Lucene search
+L
MozillaMost viewed

1579 matches found

Mozilla
Mozilla
added 2015/11/03 12:0 a.m.50 views

Trailing whitespace in IP address hostnames can bypass same-origin policy — Mozilla

Security researcher Michał Bentkowski reported that adding white-space characters to hostnames that are IP addresses can bypass same-origin policy. This flaw was caused by trailing whitespaces being evaluated differently when parsing IP addresses instead of alphanumeric hostnames. This could lead...

7.5CVSS8.5AI score0.03097EPSS
SaveExploits0References2Affected Software3
Mozilla
Mozilla
added 2015/09/22 12:0 a.m.50 views

Arbitrary file manipulation by local user through Mozilla updater — Mozilla

Security researcher Holger Fuhrmannek reported that when the Mozilla updater is run, the updater can be manipulated to load the updated files from a working directory under user control in concert with junctions. When the updates are run by the Mozilla Maintenance Service on Windows, these...

6.6CVSS7AI score0.00294EPSS
SaveExploits0References2Affected Software3
Mozilla
Mozilla
added 2015/08/12 12:0 a.m.50 views

Integer overflows in libstagefright while processing MP4 video metadata — Mozilla

Security researcher Joshua Drake reported potential integer overflows in the libstagefright library while processing video sample metadata in MPEG4 video files. This can lead to a potentially exploitable crash...

9.3CVSS6.2AI score0.04021EPSS
SaveExploits0References2Affected Software2
Mozilla
Mozilla
added 2015/08/11 12:0 a.m.50 views

Mozilla Content Security Policy allows for asterisk wildcards in violation of CSP specification — Mozilla

Mozilla security engineer Christoph Kerschbaumer reported a discrepancy in Mozilla's implementation of Content Security Policy and the CSP specification. The specification states that blob:, data:, and filesystem: URLs should be excluded in case of a wildcard when matching source expressions but...

4.3CVSS8.3AI score0.02948EPSS
SaveExploits0References3Affected Software2
Mozilla
Mozilla
added 2014/10/14 12:0 a.m.50 views

Buffer overflow during CSS manipulation — Mozilla

Using the Address Sanitizer tool, security researcher Atte Kettunen from OUSPG discovered a buffer overflow when making capitalization style changes during CSS parsing. This can cause a crash that is potentially exploitable...

7.5CVSS9.3AI score0.05087EPSS
SaveExploits0References2Affected Software4
Mozilla
Mozilla
added 2014/09/02 12:0 a.m.50 views

Use-after-free setting text directionality — Mozilla

Security researcher regenrecht reported, via TippingPoint's Zero Day Initiative, a use-after-free during text layout when interacting with the setting of text direction. This results in a use-after-free which can lead to arbitrary code execution...

9.3CVSS9.4AI score0.04943EPSS
SaveExploits0References2Affected Software4
Mozilla
Mozilla
added 2013/12/10 12:0 a.m.50 views

Potential overflow in JavaScript binary search algorithms — Mozilla

Compiler Engineer Dan Gohman of Google reported that binary search algorithms in the SpiderMonkey JavaScript engine were prone to overflow in several places, leading to potential out-of-bounds array access. While none of these are known to be directly exploitable, they are unsafe in theory and ha...

7.5CVSS2.8AI score0.03707EPSS
SaveExploits0References2Affected Software2
Mozilla
Mozilla
added 2013/12/10 12:0 a.m.50 views

Character encoding cross-origin XSS attack — Mozilla

Security researcher Masato Kinugawa discovered that if a web page is missing character set encoding information it can inherit character encodings across navigations into another domain from an earlier site. Only same-origin inheritance is allowed according to the HTML5 specification. This issue...

4.3CVSS2.3AI score0.03402EPSS
SaveExploits1References2Affected Software2
Mozilla
Mozilla
added 2013/09/17 12:0 a.m.50 views

Buffer overflow with multi-column, lists, and floats — Mozilla

Security researcher Aki Helin reported that combining lists, floats, and multiple columns could trigger a potentially exploitable buffer overflow...

9.3CVSS2.4AI score0.08894EPSS
SaveExploits0References2Affected Software5
Mozilla
Mozilla
added 2013/08/06 12:0 a.m.50 views

Buffer overflow in Mozilla Maintenance Service and Mozilla Updater — Mozilla

Security researcher Seb Patane reported stack buffer overflows in both the Maintenance Service and the Mozilla Updater when unexpectedly long paths were encountered. A local attacker could pass these as command-line arguments to the Maintenance Service to crash either program and potentially lead...

