CVE-2009-0777

CVE-2009-0777 affects Mozilla Firefox (before 3.0.7), Mozilla Thunderbird (before 2.0.0.21), and SeaMonkey (before 1.1.15). The issue arises when decoding invisible characters displayed in the location bar, causing an incorrect address to be shown. This can enable remote attackers to spoof URLs a...

CVE-2011-0073

CVE-2011-0073 affects Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14. The issue arises from improper use of nsTreeRange data structures, leading to a dangling pointer which allows remote code execution via unspecified vectors. The OpenVAS/MiracleLinux entries r...

CVE-2012-0472

CVE-2012-0472 is present in the MiracleLinux AXSA:2012-874:05 advisory, which mentions Mozilla Firefox 4.x–11.0 (and related products like Thunderbird/SeaMonkey in affected lines) and links the issue to the cairo-dwrite font rendering code. The description in the initial document (and mirrored in...

CVE-2012-1938

CVE-2012-1938 affects Mozilla's browser engine and is described in the MiracleLinux AXSA:2012-857 advisory as multiple vulnerabilities in Firefox (and related components) that could allow memory corruption and remote code execution. Specifically, it impacts Mozilla Firefox before 13.0, Thunderbir...

CVE-2013-0794

CVE-2013-0794 affects Mozilla Firefox (pre-20.0) and SeaMonkey (pre-2.17) where origin spoofing of tab-modal dialogs enables phishing via crafted sites. Root cause: tab-modal dialogs did not enforce origin checks, allowing a remote site to spoof the dialog origin. Impact: potential credential/phi...

CVE-2013-1711

CVE-2013-1711 affects Mozilla Firefox (before 23.0) and SeaMonkey (before 2.20); the XrayWrapper implementation fails to properly address an XBL scope bypass caused by non-native arguments in XBL function calls. This bypass can enable remote XSS through access to an unprivileged object, as docume...

CVE-2014-1542

CVE-2014-1542 refers to a buffer overflow in the Speex resampler within the Web Audio subsystem of Mozilla Firefox, exploitable via crafted AudioBuffer parameters to achieve remote code execution. The vulnerability affects Firefox prior to version 30.0. The provided connected documents corroborat...

CVE-2014-1549

The CVE-2014-1549 vulnerability affects Mozilla Firefox (before 31.0) and Thunderbird (before 31.0). It arises in mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer where poor Web Audio buffer memory allocation enables remote code execution or a denial of service via crafted audio con...

CVE-2015-0798

CVE-2015-0798 affects Mozilla Firefox where Reader mode on Android and Desktop Firefox pre-release mishandles privileged URLs, enabling remote JavaScript execution with chrome privileges by bypassing the Same Origin Policy. Affected: Firefox before 37.0.1 (Android) and pre-release desktop builds....

CVE-2015-4515

CVE-2015-4515 affects Mozilla Firefox before 42.0: when NTLM v1 is enabled for HTTP authentication, a crafted site can trigger an NTLM type 3 exchange that causes the Workstation field (hostname) to be disclosed to remote attackers. Impact is information disclosure of hostname/windows domain info...

CVE-2016-1967

CVE-2016-1967 affects Mozilla Firefox before 45.0: a Same Origin Policy bypass via IFRAME Resource Timing API times can occur when history.back and performance.getEntries are used, especially after restoring a browser session. The issue stems from an incomplete fix for CVE-2015-7207. Public explo...

CVE-2016-2790

The CVE-2016-2790 issue is in Graphite 2 prior to 1.3.6 (graphite2) used by Firefox/Firefox ESR. The root cause is uninitialized memory in Graphite’s TtfUtil::GetTableInfo, enabling a remote attacker to cause a denial of service or potentially other impact via a crafted Graphite font. Impact is t...

CVE-2016-2835

CVE-2016-2835 affects Mozilla Firefox prior to 48.0 where memory safety hazards in the browser engine could allow remote attackers to cause memory corruption, crash the application, or possibly execute arbitrary code via unspecified vectors. Public references in multiple advisories (MFSA 2016-62)...

CVE-2016-5271

CVE-2016-5271 affects Mozilla Firefox before 49.0. The vulnerable component is PropertyProvider::GetSpacingInternal, triggered by text runs in pages using display: contents CSS. The root cause is an out-of-bounds read, which can lead to application crash (Denial of Service) when processing such c...

CVE-2016-9070

CVE-2016-9070 concerns Firefox prior to 50 where a page loaded into the browser sidebar via a bookmark can reference a privileged chrome window, enabling limited JavaScript that bypasses cross-origin protections. Public details across multiple OSS/distribution advisories (e.g., Ubuntu USN-3124-1,...

