3269 matches found
CVE-2013-5615
CVE-2013-5615 concerns GetElementIC typed array stubs being generated outside observed typesets in the Mozilla JavaScript engine. The connected vendor notes identify affected products as Mozilla Firefox (and related Firefox ESR/Thunderbird/SeaMonkey lines in the 2013 MFSA bundle) with fixes imple...
CVE-2015-0811
CVE-2015-0811 affects Mozilla Firefox before 37.0. The QCMS implementation can read process heap memory or cause a denial of service (out-of-bounds read) when handling an image during transformation. Connected sources confirm this CVE alongside related Firefox/GNU/Linux ecosystem fixes (MFSA-2015...
CVE-2015-0814
CVE-2015-0814 is one of multiple browser-engine vulnerabilities in Mozilla Firefox (and Thunderbird ESR) addressed in MFSA advisories. The issue affects Firefox before 37.0 (and ESR 31.x before 31.6) and can enable remote attackers to cause memory corruption and application crashes or potentially...
CVE-2015-4481
CVE-2015-4481 is a concrete vulnerability in Mozilla Maintenance Service on Windows where a hard-link race allows arbitrary file overwriting, enabling local privilege escalation. Public documentation across connected sources confirms the issue affects Windows Firefox/maintenance service and was a...
CVE-2016-1523
CVE-2016-1523 concerns Graphite 2 Libgraphite’s SillMap::readFace in FeatureMap.cpp, used by Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1. A mis-handled return value can allow remote attackers to cause denial of service via a crafted Graphite smart font. Affected component is Gr...
CVE-2016-5275
CVE-2016-5275 is a Firefox vulnerability: a buffer overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions during canvas rendering with empty filters could allow remote code execution. Affected products/versions: Mozilla Firefox up to 49.0 prior to 49.0 (Firefox 49.x era). Exploitatio...
CVE-2019-11700
Mozilla Firefox before version 67 is affected by CVE-2019-11700 due to improper handling of the res: protocol. A hyperlink using res: could cause local-file access at a known location in Internet Explorer when a user approves execution, with the issue confined to Windows. The vulnerability is roo...
CVE-2023-29538
CVE-2023-29538 affects Firefox (and Focus) on Android: under specific WebExtension load circumstances a jar:file:/// URI could be exposed instead of moz-extension:///, leaking local directory paths. Affected: Firefox for Android <112, Firefox <112, and Focus for Android
CVE-2023-6869
CVE-2023-6869 affects Mozilla Firefox older than 121. The issue arises when a element could be manipulated to render content outside a sandboxed iframe, allowing untrusted content to masquerade as trusted content. Impact per sources is user-facing trust bypass with potential to display misleadin...
CVE-2023-6873
CVE-2023-6873 is a memory-safety vulnerability reported in Mozilla Firefox affecting versions older than 121. The issue involves memory corruption in Firefox 120-era code paths that could potentially be exploited to execute arbitrary code. Connected advisories (e.g., MFSA2023-56) corroborate wide...
CVE-2010-1207
CVE-2010-1207 concerns Mozilla Firefox and Thunderbird where a cross-origin canvas read restriction can be bypassed. The description in the connected documents states that Firefox before 3.6.7 and Thunderbird before 3.1.1 do not properly enforce read restrictions for CANVAS elements, allowing a r...
CVE-2012-1958
CVE-2012-1958 is a use-after-free vulnerability in Mozilla Firefox’s nsGlobalWindow::PageHidden path that could allow remote code execution. The vulnerability affects Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2...
CVE-2012-4181
CVE-2012-4181 is a use-after-free in Mozilla Firefox's nsSMILAnimationController::DoSample that can lead to remote code execution or a denial of service (heap memory corruption). Affected products include Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunde...
CVE-2013-0773
CVE-2013-0773 corresponds to a vulnerability in the Chrome Object Wrapper (COW) and System Only Wrapper (SOW) security wrappers in Mozilla-based products. The issue allowed modifications to a prototype, enabling a non-specified remote site to access chrome objects or potentially execute JavaScrip...
CVE-2013-1699
CVE-2013-1699 affects Mozilla Firefox before 22.0. The IDN display algorithm mishandles .com/.net/.name, allowing spoofing of the address bar via homograph characters. The MFSA advisory MFSA2013-61 documents the issue; openSUSE/other advisories show a fix in Firefox 22.0 (e.g., openSUSE-SU-2013-5...
CVE-2013-1708
Summary (CVE-2013-1708) : Mozilla Firefox before 23.0 and SeaMonkey before 2.20 were vulnerable to a denial-of-service via a crafted WAV file that is not properly handled by nsCString::CharAt, causing an application crash. OpenSUSE/SUSE advisories (and the Gentoo GLSA reference) link this CVE to ...
