Lucene search
+L
MozillaMost viewed

1579 matches found

Mozilla
Mozilla
added 2008/07/15 12:0 a.m.42 views

Remote code execution by overflowing CSS reference counter — Mozilla

An anonymous researcher, via TippingPoint's Zero Day Initiative program, reported a vulnerability in Mozilla's internal CSSValue array data structure. The vulnerability was caused by an insufficiently sized variable being used as a reference counter for CSS objects. By creating a very large numbe...

9.3CVSS3AI score0.05284EPSS
SaveExploits1References2Affected Software3
Mozilla
Mozilla
added 2008/02/07 12:0 a.m.42 views

Privilege escalation, XSS, Remote Code Execution — Mozilla

Mozilla contributors mozbugra4 and Boris Zbarsky submitted a series of vulnerabilities which allow scripts from page content to escape from its sandboxed context and/or run with chrome privileges. An additional vulnerability reported by mozbugra4 demonstrated that the XMLDocument.load function ca...

4.3CVSS5.3AI score0.02205EPSS
SaveExploits1References2Affected Software3
Mozilla
Mozilla
added 2008/02/07 12:0 a.m.42 views

Crashes with evidence of memory corruption (rv:1.8.1.12) — Mozilla

Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox 2.0.0.12 and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these coul...

9.3CVSS2.8AI score0.03304EPSS
SaveExploits1References4Affected Software3
Mozilla
Mozilla
added 2006/12/19 12:0 a.m.42 views

Crashes with evidence of memory corruption (rv:1.8.0.9/1.8.1.1) — Mozilla

As part of the Firefox 2.0.0.1 and 1.5.0.9 update releases we fixed several bugs to improve the stability of the product. Some of these were crashes that showed evidence of memory corruption and we presume that at least some of these could be exploited to run arbitrary code with enough effort...

6.8CVSS2AI score0.04324EPSS
SaveExploits0References22Affected Software3
Mozilla
Mozilla
added 2006/11/07 12:0 a.m.42 views

Crashes with evidence of memory corruption (rv:1.8.0.8) — Mozilla

As part of the Firefox 1.5.0.8 release we fixed several bugs to improve the stability of the product. Some of these were crashes that showed evidence of memory corruption and we presume that at least some of these could be exploited to run arbitrary code with enough effort...

7.5CVSS1.9AI score0.05531EPSS
SaveExploits0References18Affected Software3
Mozilla
Mozilla
added 2006/09/14 12:0 a.m.42 views

Crashes with evidence of memory corruption (rv:1.8.0.7) — Mozilla

As part of the Firefox 1.5.0.7 release we fixed several bugs to improve the stability of the product. Some of these were crashes that showed evidence of memory corruption and we presume that at least some of these could be exploited to run arbitrary code with enough effort...

10CVSS1.9AI score0.0544EPSS
SaveExploits0References29Affected Software3
Mozilla
Mozilla
added 2006/04/21 12:0 a.m.42 views

JavaScript execution in mail when forwarding in-line — Mozilla

Georgi Guninski reports that forwarding mail in-line while using the default HTML "rich mail" editor will execute JavaScript embedded in the e-mail message. Forwarding mail in-line is not the default setting but it is easily accessed through the "Forward As" menu item...

9.3CVSS0.6AI score0.07066EPSS
SaveExploits2References1Affected Software3
Mozilla
Mozilla
added 2006/04/13 12:0 a.m.42 views

Crashes with evidence of memory corruption (rv:1.8) — Mozilla

As part of the Firefox 1.5 release we fixed several crash bugs to improve the stability of the product. Some of these crashes showed evidence of memory corruption that we presume could be exploited to run arbitrary code and have been applied to the Firefox 1.0.x and Mozilla Suite 1.7.x releases...

10CVSS2.5AI score0.08251EPSS
SaveExploits0References6Affected Software4
Mozilla
Mozilla
added 2024/03/22 12:0 a.m.41 views

Security Vulnerabilities fixed in Firefox ESR 115.9.1 — Mozilla

An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does not affect mobile versions of Firefox...

8.4CVSS6.4AI score0.047EPSS
SaveExploits0References1Affected Software1
Mozilla
Mozilla
added 2023/12/19 12:0 a.m.41 views

Security Vulnerabilities fixed in Firefox ESR 115.6 — Mozilla

The WebGL DrawElementsInstanced method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. EncryptingOutputStream was susceptible to exposing uninitialized data. This issue...