7.2CVSS4AI score0.00329EPSS
SaveExploits0References4Affected Software5
Mozilla
Mozilla
added 2013/04/02 12:0 a.m.50 views

Out-of-bounds array read in CERT_DecodeCertPackage — Mozilla

Mozilla community member Ambroz Bizjak reported an out-of-bounds array read in the CERTDecodeCertPackage function of the Network Security Services NSS library when decoding a certificate. When this occurs, it will lead to memory corruption and a non-exploitable crash...

5CVSS9AI score0.05213EPSS
SaveExploits0References2Affected Software5
Mozilla
Mozilla
added 2013/03/07 12:0 a.m.50 views

Use-after-free in HTML Editor — Mozilla

VUPEN Security, via TippingPoint's Zero Day Initiative, reported a use-after-free within the HTML editor when content script is run by the document.execCommand function while internal editor operations are occurring. This could allow for arbitrary code execution...

9.3CVSS2.2AI score0.06398EPSS
SaveExploits0References2Affected Software5
Mozilla
Mozilla
added 2013/02/19 12:0 a.m.50 views

Wrapped WebIDL objects can be wrapped again — Mozilla

Mozilla developer Boris Zbarsky reported that in some circumstances a wrapped WebIDL object can be wrapped multiple times, overwriting the existing wrapped state. This could lead to an exploitable condition in rare cases...

9.3CVSS2.6AI score0.02745EPSS
SaveExploits0References2Affected Software2
Mozilla
Mozilla
added 2012/11/20 12:0 a.m.50 views

evalInSanbox location context incorrectly applied — Mozilla

Mozilla security researcher mozbugra4 reported that if code executed by the evalInSandbox function sets location.href, it can get the wrong subject principal for the URL check, ignoring the sandbox's Javascript context and gaining the context of evalInSandbox object. This can lead to malicious we...

4.3CVSS1.2AI score0.03083EPSS
SaveExploits1References2Affected Software5
Mozilla
Mozilla
added 2012/11/20 12:0 a.m.50 views

Frames can shadow top.location — Mozilla

Security researcher Mariusz Mlynski reported that the location property can be accessed by binary plugins through top.location with a frame whose name attribute's value is set to "top". This can allow for possible cross-site scripting XSS attacks through plugins...

4.3CVSS8AI score0.02546EPSS
SaveExploits0References2Affected Software5
Mozilla
Mozilla
added 2012/11/20 12:0 a.m.50 views

Use-after-free, buffer overflow, and memory corruption issues found using Address Sanitizer — Mozilla

Security researcher miaubiz used the Address Sanitizer tool to discover a series critically rated of use-after-free, buffer overflow, and memory corruption issues in shipped software. These issues are potentially exploitable, allowing for remote code execution. We would also like to thank miaubiz...

10CVSS3AI score0.08528EPSS
SaveExploits4References8Affected Software5
Mozilla
Mozilla
added 2012/08/28 12:0 a.m.50 views

Installer will launch incorrect executable following new installation — Mozilla

Security researcher Masato Kinugawa reported that if a crafted executable is placed in the root partition on a Windows file system, the Firefox and Thunderbird installer will launch this program after a standard installation instead of Firefox or Thunderbird, running this program with the user's...

6.9CVSS3.8AI score0.00296EPSS
SaveExploits1References2Affected Software5
Mozilla
Mozilla
added 2011/12/20 12:0 a.m.50 views

Key detection without JavaScript via SVG animation — Mozilla

Security researcher Mario Heiderich reported it was possible to use SVG animation accessKey events to detect key strokes even when JavaScript was disabled. Since web pages can normally detect key events through script and most users have scripting enabled this does not present a risk for most...

4.3CVSS0.9AI score0.02084EPSS
SaveExploits1References2Affected Software3
Mozilla
Mozilla
added 2011/09/27 12:0 a.m.50 views

XSS via plugins and shadowed window.location object — Mozilla

Mozilla developer Boris Zbarsky reported that a frame named "location" could shadow the window.location object unless a script in a page grabbed a reference to the true object before the frame was created. Because some plugins use the value of window.location to determine the page origin this cou...

4.3CVSS0.8AI score0.01095EPSS
SaveExploits0References3Affected Software3
Mozilla
Mozilla
added 2011/08/16 12:0 a.m.50 views

Security issues addressed in SeaMonkey 2.3 — Mozilla

Miscellaneous memory safety hazards rv:4.0 Impact: Critical Description: Mozilla identified and fixed several memory safety bugs in the browser engine used in SeaMonkey 2.2 and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and w...