CVE-2014-1563
Mozilla Firefox before 32.0 (and ESR 31.x before 31.1) and Thunderbird 31.x before 31.1 are affected by a use-after-free in mozilla::DOMSVGLength::GetTearOff triggered by an SVG animation with DOM interactions, enabling remote code execution or a denial of service via heap memory corruption. Upgr...
CVE-2015-4518
Mozilla Firefox CVE-2015-4518 describes an improper Reader View whitelist that can bypass CSP protections, enabling cross-site scripting via SVG-related vectors and the about:reader URL in Firefox versions before 42.0. Affected product: Firefox Reader View. Root cause: overly permissive allowlist...
CVE-2016-2805
CVE-2016-2805 affects Mozilla Firefox ESR 38.x prior to 38.8. A memory safety issue in the browser engine may allow memory corruption, crashes, or possibly arbitrary code execution via unknown vectors. Debian/Arch/CentOS advisories confirm the fix is to upgrade to Firefox ESR 38.8.0 (and related ...
CVE-2016-7152
CVE-2016-7152 is described in IBM Security Bulletin as a HEIST-related vulnerability affecting the Firefox component of the IBM Synthetic Playback agent used with IBM Application Performance Management (APM) 8.1.3 and IBM Cloud Application Performance Management. The root cause is that the HTTPS ...
CVE-2017-5413
CVE-2017-5413 : A segmentation fault can occur during bidirectional layout operations in Mozilla Firefox and Thunderbird. Affected products include Firefox and Thunderbird versions earlier than 52 (Firefox 52.x, Thunderbird 52.x) with the root cause described as a crash in bidirectional processin...
CVE-2017-5453
CVE-2017-5453 affects Mozilla Firefox
CVE-2018-5105
CVE-2018-5105 affects Firefox before 58. WebExtensions can bypass prompts to first save and then open a downloaded file, enabling an executable to run with local user privileges without explicit consent. Remedy: upgrade Firefox to 58 or later (addressed in the MFSA advisory).
CVE-2018-5111
CVE-2018-5111 describes a spoofing vulnerability in Mozilla Firefox where dragging the text of a specially formatted URL from page content into the address bar can cause the address bar to display a different URL than the one actually loaded. This can enable phishing by misleading users about the...
CVE-2018-5122
CVE-2018-5122 : A potential integer overflow in the WebCrypto DoCrypt function could lead to an out-of-bounds write. Affected product is Mozilla Firefox prior to version 58. This is documented across sources referencing Firefox WebCrypto vulnerability details and MFSA advisory context, confirming...
CVE-2018-5141
CVE-2018-5141 is a vulnerability in the Firefox Push API where notifications can be triggered by web content via service workers without direct user interaction, potentially allowing opening new tabs or displaying content from arbitrary URLs. The connected documents confirm this affects Firefox v...
CVE-2022-46885
CVE-2022-46885: Memory-safety bugs in Mozilla Firefox 105 allow the potential execution of arbitrary code in Firefox versions before 106. The affected product is Mozilla Firefox; root cause is memory corruption. The connected documents confirm the vulnerability but do not provide an explicit reme...
CVE-2026-14241
CVE-2026-14241 is a memory-safety issue in Firefox 152.0.3 that could potentially be exploited to execute arbitrary code. The issue affects Firefox desktop builds and was fixed in Firefox 152.0.4. Multiple connected sources confirm the same root cause: memory-safety bugs leading to memory corrupt...
CVE-2026-16367
CVE-2026-16367 affects Mozilla Firefox versions earlier than 153.0. The Sandboxing escape is due to an invalid pointer in the Disability Access APIs component, with the vulnerability fixed in Firefox 153. The CVSS v3.1 base score is 10.0 (CRITICAL), with Network attack vector, Low attack complexi...
CVE-2007-3656
Mozilla Firefox 1.8.x and earlier versions are affected by CVE-2007-3656 due to not performing a security zone check for wyciwyg URIs. The issue allows a remote attacker to obtain sensitive information, potentially poison the browser cache, and may enable further attack vectors via HTTP 302 redir...
CVE-2008-0415
CVE-2008-0415 affects Mozilla Firefox < 2.0.0.12, Thunderbird < 2.0.0.12, and SeaMonkey
CVE-2009-3078
CVE-2009-3078 affects Mozilla Firefox: visual truncation allows spoofing the address bar by using Unicode with tall line-height, enabling a remote attacker to hide/alter URL display. Affected versions are Firefox before 3.0.14 and 3.5.x before 3.5.3; fixes exist in Firefox 3.0.14 and 3.5.3. Multi...
