3269 matches found
CVE-2016-9896
CVE-2016-9896 is a use-after-free in WebVR affecting Mozilla Firefox versions before 50.1, specifically when manipulating the navigator object. The impact is denial of memory safety, with potential arbitrary code execution and memory corruption as described in the vulnerability notes. Firefox 50....
CVE-2017-5377
Concrete details found: CVE-2017-5377 is a memory–corruption vulnerability in Skia triggered when using transforms to create gradients, affecting Firefox versions earlier than 51.0.1. The underlying issue is a memory-safety defect in Skia that can cause a crash and potentially enable exploitation...
CVE-2018-5115
CVE-2018-5115 is a vulnerability in Firefox prior to version 58 where an HTTP authentication prompt triggered by a background network request can be displayed over the current foreground page, potentially confusing users about the request origin and leading them to submit credentials to a third p...
CVE-2018-5126
CVE-2018-5126 affects Firefox versions before 59.0. The issue is memory-safety bugs in Firefox 58 that can cause memory corruption and potentially allow arbitrary code execution. Affected product: Firefox < 59. Remediation: update to Firefox 59.0 or newer. The connected documents corroborate t...
CVE-2018-5153
CVE-2018-5153 affects Mozilla Firefox before 60.0. When websocket data is sent with mixed text and binary in a single message, the binary data can be corrupted, causing an out-of-bounds read and the read memory being sent back to the origin server. The issue is fixed in Firefox 60.0; upgrade to 6...
CVE-2018-5172
CVE-2018-5172 : The Live Bookmarks page and PDF viewer in Firefox allow execution of injected script when a user pastes script content from the clipboard while viewing RSS feeds or PDF files. This could enable social engineering to run code in the page context, but does not grant privilege escala...
CVE-2019-9814
CVE-2019-9814 affects Mozilla Firefox before version 67.0. The issue comprises memory safety bugs that could allow memory corruption and, with enough effort, potentially arbitrary code execution. The vulnerability is documented as memory safety bugs in Firefox 66 that are fixed in Firefox 67.0. I...
CVE-2022-45417
The CVE-2022-45417 entry corresponds to Mozilla Firefox prior to version 107, where Service Workers failed to detect Private Browsing Mode in all cases. This could cause Service Workers to be written to disk for sites visited in Private Browsing Mode, potentially leaking Private Browsing details ...
CVE-2022-46884
CVE-2022-46884 corresponds to a use-after-free in Firefox SVG Images when the Refresh Driver is destroyed at an inopportune moment, leading to memory corruption or a potentially exploitable crash. Affected product: Firefox (desktop). Impact as described: memory safety issue with SVG Images; prior...
CVE-2023-6872
CVE-2023-6872 concerns Mozilla Firefox earlier than 121, where GNOME leaked browser tab titles to system logs, potentially exposing user browsing habits in private tabs. Affected product: Firefox
CVE-2007-3736
CVE-2007-3736 is a cross-site scripting vulnerability affecting Mozilla-derived browsers (notably SeaMonkey and Firefox) described as a timing issue that allows arbitrary web script execution in another site’s context by manipulating addEventListener or setTimeout during context changes. The conn...
CVE-2008-0592
CVE-2008-0592 affects Mozilla Firefox (before 2.0.0.12) and SeaMonkey (before 1.1.8). The root cause is improper handling of a plain/text file delivered with Content-Disposition: attachment and an invalid Content-Type: plain/text, which prevents the browser from rendering subsequent plain text fi...
CVE-2009-3274
CVE-2009-3274 affects Mozilla Firefox on Linux. The vulnerability arises because the Downloads window selects files using a predictable "/tmp" pathname, allowing a local attacker to replace an arbitrary downloaded file by pre-placing a file in /tmp before the download occurs (related to the Downl...
CVE-2010-2765
CVE-2010-2765: Integer overflow in the FRAMESET cols attribute may allow remote code execution via a large number of columns. Affected products include Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7. Exploitation c...
CVE-2012-1950
CVE-2012-1950 affects Mozilla Firefox 4.x–13.0 and Firefox ESR 10.x before 10.0.6. The issue is caused by the drag-and-drop implementation that lets an attacker spoof the address bar by canceling a page load, enabling phishing-like address-bar spoofing. Remediation: upgrade to Firefox 10.0.6 or n...
CVE-2012-3959
CVE-2012-3959 describes a use-after-free in Mozilla Firefox’s nsRangeUpdater::SelAdjDeleteNode, affecting Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. The vulnerability allows remote attackers to execu...
