Lucene search
+L
MozillaMost viewed

1579 matches found

Mozilla
Mozilla
added 2010/07/20 12:0 a.m.42 views

Cross-origin data disclosure via Web Workers and importScripts — Mozilla

Security researcher Yosuke Hasegawa reported that the Web Worker method importScripts can read and parse resources from other domains even when the content is not valid JavaScript. This is a violation of the same-origin policy and could be used by an attacker to steal information from other sites...

4.3CVSS2.1AI score0.00957EPSS
SaveExploits1References2Affected Software3
Mozilla
Mozilla
added 2010/07/20 12:0 a.m.42 views

Use-after-free error in NodeIterator — Mozilla

Security researcher regenrecht reported via TippingPoint's Zero Day Initiative an error in Mozilla's implementation of NodeIterator in which a malicious NodeFilter could be created which would detach nodes from the DOM tree while it was being traversed. The use of a detached and subsequently...

9.3CVSS3.7AI score0.05384EPSS
SaveExploits0References2Affected Software2
Mozilla
Mozilla
added 2010/07/20 12:0 a.m.42 views

Cross-origin data leakage from script filename in error messages — Mozilla

Security researcher Soroush Dalili reported that potentially sensitive URL parameters could be leaked across domains upon script errors when the script filename and line number is included in the error message...

5CVSS1.4AI score0.01069EPSS
SaveExploits1References2Affected Software3
Mozilla
Mozilla
added 2010/03/30 12:0 a.m.42 views

Dangling pointer vulnerability in nsPluginArray — Mozilla

Security researcher regenrecht reported via TippingPoint's Zero Day Initiative an error in the implementation of the window.navigator.plugins object. When a page reloads, the plugins array would reallocate all of its members without checking for existing references to each member. This could resu...

9.3CVSS3.4AI score0.06995EPSS
SaveExploits1References2Affected Software2
Mozilla
Mozilla
added 2010/03/30 12:0 a.m.42 views

XMLDocument::load() doesn't check nsIContentPolicy — Mozilla

Mozilla community member Wladimir Palant reported that XML documents were failing to call certain security checks when loading new content. This could result in certain resources being loaded that would otherwise violate security policies set by the browser or installed add-ons...

4.3CVSS9.4AI score0.0119EPSS
SaveExploits0References2Affected Software3
Mozilla
Mozilla
added 2009/12/15 12:0 a.m.42 views

Location bar spoofing vulnerabilities — Mozilla

Security researcher Jonathan Morgan reported that when a page loaded over an insecure protocol, such as http: or file:, sets its document.location to a https: URL which responds with a 204 status and empty response body, the insecure page will receive SSL indicators near the location bar, but wil...

6.8CVSS0.1AI score0.02539EPSS
SaveExploits7References5Affected Software2
Mozilla
Mozilla
added 2009/06/11 12:0 a.m.42 views

Arbitrary domain cookie access by local file: resources — Mozilla

Security researcher Gregory Fleischer reported that local resources loaded via the file: protocol can access any domain's cookies which have been saved on a user's machine. Fleischer demonstrated that a local document's domain was being calculated incorrectly from its URL. If a victim could be...

4.3CVSS2.1AI score0.02325EPSS
SaveExploits1References2Affected Software2
Mozilla
Mozilla
added 2009/03/04 12:0 a.m.42 views

XML data theft via RDFXMLDataSource and cross-domain redirect — Mozilla

Mozilla security researcher Georgi Guninski reported that a website could use nsIRDFService and a cross-domain redirect to steal arbitrary XML data from another domain, a violation of the same-origin policy. This vulnerability could be used by a malicious website to steal private data from users...

7.1CVSS3.7AI score0.016EPSS
SaveExploits0References2Affected Software3
Mozilla
Mozilla
added 2009/02/03 12:0 a.m.42 views

XMLHttpRequest allows reading HTTPOnly cookies — Mozilla

Developer and Mozilla community member Wladimir Palant reported that cookies marked HTTPOnly were readable by JavaScript via the XMLHttpRequest.getResponseHeader and XMLHttpRequest.getAllResponseHeaders APIs. This vulnerability bypasses the security mechanism provided by the HTTPOnly flag which...

5CVSS1.5AI score0.0156EPSS
SaveExploits0References2Affected Software2
Mozilla
Mozilla
added 2008/07/16 12:0 a.m.42 views

Crash with malformed GIF file on Mac OS X — Mozilla

Drew Yao of Apple Product Security reported a vulnerability in Mozilla graphics code which handles GIF rendering in Mac OS X. He demonstrated that a GIF file could be specially crafted to cause the browser to free an uninitialized pointer. An attacker could use this vulnerability to crash the...