10CVSS8.9AI score0.05485EPSS
SaveExploits1References21Affected Software1
Mozilla
Mozilla
added 2011/06/21 12:0 a.m.50 views

Miscellaneous memory safety hazards (rv:3.0/1.9.2.18) — Mozilla

Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be...

10CVSS3.1AI score0.05609EPSS
SaveExploits2References10Affected Software3
Mozilla
Mozilla
added 2010/07/20 12:0 a.m.50 views

Remote code execution using malformed PNG image — Mozilla

OUSPG researcher Aki Helin reported a buffer overflow in Mozilla graphics code which consumes image data processed by libpng. A malformed PNG file could be created which would cause libpng to incorrectly report the size of the image to downstream consumers. When the dimensions of such images are...

9.8CVSS2.3AI score0.43382EPSS
SaveExploits7References2Affected Software3
Mozilla
Mozilla
added 2010/06/22 12:0 a.m.50 views

Freed object reuse across plugin instances — Mozilla

Microsoft Vulnerability Research reported that two plugin instances could interact in a way in which one plugin gets a reference to an object owned by a second plugin and continues to hold that reference after the second plugin is unloaded and its object is destroyed. In these cases, the first...

9.3CVSS2AI score0.04812EPSS
SaveExploits0References2Affected Software2
Mozilla
Mozilla
added 2009/06/11 12:0 a.m.50 views

JavaScript chrome privilege escalation — Mozilla

Mozilla security researcher mozbugra4 reported a vulnerability which allows scripts from page content to run with elevated privileges. Using this vulnerability, an attacker could cause a chrome privileged object, such as the browser sidebar or the FeedWriter, to interact with web content in such ...

9.3CVSS3.1AI score0.04795EPSS
SaveExploits1References2Affected Software3
Mozilla
Mozilla
added 2009/04/21 12:0 a.m.50 views

jar: scheme ignores the content-disposition: header on the inner URI — Mozilla

Mozilla developer Daniel Veditz reported that when the jar: scheme is used to wrap a URI which serves the content with Content-Disposition: attachment, the HTTP header is ignored and the content is unpacked and displayed inline. A site may depend on this HTTP header to prevent potentially untrust...

4.3CVSS0.6AI score0.01329EPSS
SaveExploits0References2Affected Software1
Mozilla
Mozilla
added 2008/09/23 12:0 a.m.50 views

UTF-8 URL stack buffer overflow — Mozilla

Justin Schuh and Tom Cross of the IBM X-Force and Peter Williams of IBM Watson Labs reported errors in Mozilla URL parsing routines. These errors could be exploited using a specially crafted UTF-8 URL in a hyperlink which could overflow a stack buffer and allow an attacker to execute arbitrary co...

10CVSS5.8AI score0.43921EPSS
SaveExploits12References3Affected Software3
Mozilla
Mozilla
added 2023/03/14 12:0 a.m.49 views

Security Vulnerabilities fixed in Firefox ESR 102.9 — Mozilla

Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lead to a potentially exploitable crash. Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website...

8.8CVSS1AI score0.00798EPSS
SaveExploits0References6Affected Software1
Mozilla
Mozilla
added 2022/02/08 12:0 a.m.49 views

Security Vulnerabilities fixed in Firefox ESR 91.6 — Mozilla

A Time-of-Check Time-of-Use bug existed in the Maintenance Updater Service that could be abused to grant Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM access.This bug only affects Firefox on Windows. Other operating systems are unaffected. If a user...

9.6CVSS0.4AI score0.00926EPSS
SaveExploits2References9Affected Software1
Mozilla
Mozilla
added 2018/12/11 12:0 a.m.49 views

Security vulnerabilities fixed in Firefox ESR 60.4 — Mozilla

A buffer overflow and out-of-bounds read can occur in TextureStorage11 within the ANGLE graphics library, used for WebGL content. This results in a potentially exploitable crash. A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select...

9.8CVSS0.5AI score0.09646EPSS
SaveExploits0References6Affected Software1
Mozilla
Mozilla
added 2016/08/02 12:0 a.m.49 views

Location bar spoofing via data URLs with malformed/invalid mediatypes — Mozilla

Security researcher Firas Salem reported that decoding url-encoded values in data: urls for display leads to potential spoofing in the Location bar by using non-ASCII and emoji characters in a data: url's mediatype. This issue could result in the wrong URL being displayed as a location, which can...

4.3CVSS6.7AI score0.01473EPSS
SaveExploits0References2Affected Software1
Mozilla
Mozilla
added 2016/08/02 12:0 a.m.49 views

Information disclosure and local file manipulation through drag and drop — Mozilla

Security researcher Rafael Gieschke reported that file URIs dragged from a web page in Firefox to other software do not have their contents properly filtered before being passed to other programs, such as the local file manager. This can allow for the theft or manipulation of arbitrary local file...