CVE-2012-3992
CVE-2012-3992 affects Mozilla Firefox (and related Firefox-based apps) where history data is not properly handled. The flaw lets remote attackers perform cross-site scripting (XSS) or obtain sensitive POST content via a location.hash write operation combined with history navigation that loads a U...
CVE-2013-0761
CVE-2013-0761 is a use-after-free vulnerability in Firefox’s mozilla::TrackUnionStream::EndTrack that could allow remote code execution or a denial of service via heap memory corruption. Affected products include Firefox before 18.0 (and ESR 17.x before 17.0.1), Thunderbird before 17.0.2 (and ESR...
CVE-2013-0764
CVE-2013-0764 affects Mozilla Firefox (before 18.0), Firefox ESR (before 17.0.2), Thunderbird (before 17.0.2 and ESR 17.x before 17.0.2), and SeaMonkey (before 2.15). The vulnerability is a thread-safety issue in nsSOCKSSocketInfo::ConnectToProxy that can allow remote code execution through craft...
CVE-2013-1737
CVE-2013-1737 affects Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0/ESR 17.x before 17.0.9, and SeaMonkey before 2.21. The issue is that the attacker-controlled getter on DOM proxies may fail to correctly identify the this object, potentially bypassing acces...
CVE-2013-5612
CVE-2013-5612 is a cross-site scripting (XSS) vulnerability in Mozilla Firefox before 26.0 and SeaMonkey before 2.23 due to the absence of a charset parameter in the Content-Type header. Connected advisories confirm Firefox/SeaMonkey fixes in 2013–2014 releases (e.g., openSUSE SU-2013:1917, Mirac...
CVE-2014-1541
CVE-2014-1541 is a use-after-free in the RefreshDriverTimer::TickDriver function of the SMIL Animation Controller, affecting Mozilla Firefox before 30.0, Firefox ESR before 24.6, and Thunderbird before 24.6. Remote attackers could abuse crafted web content to execute arbitrary code or cause a den...
CVE-2014-1592
CVE-2014-1592 is a use-after-free in Mozilla Firefox’s nsHtml5TreeOperation (xul.dll) that enables remote code execution by adding a second root element to an HTML5 document during parsing. Affected products/versions include Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird b...
CVE-2015-0810
CVE-2015-0810 affects Mozilla Firefox on macOS prior to version 37.0. The vulnerability arises when Firefox does not ensure the cursor is visible, enabling remote attackers to perform clickjacking via a Flash object in combination with layered DIV elements and crafted JavaScript that interacts wi...
CVE-2015-7207
CVE-2015-7207 affects Mozilla Firefox before 43.0. The vulnerability arises because the IFRAME Resource Timing API times are not properly restricted, allowing a remote attacker to bypass the Same Origin Policy and exfiltrate data via crafted JavaScript that uses history.back and performance.getEn...
CVE-2016-2814
Summary: CVE-2016-2814 is a heap-based buffer overflow in libstagefright (stagefright::SampleTable::parseSampleCencInfo) that affects Mozilla Firefox and ESR releases prior to certain versions. What’s affected: Firefox <46.0, ESR <38.8 (38.x), and ESR
CVE-2016-5254
CVE-2016-5254 is a use-after-free in Firefox’s nsXULPopupManager::KeyDown affecting Firefox < 48.0 and Firefox ESR
CVE-2016-5277
The CVE-2016-5277 entry documents a use-after-free in Mozilla Firefox’s nsRefreshDriver::Tick, exploitable via interaction between timeline destruction and the Web Animations model. Affected: Mozilla Firefox before 49.0, Firefox ESR before 45.4, and Thunderbird
CVE-2017-5381
CVE-2017-5381 affects Firefox
CVE-2017-5389
CVE-2017-5389 affects Firefox versions older than 51.0. The issue arises when a WebExtension uses the mozAddonManager API to modify CSP headers and redirect script loads via host requests, enabling an attacker to install additional extensions without user permission. The connected Nessus advisori...
CVE-2017-5421
CVE-2017-5421 is reported as a print preview spoofing issue affecting Mozilla Firefox and Mozilla Thunderbird when popup windows are enabled. The vulnerability description states that a malicious site could spoof the contents of the print preview window, causing user confusion about which site is...
CVE-2017-7758
CVE-2017-7758 describes an out-of-bounds read in the Opus encoder when the number of channels in an audio stream changes during encoding. Affected products include Firefox < 54, Firefox ESR < 52.2, and Thunderbird
CVE-2018-5133
CVE-2018-5133 affects Firefox before 59, where a malicious local program can set the app.support.baseURL preference to HTML/script, which is not sanitized and can execute when loading chrome://browser/content/preferences/in-content/preferences.xul or when an EME CDM-disabled notification is shown...