8.8CVSS3.3AI score0.03592EPSS
SaveExploits2References2Affected Software1
Mozilla
Mozilla
added 2008/07/15 12:0 a.m.42 views

Remote code execution by overflowing CSS reference counter — Mozilla

An anonymous researcher, via TippingPoint's Zero Day Initiative program, reported a vulnerability in Mozilla's internal CSSValue array data structure. The vulnerability was caused by an insufficiently sized variable being used as a reference counter for CSS objects. By creating a very large numbe...

9.3CVSS3AI score0.05284EPSS
SaveExploits1References2Affected Software3
Mozilla
Mozilla
added 2008/02/07 12:0 a.m.42 views

Privilege escalation, XSS, Remote Code Execution — Mozilla

Mozilla contributors mozbugra4 and Boris Zbarsky submitted a series of vulnerabilities which allow scripts from page content to escape from its sandboxed context and/or run with chrome privileges. An additional vulnerability reported by mozbugra4 demonstrated that the XMLDocument.load function ca...

4.3CVSS5.3AI score0.02205EPSS
SaveExploits1References2Affected Software3
Mozilla
Mozilla
added 2008/02/07 12:0 a.m.42 views

Crashes with evidence of memory corruption (rv:1.8.1.12) — Mozilla

Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox 2.0.0.12 and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these coul...

9.3CVSS2.8AI score0.03304EPSS
SaveExploits1References4Affected Software3
Mozilla
Mozilla
added 2006/12/19 12:0 a.m.42 views

Crashes with evidence of memory corruption (rv:1.8.0.9/1.8.1.1) — Mozilla

As part of the Firefox 2.0.0.1 and 1.5.0.9 update releases we fixed several bugs to improve the stability of the product. Some of these were crashes that showed evidence of memory corruption and we presume that at least some of these could be exploited to run arbitrary code with enough effort...

6.8CVSS2AI score0.04324EPSS
SaveExploits0References22Affected Software3
Mozilla
Mozilla
added 2006/11/07 12:0 a.m.42 views

Crashes with evidence of memory corruption (rv:1.8.0.8) — Mozilla

As part of the Firefox 1.5.0.8 release we fixed several bugs to improve the stability of the product. Some of these were crashes that showed evidence of memory corruption and we presume that at least some of these could be exploited to run arbitrary code with enough effort...

7.5CVSS1.9AI score0.05531EPSS
SaveExploits0References18Affected Software3
Mozilla
Mozilla
added 2006/09/14 12:0 a.m.42 views

Crashes with evidence of memory corruption (rv:1.8.0.7) — Mozilla

As part of the Firefox 1.5.0.7 release we fixed several bugs to improve the stability of the product. Some of these were crashes that showed evidence of memory corruption and we presume that at least some of these could be exploited to run arbitrary code with enough effort...

10CVSS1.9AI score0.0544EPSS
SaveExploits0References29Affected Software3
Mozilla
Mozilla
added 2006/07/25 12:0 a.m.42 views

JavaScript engine vulnerabilities — Mozilla

Continuing our security audit of the JavaScript engine, Mozilla developers found and fixed several potential vulnerabilities...

7.5CVSS3.9AI score0.06476EPSS
SaveExploits0References14Affected Software3
Mozilla
Mozilla
added 2006/04/21 12:0 a.m.42 views

JavaScript execution in mail when forwarding in-line — Mozilla

Georgi Guninski reports that forwarding mail in-line while using the default HTML "rich mail" editor will execute JavaScript embedded in the e-mail message. Forwarding mail in-line is not the default setting but it is easily accessed through the "Forward As" menu item...

9.3CVSS0.6AI score0.07066EPSS
SaveExploits2References1Affected Software3
Mozilla
Mozilla
added 2006/04/13 12:0 a.m.42 views

Crashes with evidence of memory corruption (rv:1.8) — Mozilla

As part of the Firefox 1.5 release we fixed several crash bugs to improve the stability of the product. Some of these crashes showed evidence of memory corruption that we presume could be exploited to run arbitrary code and have been applied to the Firefox 1.0.x and Mozilla Suite 1.7.x releases...

10CVSS2.5AI score0.08251EPSS
SaveExploits0References6Affected Software4
Mozilla
Mozilla
added 2025/04/29 12:0 a.m.41 views

Security Vulnerabilities fixed in Firefox 138 — Mozilla

Mozilla Firefox's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file...