CVE-2010-3166
CVE-2010-3166 concerns a heap-based buffer overflow in Mozilla code (nsTextFrameUtils::TransformText) that could allow remote code execution via a bidirectional text run. Affected products/versions: Firefox before 3.5.12 and 3.6.x before 3.6.9; Thunderbird before 3.0.7 and 3.1.x before 3.1.3; Sea...
CVE-2012-3994
Mode C: CVE-2012-3994 affects Mozilla Firefox family and related Mozilla components (e.g., Firefox, Firefox ESR, Thunderbird, SeaMonkey). Root cause: use of Object.defineProperty to shadow the top object and interaction with top.location, enabling remote XSS via a binary plugin. Affected versions...
CVE-2015-0835
CVE-2015-0835 refers to multiple unspecified vulnerabilities in the Mozilla Firefox browser engine, fixed by upgrading Firefox to 36.0 or later. The issue (reported for Firefox before 36.0) could allow remote attackers to cause a memory corruption and application crash (DoS) and, possibly, execut...
CVE-2015-7216
Mozilla Firefox before 43.0 on Linux GNOME platforms is affected by CVE-2015-7216 due to gdk-pixbuf configuration that incorrectly enables the JasPer JPEG-2000 decoder. A crafted JPEG 2000 image can cause a denial of service and possibly other impact. The vulnerability is tied to the 43.x Firefox...
CVE-2016-1522
CVE-2016-1522 affects Graphite 2 Libgraphite (Graphite2 1.2.4) used in Firefox/Firefox ESR before 43.0. Code.cpp does not account for recursive load calls during a size check, enabling a remote attacker to trigger a denial of service (heap-based buffer overflow) or possibly execute arbitrary code...
CVE-2016-5266
CVE-2016-5266 affects Mozilla Firefox before 48.0. The vulnerability arises from Firefox not properly restricting drag-and-drop (dataTransfer) actions for file: URIs, allowing user-assisted attackers to access local files via a crafted web site. Multiple connected advisories confirm the issue and...
CVE-2016-5289
CVE-2016-5289 refers to memory safety bugs reported in Firefox 49 that showed evidence of memory corruption and could enable arbitrary code execution. The vulnerability affects Firefox versions older than 50, and multiple connected advisories indicate fixes were deployed in Firefox 50 (MFSA 2016-...
CVE-2016-9894
CVE-2016-9894 : A buffer overflow in SkiaGL occurs when a GrGLBuffer is truncated during allocation, leading to overflow by later writers. Affects Mozilla Firefox <= 50.0.x (reported for Firefox
CVE-2017-7796
CVE-2017-7796 is a Windows-specific vulnerability in Mozilla Firefox prior to version 55 where the updater’s logger deletes update.log before writing a new log. The updater’s command-line argument specifies the log path, which could be abused with a local exploit to cause the deletion of a differ...
CVE-2017-7797
CVE-2017-7797 affects Firefox versions prior to 55.0. The issue arises from how response header names are interned: header names are stored in a global registry and are not protected by same-origin policies, allowing stored header names to be exposed across origins. Public documentation in the co...
CVE-2018-12381
Concretely, CVE-2018-12381 affects Mozilla Firefox ESR < 60.2 and Firefox
CVE-2018-5119
The CVE-2018-5119 issue affects Mozilla Firefox versions earlier than 58. In Reader View, cross-origin content could be displayed when CORS headers prohibit loading cross-origin content, potentially allowing access to restricted content. Mitigation: upgrade to Firefox 58 or newer where this is fi...
CVE-2018-5132
CVE-2018-5132 : The Find API for WebExtensions in Firefox can search privileged pages (for example, about:debugging) when those pages are open in a tab, potentially exposing protected data. Affected products/versions: Firefox
CVE-2023-25740
CVE-2023-25740 affects Firefox for Windows (pre-110). After downloading a Windows .scf script from the local filesystem, an attacker could specify a remote path that triggers unexpected network requests by the OS and may leak NTLM credentials. Impact is limited to Firefox on Windows; other OSes a...
CVE-2007-3735
CVE-2007-3735 affects Mozilla Firefox before 2.0.0.5 and Thunderbird before 2.0.0.5. The vulnerability is in the JavaScript engine and can cause a remote crash via memory corruption, as described in the initial entry. Connected advisories also reference patches to address these issues (e.g., Fire...
CVE-2009-3388
CVE-2009-3388 affects Mozilla Firefox 3.5.x prior to 3.5.6 and SeaMonkey prior to 2.0.1, with the underlying issue described as memory safety problems. Public disclosures in multiple advisories indicate that the vulnerability involves memory-safety issues in the liboggplay library (memory safety ...
CVE-2010-0170
Technical details about CVE-2010-0170 are not provided in the connected documents. Public details appear limited to the initial description in this entry. Monitor for updates and new disclosures in authoritative advisories. The supplied documents do not specify affected products, versions, root c...