CVE-2018-5135
CVE-2018-5135 affects Mozilla Firefox versions earlier than 59.0. The issue allows WebExtensions to bypass normal restrictions and use browser.tabs.executeScript to inject scripts into contexts where injection should not be allowed (e.g., other WebExtensions or unprivileged about: pages). This is...
CVE-2018-5136
CVE-2018-5136 describes a policy bypass in Mozilla Firefox where a shared worker created from a "data:" URL in one tab can be shared with another tab from a different origin, bypassing the same-origin policy. This affects Firefox versions earlier than 59. The bug is that a data URL-based shared w...
CVE-2018-5176
The CVE-2018-5176 entry describes a JSON Viewer script-injection vulnerability in Mozilla Firefox where the JSON Viewer linkifies strings that parse as URLs, including javascript: links. This could allow a user to click a malicious link and potentially expose cookies or authorization tokens withi...
CVE-2023-25741
The CVE-2023-25741 entry concerns Firefox (
CVE-2023-29545
CVE-2023-29545 describes a Windows Save As issue where Firefox/Thunderbird could resolve environment-variable-like names in suggested filenames to the current user context. Affected: Firefox and Thunderbird on Windows; versions affected per the entry are Firefox < 112, Firefox ESR < 102.10,...
CVE-2005-0752
The CVE-2005-0752 entry describes a remote code execution via the Plugin Finder Service (PFS) in Firefox, affected when a javascript: URL is used in the PLUGINSPAGE attribute of an EMBED tag. The vulnerability is tied to Firefox versions before 1.0.3, with an exploit occurring through a crafted E...
CVE-2012-0456
CVE-2012-0456 concerns the SVG Filters implementation in Mozilla Firefox (and related Mozilla products) that can allow remote attackers to obtain sensitive information from process memory via an out-of-bounds read. Affected products include Firefox versions prior to 3.6.28 and 4.x through 10.0, F...
CVE-2012-0458
CVE-2012-0458 affects Mozilla Firefox and related Mozilla products where a drag-and-drop of a javascript: URL to the home button could bypass restrictions and execute arbitrary JavaScript with chrome privileges in the about:sessionrestore context. Affected products include Firefox before 3.6.28 a...
CVE-2012-0479
CVE-2012-0479 affects Mozilla Firefox (4.x–11.0; ESR 10.x before 10.0.4), Thunderbird (5.0–11.0), and SeaMonkey (before 2.9). Root cause per description: spoofing of the address bar via an https URL for invalid RSS/Atom XML content. This enables remote attackers to mislead users about the site th...
CVE-2012-1959
CVE-2012-1959 affects Mozilla Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0 and Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11. The root cause is the failure to consider same-compartment security wrappers (SCSW) during cross-compartment wrapping, allowing r...
CVE-2012-3967
CVE-2012-3967 is a Firefox/WebGL vulnerability on Linux where the WebGL implementation fails to interact correctly with Mesa drivers when a large number of sampler uniforms are used. This can let remote attackers execute arbitrary code or cause a denial of service (stack memory corruption) via a ...
CVE-2012-4192
CVE-2012-4192 affects Mozilla Firefox 16.0, Thunderbird 16.0, and SeaMonkey 2.13 (and related ESR/derivatives) where a crafted page can bypass the Same Origin Policy and read the properties of the Location object (window.location). The root cause is described as a security check not being applied...
CVE-2012-4207
CVE-2012-4207 affects Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0 / ESR 10.x, and SeaMonkey before 2.14. The flaw in the HZ-GB-2312 charset implementation allows remote attackers to perform cross-site scripting (XSS) via a crafted document, due to imprope...
CVE-2013-0747
Technical details for CVE-2013-0747 are not publicly provided in the supplied documents. Monitor for updates.
CVE-2013-5595
CVE-2013-5595 affects the Mozilla/XUL Firefox engine. The vulnerability arises from improper memory allocation in unspecified JavaScript functions, enabling remote attackers to trigger a buffer overflow via a crafted web page. Affected are Firefox before 25.0, Firefox ESR 17.x before 17.0.10, and...
CVE-2013-5597
CVE-2013-5597 is a use-after-free vulnerability in Mozilla Firefox (and affected Mozilla platforms) caused by improper handling in nsDocLoader::doStopDocumentLoad during an offline-cache update. The issue allows remote attackers to trigger arbitrary code execution or a denial of service via a sta...