9.1CVSS7.9AI score0.00609EPSS
SaveExploits0References11Affected Software1
Mozilla
Mozilla
added 2024/03/22 12:0 a.m.41 views

Security Vulnerabilities fixed in Firefox ESR 115.9.1 — Mozilla

An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does not affect mobile versions of Firefox...

8.4CVSS6.4AI score0.047EPSS
SaveExploits0References1Affected Software1
Mozilla
Mozilla
added 2023/12/19 12:0 a.m.41 views

Security Vulnerabilities fixed in Firefox ESR 115.6 — Mozilla

The WebGL DrawElementsInstanced method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. EncryptingOutputStream was susceptible to exposing uninitialized data. This issue...

8.8CVSS9AI score0.20472EPSS
SaveExploits0References11Affected Software1
Mozilla
Mozilla
added 2016/08/02 12:0 a.m.41 views

Form input type change from password to text can store plain text password in session restore file — Mozilla

Mozilla employee Mike Kaply reported that the Firefox session restore data can contain passwords in plain text if a password input field on a page has its type changed from "password" to "text" during a session. This can occur if the password input field has a scripted mechanism to display the...

6.5CVSS7.8AI score0.01379EPSS
SaveExploits0References2Affected Software1
Mozilla
Mozilla
added 2016/04/26 12:0 a.m.41 views

Use-after-free and buffer overflow in Service Workers — Mozilla

Security researcher Looben Yang reported two issues discovered in Service Workers using Address Sanitizer...

8.8CVSS8AI score0.0294EPSS
SaveExploits0References4Affected Software1
Mozilla
Mozilla
added 2015/12/30 12:0 a.m.41 views

Lockscreen delay bypass in Firefox OS — Mozilla

Frederik Braun of Mozilla discovered a bug in the lockscreen state logic that allows an attacker to bypass the lockscreen delay. The delay was introduced to make it harder to brute-force the passcode lock of a Firefox OS device when an attacker has gained physical access. A successful attack woul...

4.6CVSS5.2AI score0.00315EPSS
SaveExploits0References2Affected Software1
Mozilla
Mozilla
added 2015/12/15 12:0 a.m.41 views

Firefox allows for control characters to be set in cookies — Mozilla

Security researcher musicDespiteEverything reported an issue when ASCII code 11 for vertical tab is stored in a cookie in violation of RFC6265. This may result in incorrect cookie handling by servers, resulting in the potential ability to set cookie values and read cookie data from users in conce...

5CVSS7.3AI score0.0239EPSS
SaveExploits0References2Affected Software1
Mozilla
Mozilla
added 2015/08/11 12:0 a.m.41 views

Overflow issues in libstagefright — Mozilla

An anonymous researcher reported, via TippingPoint's Zero Day Initiative, two integer overflows in the libstagefright library that could be triggered by a malicious 'saio' chunk in an MPEG4 video. These overflows allowed for potential arbitrary code execution. This issue was independently reporte...

10CVSS7.7AI score0.09027EPSS
SaveExploits0References7Affected Software3
Mozilla
Mozilla
added 2015/08/11 12:0 a.m.41 views

Feed protocol with POST bypasses mixed content protections — Mozilla

Security researcher Masato Kinugawa reported that opening a target page using a POST to the url prefixed with the feed: protocol disables the mixed content blocker for that page. This could allow for the risk of a man-in-the-middle MITM scripting attack on pages that accidentally include insecure...

4.3CVSS8.4AI score0.01511EPSS
SaveExploits0References2Affected Software2
Mozilla
Mozilla
added 2014/04/29 12:0 a.m.41 views

Out-of-bounds write in Cairo — Mozilla

Security researcher Jukka Jylänki reported a crash in the the Cairo graphics library. This happens when Cairo paints out-of-bounds to the destination buffer in the compositing function when working with canvas in certain circumstances. This issue allows malicious web content to cause a potentiall...

10CVSS8.8AI score0.05601EPSS
SaveExploits0References2Affected Software2
Mozilla
Mozilla
added 2013/09/17 12:0 a.m.41 views

Calling scope for new Javascript objects can lead to memory corruption — Mozilla

Mozilla community member Ms2ger found a mechanism where a new Javascript object with a compartment is uninitialized could be entered through web content. When the scope for this object is called, it leads to a potentially exploitable crash...