8.8CVSS9AI score0.20472EPSS
SaveExploits0References11Affected Software1
Mozilla
Mozilla
added 2021/09/07 12:0 a.m.41 views

Security Vulnerabilities fixed in Thunderbird 91.1 — Mozilla

When delegating navigations to the operating system, Thunderbird would accept the mk scheme which might allow attackers to launch pages and execute scripts in Internet Explorer in unprivileged mode. This bug only affects Thunderbird for Windows. Other operating systems are unaffected. Mozilla...

8.8CVSS2.5AI score0.01118EPSS
SaveExploits1References2Affected Software1
Mozilla
Mozilla
added 2016/08/02 12:0 a.m.41 views

Form input type change from password to text can store plain text password in session restore file — Mozilla

Mozilla employee Mike Kaply reported that the Firefox session restore data can contain passwords in plain text if a password input field on a page has its type changed from "password" to "text" during a session. This can occur if the password input field has a scripted mechanism to display the...

6.5CVSS7.8AI score0.01379EPSS
SaveExploits0References2Affected Software1
Mozilla
Mozilla
added 2016/04/26 12:0 a.m.41 views

Use-after-free and buffer overflow in Service Workers — Mozilla

Security researcher Looben Yang reported two issues discovered in Service Workers using Address Sanitizer...

8.8CVSS8AI score0.0294EPSS
SaveExploits0References4Affected Software1
Mozilla
Mozilla
added 2016/01/26 12:0 a.m.41 views

Missing delay following user click events in protocol handler dialog — Mozilla

Security researcher window reported an issue where the protocol handler dialog appears, double click events are treated as two single click events. This was caused by the lack of a delay following the initial focus in the file download dialog. This could cause a second dialog to be sent the secon...

6.1CVSS7.5AI score0.01256EPSS
SaveExploits0References2Affected Software1
Mozilla
Mozilla
added 2015/12/30 12:0 a.m.41 views

Lockscreen delay bypass in Firefox OS — Mozilla

Frederik Braun of Mozilla discovered a bug in the lockscreen state logic that allows an attacker to bypass the lockscreen delay. The delay was introduced to make it harder to brute-force the passcode lock of a Firefox OS device when an attacker has gained physical access. A successful attack woul...

4.6CVSS5.2AI score0.00315EPSS
SaveExploits0References2Affected Software1
Mozilla
Mozilla
added 2015/12/15 12:0 a.m.41 views

Firefox allows for control characters to be set in cookies — Mozilla

Security researcher musicDespiteEverything reported an issue when ASCII code 11 for vertical tab is stored in a cookie in violation of RFC6265. This may result in incorrect cookie handling by servers, resulting in the potential ability to set cookie values and read cookie data from users in conce...

5CVSS7.3AI score0.0239EPSS
SaveExploits0References2Affected Software1
Mozilla
Mozilla
added 2015/08/11 12:0 a.m.41 views

Overflow issues in libstagefright — Mozilla

An anonymous researcher reported, via TippingPoint's Zero Day Initiative, two integer overflows in the libstagefright library that could be triggered by a malicious 'saio' chunk in an MPEG4 video. These overflows allowed for potential arbitrary code execution. This issue was independently reporte...

10CVSS7.7AI score0.09027EPSS
SaveExploits0References7Affected Software3
Mozilla
Mozilla
added 2015/08/11 12:0 a.m.41 views

Arbitrary file overwriting through Mozilla Maintenance Service with hard links — Mozilla

Security researcher James Forshaw, security researcher with Google Project Zero, reported that the Mozilla Maintenance Service on Windows can be made to write its log file in a restricted location with an arbitrary file name through the use of a hard link by means of a race condition. This can...

3.3CVSS9.2AI score0.00797EPSS
SaveExploits2References2Affected Software4
Mozilla
Mozilla
added 2015/08/11 12:0 a.m.41 views

Feed protocol with POST bypasses mixed content protections — Mozilla

Security researcher Masato Kinugawa reported that opening a target page using a POST to the url prefixed with the feed: protocol disables the mixed content blocker for that page. This could allow for the risk of a man-in-the-middle MITM scripting attack on pages that accidentally include insecure...

4.3CVSS8.4AI score0.01511EPSS
SaveExploits0References2Affected Software2
Mozilla
Mozilla
added 2015/05/12 12:0 a.m.41 views

Out-of-bounds read and write in asm.js validation — Mozilla

Security researcher Dougall Johnson reported an out-of-bounds read and write in asm.js during JavaScript validation due to an error in how heap lengths are defined. This results in a potentially exploitable crash and could allow for the reading of random memory which may contain sensitive data...

