install additional...