6.8CVSS1.7AI score0.04013EPSS
SaveExploits0References2Affected Software5
Mozilla
Mozilla
added 2013/04/02 12:0 a.m.41 views

Memory corruption while rendering grayscale PNG images — Mozilla

Mozilla community member Tobias Schula reported that if gfx.colormanagement.enablev4 preference is enabled manually in about:config, some grayscale PNG images will be rendered incorrectly and cause memory corruption during PNG decoding when certain color profiles are in use. A crafted PNG image...

4.3CVSS6.1AI score0.01382EPSS
SaveExploits0References2Affected Software2
Mozilla
Mozilla
added 2011/09/27 12:0 a.m.41 views

Integer underflow when using JavaScript RegExp — Mozilla

Mark Kaplan reported a potentially exploitable crash due to integer underflow when using a large JavaScript RegExp expression. We would also like to thank Mark for contributing the fix for this problem...

10CVSS2.8AI score0.05324EPSS
SaveExploits0References2Affected Software1
Mozilla
Mozilla
added 2011/08/16 12:0 a.m.41 views

Security issues addressed in Firefox 3.6.20 — Mozilla

Miscellaneous memory safety hazards rv:1.9.2.20 Impact: Critical Description: Mozilla developers and community members identified and fixed several memory safety bugs in the browser engine used in Firefox 3.6 and other Mozilla-based products. Some of these bugs showed evidence of memory corruptio...

10CVSS10AI score0.05562EPSS
SaveExploits5References14Affected Software1
Mozilla
Mozilla
added 2009/12/15 12:0 a.m.41 views

Privilege escalation via chrome window.opener — Mozilla

Security researcher David James reported that a content window which is opened by a chrome window retains a reference to the chrome window via the window.opener property. Using this reference, content in the new window can access functions inside the chrome window, such as eval, and use these...

7.6CVSS1.9AI score0.03707EPSS
SaveExploits1References2Affected Software2
Mozilla
Mozilla
added 2009/08/03 12:0 a.m.41 views

Crashes with evidence of memory corruption (rv:1.9.1.2/1.9.0.13) — Mozilla

Mozilla developers and community members identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some ...

10CVSS2.6AI score0.04939EPSS
SaveExploits0References6Affected Software1
Mozilla
Mozilla
added 2008/03/25 12:0 a.m.41 views

Java socket connection to any local port via LiveConnect — Mozilla

Security researcher Gregory Fleischer demonstrated that web content fetched via the jar: protocol can use Java via LiveConnect to open socket connections to arbitrary ports on the user's machine "localhost". The issue is caused by improper parsing of the content origin passed from the browser to...

9.3CVSS2.6AI score0.05684EPSS
SaveExploits1References4Affected Software2
Mozilla
Mozilla
added 2008/02/19 12:0 a.m.41 views

Possible information disclosure in BMP decoder — Mozilla

Security researcher Gynvael Coldwind of Vexillium crediting help from udevd and porneL demonstrated that BMP images could be used to reveal small chunks of uninitialized memory that might contain sensitive data from other pages or other programs, and that this data could be extracted from the ima...

9.3CVSS1.2AI score0.02224EPSS
SaveExploits1References2Affected Software2
Mozilla
Mozilla
added 2007/10/18 12:0 a.m.41 views

File input focus stealing vulnerability — Mozilla

A user on the Sla.ckers.org forums named hong reported that a file upload control could be filled programmatically by switching page focus to the label before a file upload form control for selected keyboard events. An attacker could use this trick to steal files from the users' computer if the...

4.3CVSS0.8AI score0.09825EPSS
SaveExploits4References4Affected Software2
Mozilla
Mozilla
added 2007/10/18 12:0 a.m.41 views

URIs with invalid %-encoding mishandled by Windows — Mozilla

On Windows XP with Internet Explorer 7 installed several "web related" URI schemes do not launch the registered protocol-handler if the URI contains an invalid %-encoded sequence. This was initially reported by Billy Rios and Nate McFeters with additional investigation by Secunia. A patch that...

9.3CVSS6.1AI score0.02648EPSS
SaveExploits0References3Affected Software3
Mozilla
Mozilla
added 2007/07/17 12:0 a.m.41 views

Remote code execution by launching Firefox from Internet Explorer — Mozilla

Internet Explorer calls registered URL protocols without escaping quotes and may be used to pass unexpected and potentially dangerous data to the application that registers that URL Protocol...