7.5CVSS8.8AI score0.03771EPSS
SaveExploits0References2Affected Software2
Mozilla
Mozilla
added 2015/03/31 12:0 a.m.41 views

Cursor clickjacking with flash and images — Mozilla

Security researcher Jordi Chancel reported a mechanism that made cursor invisible through flash content and then replaced it through the layering of HTML content. This flaw can be in used in combination with an image of the cursor manipulated through JavaScript, leading to clickjacking during...

4.3CVSS8.7AI score0.0147EPSS
SaveExploits0References2Affected Software2
Mozilla
Mozilla
added 2014/06/10 12:0 a.m.41 views

Out of bounds write in NSPR — Mozilla

Security researcher Abhishek Arya Inferno of the Google Chrome Security Team reported an out of bounds write in the Netscape Portable Runtime NSPR leading to a potentially exploitable crash or code execution. This issue is fixed in NSPR version 4.10.6...

10CVSS8.8AI score0.06329EPSS
SaveExploits0References3Affected Software1
Mozilla
Mozilla
added 2014/04/29 12:0 a.m.41 views

Out-of-bounds write in Cairo — Mozilla

Security researcher Jukka Jylänki reported a crash in the the Cairo graphics library. This happens when Cairo paints out-of-bounds to the destination buffer in the compositing function when working with canvas in certain circumstances. This issue allows malicious web content to cause a potentiall...

10CVSS8.8AI score0.05601EPSS
SaveExploits0References2Affected Software2
Mozilla
Mozilla
added 2013/09/17 12:0 a.m.41 views

Improper state in HTML5 Tree Builder with templates — Mozilla

Using the Address Sanitizer tool, security researcher Atte Kettunen from OUSPG found that the HTML5 Tree Builder does not properly store state when interacting with template elements. Because some stack information is incorrectly stored, the template insertion mode stack can be used when it is...

6.8CVSS1.9AI score0.03991EPSS
SaveExploits0References2Affected Software3
Mozilla
Mozilla
added 2013/09/17 12:0 a.m.41 views

WebGL Information disclosure through OS X NVIDIA graphic drivers — Mozilla

Mozilla developer Victor Porof reported a flaw in the NVIDIA OS X graphic drivers that would allow portions of a user's desktop or other visible applications to be incorporated into WebGL canvases. This could result in personal information becoming available to web content...

2.6CVSS5.7AI score0.01233EPSS
SaveExploits0References2Affected Software1
Mozilla
Mozilla
added 2013/09/17 12:0 a.m.41 views

Calling scope for new Javascript objects can lead to memory corruption — Mozilla

Mozilla community member Ms2ger found a mechanism where a new Javascript object with a compartment is uninitialized could be entered through web content. When the scope for this object is called, it leads to a potentially exploitable crash...

6.8CVSS1.7AI score0.04013EPSS
SaveExploits0References2Affected Software5
Mozilla
Mozilla
added 2013/04/02 12:0 a.m.41 views

Memory corruption while rendering grayscale PNG images — Mozilla

Mozilla community member Tobias Schula reported that if gfx.colormanagement.enablev4 preference is enabled manually in about:config, some grayscale PNG images will be rendered incorrectly and cause memory corruption during PNG decoding when certain color profiles are in use. A crafted PNG image...

4.3CVSS6.1AI score0.01382EPSS
SaveExploits0References2Affected Software2
Mozilla
Mozilla
added 2013/04/02 12:0 a.m.41 views

World read and write access to app_tmp directory on Android — Mozilla

Security researcher Shuichiro Suzuki of the Fourteenforty Research Institute reported the apptmp directory is set to be world readable and writeable by Firefox for Android. This potentially allows for third party applications to replace or alter Firefox add-ons when downloaded because they are...

4.3CVSS5.9AI score0.00994EPSS
SaveExploits0References2Affected Software1
Mozilla
Mozilla
added 2011/09/27 12:0 a.m.41 views

Integer underflow when using JavaScript RegExp — Mozilla

Mark Kaplan reported a potentially exploitable crash due to integer underflow when using a large JavaScript RegExp expression. We would also like to thank Mark for contributing the fix for this problem...