8.1CVSS8.8AI score0.0166EPSS
SaveExploits0References2Affected Software1
Mozilla
Mozilla
added 2016/04/26 12:0 a.m.49 views

Buffer overflow in libstagefright with CENC offsets — Mozilla

Using Address Sanitizer, security researcher Sascha Just reported a buffer overflow in the libstagefright library due to issues with the handling of CENC offsets and the sizes table. This results in a potentially exploitable crash triggerable through web content...

8.8CVSS1.4AI score0.0378EPSS
SaveExploits0References2Affected Software2
Mozilla
Mozilla
added 2016/04/26 12:0 a.m.49 views

CSP not applied to pages sent with multipart/x-mixed-replace — Mozilla

Security researcher Muneaki Nishimura nishimunea of Recruit Technologies Co., Ltd. reported that Content Security Policy CSP is not applied correctly to web content sent with the multipart/x-mixed-replace MIME type. This allows for script to run in instances where CSP should block it, leading to ...

6.5CVSS6.7AI score0.02314EPSS
SaveExploits0References2Affected Software1
Mozilla
Mozilla
added 2016/03/08 12:0 a.m.49 views

Use-after-free in SetBody — Mozilla

Security researcher lokihardt, working with HP's Zero Day Initiative, reported a use-after-free issue in the SetBody function of HTMLDocument. This results in a potentially exploitable crash...

8.8CVSS0.9AI score0.0289EPSS
SaveExploits0References2Affected Software3
Mozilla
Mozilla
added 2016/03/08 12:0 a.m.49 views

Same-origin policy violation using performance.getEntries and history navigation with session restore — Mozilla

Security researcher Jordi Chancel discovered a variant of Mozilla Foundation Security Advisory 2015-136 which was fixed in Firefox 43. In the original bug, it was possible to read cross-origin URLs following a redirect if performance.getEntries was used along with an iframe to host a page...

6.5CVSS7.8AI score0.02248EPSS
SaveExploits0References3Affected Software2
Mozilla
Mozilla
added 2015/12/15 12:0 a.m.49 views

Integer underflow and buffer overflow processing MP4 metadata in libstagefright — Mozilla

Mozilla developer Gerald Squelart fixed an integer underflow in the libstagefright library initially reported by Joshua Drake to Google. The issues occurred in MP4 format video file while parsing cover metadata, leading to a buffer overflow. This results in a potentially exploitable crash and can...

6.8CVSS6.9AI score0.04269EPSS
SaveExploits0References2Affected Software2
Mozilla
Mozilla
added 2015/05/12 12:0 a.m.49 views

Use-after-free due to Media Decoder Thread creation during shutdown — Mozilla

Security researchers Tyson Smith and Jesse Schwartzentruber reported a use-after-free during the shutdown process. This was caused by a race condition when media decoder threads are created during the shutdown process in some circumstances. This leads to a potentially exploitable crash when...

6.8CVSS8.9AI score0.02196EPSS
SaveExploits0References2Affected Software3
Mozilla
Mozilla
added 2015/03/20 12:0 a.m.49 views

Privilege escalation through SVG navigation — Mozilla

Security researcher Mariusz Mlynski reported, through HP Zero Day Initiative's Pwn2Own contest, a method to run arbitrary scripts in a privileged context. This bypassed the same-origin policy protections by using a flaw in the processing of SVG format content navigation...

7.5CVSS8.9AI score0.03152EPSS
SaveExploits0References2Affected Software3
Mozilla
Mozilla
added 2015/02/24 12:0 a.m.49 views

Use-after-free in Developer Console date with OpenType Sanitiser — Mozilla

Using the Address Sanitizer tool, security researcher Atte Kettunen found a problem with OpenType Sanitiser OTS that resulted in a use-after-free while expanding macros in some circumstances. This use-after-free was only used for information displayed in the developer console and was not...

7.5CVSS8.8AI score0.03891EPSS
SaveExploits0References2Affected Software1
Mozilla
Mozilla
added 2015/02/24 12:0 a.m.49 views

Miscellaneous memory safety hazards (rv:36.0 / rv:31.5) — Mozilla

Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of the...

7.5CVSS9.9AI score0.04359EPSS
SaveExploits0References4Affected Software5
Mozilla
Mozilla
added 2015/01/13 12:0 a.m.49 views

Read of uninitialized memory in Web Audio — Mozilla

Security researcher Holger Fuhrmannek used the used the Address Sanitizer tool to discover a crash in Web Audio while manipulating timelines. This allowed for the a small block of memory with an uninitialized pointer to be read. The crash it not exploitable...