4.3CVSS4.8AI score0.29355EPSS
SaveExploits4References2Affected Software3
Mozilla
Mozilla
added 2007/05/30 12:0 a.m.41 views

XSS using addEventListener — Mozilla

Mozilla contributor mozbugra4 demonstrated that the addEventListener method could be used to inject script into another site in violation of the browser's same-origin policy. This could be used to access or modify private or valuable information from that other site...

4.3CVSS2.9AI score0.01649EPSS
SaveExploits0References3Affected Software2
Mozilla
Mozilla
added 2007/02/25 12:0 a.m.41 views

onUnload + document.write() memory corruption — Mozilla

Michal Zalewski reported a memory corruption vulnerability in Firefox 2.0.0.1 involving mixing the onUnload event handler and self-modifying document.write calls. This flaw was introduced in Firefox 2.0.0.1 and 1.5.0.9 and does not affect earlier versions; it is fixed in Firefox 2.0.0.2 and 1.5.0...

9.3CVSS2.1AI score0.07069EPSS
SaveExploits1References2Affected Software2
Mozilla
Mozilla
added 2007/02/23 12:0 a.m.41 views

Improvements to help protect against Cross-Site Scripting attacks — Mozilla

Firefox 2.0.0.2 and 1.5.0.10 contain several small changes that will make it easier for sites to protect their visitors against Cross-Site Scripting XSS attacks. Invalid trailing characters in HTML tag attributes The Mozilla parser formerly ignored invalid trailing characters in HTML tag attribut...

5.8CVSS8AI score0.0213EPSS
SaveExploits0References11Affected Software2
Mozilla
Mozilla
added 2006/07/25 12:0 a.m.41 views

UniversalBrowserRead privilege escalation — Mozilla

shutdown reports that scripts granted the UniversalBrowserRead privilege can leverage that into the equivalent of the far more powerful UniversalXPConnect since they are allowed to "read" into a privileged context. This allows the attacker the ability to run scripts with the full privilege of the...

7.5CVSS8.8AI score0.03036EPSS
SaveExploits0References1Affected Software3
Mozilla
Mozilla
added 2006/04/13 12:0 a.m.41 views

Mail Multiple Information Disclosure — Mozilla

As a privacy measure to prevent senders primarily spammers from tracking when e-mail is read Thunderbird does not load remote content referenced from an HTML mail message until a user tells it to do so. This normally includes the content of frames and CSS files, but CrashFr showed it was possible...

2.6CVSS1.6AI score0.0486EPSS
SaveExploits2References1Affected Software1
Mozilla
Mozilla
added 2006/04/13 12:0 a.m.41 views

Accessing XBL compilation scope via valueOf.call() — Mozilla

mozbugra4 discovered that the compilation scope of privileged built-in XBL bindings was not fully protected from web content and could be accessed by calling valueOf.call and valueOf.apply on a method of that binding. This could then be used to compile and run attacker-supplied JavaScript, giving...

6.8CVSS4.9AI score0.05077EPSS
SaveExploits0References3Affected Software4
Mozilla
Mozilla
added 2005/03/22 12:0 a.m.41 views

Drag and drop loading of privileged XUL — Mozilla

A malicious page that could lure a user into dragging something such as a fake scrollbar can bypass the restriction on opening privileged XUL. The startup scripts in the XUL will run with enhanced privilege, though the actions taken upon merely opening most XUL are benign. So far no way to run...

5.1CVSS1AI score0.03307EPSS
SaveExploits1References3Affected Software2
Mozilla
Mozilla
added 2025/07/22 12:0 a.m.40 views

Security Vulnerabilities fixed in Firefox ESR 115.26 — Mozilla

On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, read the entire 64 bits. On arm64, a WASM brtable instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrec...

9.8CVSS7.8AI score0.00468EPSS
SaveExploits0References4Affected Software1
Mozilla
Mozilla
added 2023/08/29 12:0 a.m.40 views

Security Vulnerabilities fixed in Firefox ESR 115.2 — Mozilla

When receiving rendering data over IPC mStream could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been create...

8.6CVSS8.8AI score0.00688EPSS
SaveExploits0References14Affected Software1
Mozilla
Mozilla
added 2020/11/04 12:0 a.m.40 views

OAuth session fixation vulnerability in Mozilla VPN — Mozilla

An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that URL, and obtain authenticated access as that user. This issue is limited to cases where attacker and victim are sharing the same source IP...

7.6CVSS2.7AI score0.00469EPSS
SaveExploits0References3Affected Software1
Total number of security vulnerabilities1579