10CVSS2.8AI score0.05324EPSS
SaveExploits0References2Affected Software1
Mozilla
Mozilla
added 2011/08/16 12:0 a.m.41 views

Security issues addressed in Firefox 3.6.20 — Mozilla

Miscellaneous memory safety hazards rv:1.9.2.20 Impact: Critical Description: Mozilla developers and community members identified and fixed several memory safety bugs in the browser engine used in Firefox 3.6 and other Mozilla-based products. Some of these bugs showed evidence of memory corruptio...

10CVSS10AI score0.05562EPSS
SaveExploits5References14Affected Software1
Mozilla
Mozilla
added 2010/03/30 12:0 a.m.41 views

XMLDocument::load() doesn't check nsIContentPolicy — Mozilla

Mozilla community member Wladimir Palant reported that XML documents were failing to call certain security checks when loading new content. This could result in certain resources being loaded that would otherwise violate security policies set by the browser or installed add-ons...

4.3CVSS9.4AI score0.0119EPSS
SaveExploits0References2Affected Software3
Mozilla
Mozilla
added 2009/12/15 12:0 a.m.41 views

Privilege escalation via chrome window.opener — Mozilla

Security researcher David James reported that a content window which is opened by a chrome window retains a reference to the chrome window via the window.opener property. Using this reference, content in the new window can access functions inside the chrome window, such as eval, and use these...

7.6CVSS1.9AI score0.03707EPSS
SaveExploits1References2Affected Software2
Mozilla
Mozilla
added 2009/08/03 12:0 a.m.41 views

Crashes with evidence of memory corruption (rv:1.9.1.2/1.9.0.13) — Mozilla

Mozilla developers and community members identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some ...

10CVSS2.6AI score0.04939EPSS
SaveExploits0References6Affected Software1
Mozilla
Mozilla
added 2008/03/25 12:0 a.m.41 views

Java socket connection to any local port via LiveConnect — Mozilla

Security researcher Gregory Fleischer demonstrated that web content fetched via the jar: protocol can use Java via LiveConnect to open socket connections to arbitrary ports on the user's machine "localhost". The issue is caused by improper parsing of the content origin passed from the browser to...

9.3CVSS2.6AI score0.05684EPSS
SaveExploits1References4Affected Software2
Mozilla
Mozilla
added 2008/02/19 12:0 a.m.41 views

Possible information disclosure in BMP decoder — Mozilla

Security researcher Gynvael Coldwind of Vexillium crediting help from udevd and porneL demonstrated that BMP images could be used to reveal small chunks of uninitialized memory that might contain sensitive data from other pages or other programs, and that this data could be extracted from the ima...

9.3CVSS1.2AI score0.02224EPSS
SaveExploits1References2Affected Software2
Mozilla
Mozilla
added 2007/10/18 12:0 a.m.41 views

File input focus stealing vulnerability — Mozilla

A user on the Sla.ckers.org forums named hong reported that a file upload control could be filled programmatically by switching page focus to the label before a file upload form control for selected keyboard events. An attacker could use this trick to steal files from the users' computer if the...

4.3CVSS0.8AI score0.09825EPSS
SaveExploits4References4Affected Software2
Mozilla
Mozilla
added 2007/10/18 12:0 a.m.41 views

URIs with invalid %-encoding mishandled by Windows — Mozilla

On Windows XP with Internet Explorer 7 installed several "web related" URI schemes do not launch the registered protocol-handler if the URI contains an invalid %-encoded sequence. This was initially reported by Billy Rios and Nate McFeters with additional investigation by Secunia. A patch that...

9.3CVSS6.1AI score0.02648EPSS
SaveExploits0References3Affected Software3
Mozilla
Mozilla
added 2007/07/17 12:0 a.m.41 views

Remote code execution by launching Firefox from Internet Explorer — Mozilla

Internet Explorer calls registered URL protocols without escaping quotes and may be used to pass unexpected and potentially dangerous data to the application that registers that URL Protocol...

4.3CVSS4.8AI score0.29355EPSS
SaveExploits4References2Affected Software3
Mozilla
Mozilla
added 2007/05/30 12:0 a.m.41 views

XSS using addEventListener — Mozilla

Mozilla contributor mozbugra4 demonstrated that the addEventListener method could be used to inject script into another site in violation of the browser's same-origin policy. This could be used to access or modify private or valuable information from that other site...

4.3CVSS2.9AI score0.01649EPSS
SaveExploits0References3Affected Software2
Mozilla
Mozilla
added 2007/02/25 12:0 a.m.41 views

onUnload + document.write() memory corruption — Mozilla

Michal Zalewski reported a memory corruption vulnerability in Firefox 2.0.0.1 involving mixing the onUnload event handler and self-modifying document.write calls. This flaw was introduced in Firefox 2.0.0.1 and 1.5.0.9 and does not affect earlier versions; it is fixed in Firefox 2.0.0.2 and 1.5.0...