5CVSS8.8AI score0.02389EPSS
SaveExploits0References2Affected Software3
Mozilla
Mozilla
added 2014/12/02 12:0 a.m.49 views

Apple CoreGraphics framework on OS X 10.10 logging input data to /tmp directory — Mozilla

Security researcher Kent Howard reported an Apple issue present in OS X 10.10 Yosemite where log files are created by the CoreGraphics framework of OS X in the /tmp local directory. These log files contain a record of all inputs into Mozilla programs during their operation. In versions of OS X fr...

2.1CVSS8AI score0.00304EPSS
SaveExploits0References2Affected Software3
Mozilla
Mozilla
added 2014/12/02 12:0 a.m.49 views

XBL bindings accessible via improper CSS declarations — Mozilla

Security researcher Cody Crews reported a method to trigger chrome level XML Binding Language XBL bindings through web content. This was possible because some chrome accessible CSS stylesheets had their primary namespace improperly declared. When this occurred, it was possible to use these...

6.8CVSS8.9AI score0.01802EPSS
SaveExploits0References2Affected Software2
Mozilla
Mozilla
added 2014/03/18 12:0 a.m.49 views

onbeforeunload and Javascript navigation DOS — Mozilla

Security researchers Tim Philipp Schäfers and Sebastian Neef, the team of Internetwache.org, reported a mechanism using JavaScript onbeforeunload events with page navigation to prevent users from closing a malicious page's tab and causing the browser to become unresponsive. This allows for a deni...

5CVSS8.6AI score0.0364EPSS
SaveExploits1References2Affected Software2
Mozilla
Mozilla
added 2014/02/04 12:0 a.m.49 views

Crash when using web workers with asm.js — Mozilla

Soeren Balko reported a crash when terminating a web worker running asm.js code after passing an object between threads. This crash is potentially exploitable...

10CVSS9AI score0.07197EPSS
SaveExploits1References2Affected Software3
Mozilla
Mozilla
added 2013/09/17 12:0 a.m.49 views

User-defined properties on DOM proxies get the wrong "this" object — Mozilla

Mozilla developer Boris Zbarsky reported that user-defined getters on DOM proxies would incorrectly get the expando object as this. It is unlikely that this is directly exploitable but could lead to JavaScript client or add-on code making incorrect security sensitive decisions based on hacker...

5CVSS6.2AI score0.02932EPSS
SaveExploits0References2Affected Software5
Mozilla
Mozilla
added 2013/06/25 12:0 a.m.49 views

Data in the body of XHR HEAD requests leads to CSRF attacks — Mozilla

Security researcher Johnathan Kuskos reported that Firefox is sending data in the body of XMLHttpRequest XHR HEAD requests, which goes against the XHR specification. This can potentially be used for Cross-Site Request Forgery CSRF attacks against sites which do not distinguish between HEAD and PO...

4.3CVSS9.2AI score0.02011EPSS
SaveExploits0References2Affected Software5
Mozilla
Mozilla
added 2013/04/02 12:0 a.m.49 views

Out-of-bounds write in Cairo library — Mozilla

Security researcher Abhishek Arya Inferno of the Google Chrome Security Team used the Address Sanitizer tool to discover an out-of-bounds write in Cairo graphics library. When certain values are passed to it during rendering, Cairo attempts to use negative boundaries or sizes for boxes, leading t...

6.8CVSS2.4AI score0.03941EPSS
SaveExploits0References2Affected Software5
Mozilla
Mozilla
added 2013/01/08 12:0 a.m.49 views

Address space layout leaked in XBL objects — Mozilla

Mozilla security researcher Jesse Ruderman discovered that using the toString function of XBL objects can lead to inappropriate information leakage by revealing the address space layout instead of just the ID of the object. This layout information could potentially be used to bypass ASLR and othe...

4.3CVSS1.9AI score0.01998EPSS
SaveExploits1References2Affected Software5
Mozilla
Mozilla
added 2012/11/20 12:0 a.m.49 views

Improper security filtering for cross-origin wrappers — Mozilla

Mozilla developer Bobby Holley reported that security wrappers filter at the time of property access, but once a function is returned, the caller can use this function without further security checks. This affects cross-origin wrappers, allowing for write actions on objects when only read actions...

4.3CVSS8.1AI score0.0193EPSS
SaveExploits0References2Affected Software5
Total number of security vulnerabilities1579