9.3CVSS2.1AI score0.07069EPSS
SaveExploits1References2Affected Software2
Mozilla
Mozilla
added 2007/02/23 12:0 a.m.41 views

Improvements to help protect against Cross-Site Scripting attacks — Mozilla

Firefox 2.0.0.2 and 1.5.0.10 contain several small changes that will make it easier for sites to protect their visitors against Cross-Site Scripting XSS attacks. Invalid trailing characters in HTML tag attributes The Mozilla parser formerly ignored invalid trailing characters in HTML tag attribut...

5.8CVSS8AI score0.0213EPSS
SaveExploits0References11Affected Software2
Mozilla
Mozilla
added 2006/07/25 12:0 a.m.41 views

UniversalBrowserRead privilege escalation — Mozilla

shutdown reports that scripts granted the UniversalBrowserRead privilege can leverage that into the equivalent of the far more powerful UniversalXPConnect since they are allowed to "read" into a privileged context. This allows the attacker the ability to run scripts with the full privilege of the...

7.5CVSS8.8AI score0.03036EPSS
SaveExploits0References1Affected Software3
Mozilla
Mozilla
added 2006/07/25 12:0 a.m.41 views

JavaScript engine vulnerabilities — Mozilla

Continuing our security audit of the JavaScript engine, Mozilla developers found and fixed several potential vulnerabilities...

7.5CVSS3.9AI score0.06476EPSS
SaveExploits0References14Affected Software3
Mozilla
Mozilla
added 2006/04/13 12:0 a.m.41 views

Mail Multiple Information Disclosure — Mozilla

As a privacy measure to prevent senders primarily spammers from tracking when e-mail is read Thunderbird does not load remote content referenced from an HTML mail message until a user tells it to do so. This normally includes the content of frames and CSS files, but CrashFr showed it was possible...

2.6CVSS1.6AI score0.0486EPSS
SaveExploits2References1Affected Software1
Mozilla
Mozilla
added 2006/04/13 12:0 a.m.41 views

Accessing XBL compilation scope via valueOf.call() — Mozilla

mozbugra4 discovered that the compilation scope of privileged built-in XBL bindings was not fully protected from web content and could be accessed by calling valueOf.call and valueOf.apply on a method of that binding. This could then be used to compile and run attacker-supplied JavaScript, giving...

6.8CVSS4.9AI score0.05077EPSS
SaveExploits0References3Affected Software4
Mozilla
Mozilla
added 2005/03/22 12:0 a.m.41 views

Drag and drop loading of privileged XUL — Mozilla

A malicious page that could lure a user into dragging something such as a fake scrollbar can bypass the restriction on opening privileged XUL. The startup scripts in the XUL will run with enhanced privilege, though the actions taken upon merely opening most XUL are benign. So far no way to run...

5.1CVSS1AI score0.03307EPSS
SaveExploits1References3Affected Software2
Mozilla
Mozilla
added 2025/07/22 12:0 a.m.40 views

Security Vulnerabilities fixed in Firefox ESR 115.26 — Mozilla

On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, read the entire 64 bits. On arm64, a WASM brtable instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrec...

9.8CVSS7.8AI score0.00468EPSS
SaveExploits0References4Affected Software1
Mozilla
Mozilla
added 2025/04/29 12:0 a.m.40 views

Security Vulnerabilities fixed in Firefox 138 — Mozilla

Mozilla Firefox's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file...

9.1CVSS7.9AI score0.00609EPSS
SaveExploits0References11Affected Software1
Mozilla
Mozilla
added 2023/08/29 12:0 a.m.40 views

Security Vulnerabilities fixed in Firefox ESR 115.2 — Mozilla

When receiving rendering data over IPC mStream could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been create...

8.6CVSS8.8AI score0.00688EPSS
SaveExploits0References14Affected Software1
Mozilla
Mozilla
added 2020/11/04 12:0 a.m.40 views

OAuth session fixation vulnerability in Mozilla VPN — Mozilla

An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that URL, and obtain authenticated access as that user. This issue is limited to cases where attacker and victim are sharing the same source IP...

7.6CVSS2.7AI score0.00469EPSS
SaveExploits0References3Affected Software1
Total number of security vulnerabilities1579