CVE-2017-5391

The CVE-2017-5391 entry affects Firefox < 51, where content-injection in about: pages can cause privileged about: pages to load in an iframe, potentially leading to privilege escalation. The issue is described in Mozilla mfsa2017-01 and is referenced in multiple advisories (e.g., openSUSE open...

CVE-2017-5394

CVE-2017-5394 describes a location bar spoofing vulnerability affecting Firefox for Android, where a loaded page’s location bar could be shown over content from another tab due to a sequence of JavaScript events combined with fullscreen mode. It explicitly states that the issue affects Firefox ve...

CVE-2017-5417

CVE-2017-5417 describes an address-bar spoofing vulnerability in Mozilla Firefox (affecting versions before 52). By dragging content from the browser pane to a malicious site’s address bar, the navigation URL could display differently from the loaded page URL, enabling spoofing. The issue is tied...

CVE-2017-7804

CVE-2017-7804 involves the WindowsDllDetourPatcher destructor, which can be repurposed by malicious code in conjunction with other flaws to write arbitrary data to memory under attacker control on Windows. Public advisories for Mozilla Thunderbird and Firefox (MFSA 2017-18/19, MFSA 2017-20) descr...

CVE-2019-9804

CVE-2019-9804 is a macOS-specific issue in Firefox Developer Tools where pasting the output of the ‘Copy as cURL’ command could cause the execution of unintended additional bash commands if the URL was maliciously crafted. The root cause is tied to how the native Bash on macOS handles the pasted ...

CVE-2020-15647

The CVE-2020-15647 issue affects Mozilla Firefox for Android prior to 68.10.1. Root cause: a Content Provider in Firefox for Android allowed local files accessible by the browser to be read by remote web pages, enabling disclosure of sensitive data including cookies for other origins. Impact: sen...

CVE-2024-4773

CVE-2024-4773 : Mozilla Firefox is affected by a spoofing vulnerability observable when a network error occurs during page load, leaving prior content visible with a blank URL bar. The issue affects Firefox versions earlier than 126. Root cause: the prior page content remains viewable after a loa...

CVE-2024-4775

CVE-2024-4775 affects Mozilla Firefox prior to 126. The issue is an missing iterator stop condition when handling WASM code in the built-in profiler, potentially causing invalid memory access and undefined behavior. Affected product: Firefox (pre-126). Root cause: incomplete iterator termination ...

CVE-2008-5018

CVE-2008-5018 affects Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13. Root cause: insufficient class checking in the Date class in the JavaScript engine, enabling remote crash (DoS). Remediation from the initial desc...

CVE-2009-3069

CVE-2009-3069 is a memory-corruption vulnerability in Mozilla Firefox 3.5.x prior to 3.5.3 that can lead to a denial of service or remote code execution via unknown vectors. The issue affects Firefox 3.5.x and is addressed by upgrading to Firefox 3.5.3 (as part of Mozilla/SUSE advisories around M...

CVE-2009-3370

CVE-2009-3370 affects Mozilla Firefox before 3.0.15 and, for 3.5.x, before 3.5.4. The flaw lets remote attackers read form history by forging mouse/keyboard events that trigger auto-fill and populate fields with history entries. Impact is attacker-readable form history data via an attacker-contro...

CVE-2009-3374

CVE-2009-3374 affects Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4. The XPCVariant::VariantDataToJS function in the XPCOM layer does not enforce restrictions on interaction between chrome privileged code and objects from remote sites, allowing a remote attacker to execute arbitrary ...

CVE-2009-3380

CVE-2009-3380 affects Mozilla Firefox browser engine (Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4). The MiracleLinux advisory lists this CVE among multiple issues fixed in Firefox/NSPR/XULRunner components; the described impact is a remote denial of service via memory corruption and potent...

CVE-2011-0051

CVE-2011-0051 affects Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12. The issue arises from not properly handling certain recursive eval calls, which can force a user to respond positively to a dialog question (e.g., granting privileges). This is a remote-facin...

CVE-2011-2367

CVE-2011-2367 affects Mozilla Firefox 4.x up to 4.0.1, where the WebGL implementation fails to properly restrict read operations. This can allow a remote attacker to read sensitive GPU memory from arbitrary processes or cause an application crash (DoS). Vectors are described as unspecified in the...

CVE-2012-0447

CVE-2012-0447 affects Mozilla Firefox 4.x–9.0, Mozilla Thunderbird 5.0–9.0, and SeaMonkey

CVE-2012-1944

CVE-2012-1944 affects Mozilla Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The underlying issue is CSP not blocking inline event handlers, enabling potential cross-site scripting via crafted HTML documents. ...

CVE-2012-1966

CVE-2012-1966 affects Mozilla Firefox 4.x–13.0 and Firefox ESR 10.x prior to 10.0.6. The issue is a cross-site scripting (XSS) vulnerability due to not applying the same context-menu restrictions for data: URLs as for javascript: URLs, enabling remote attackers to execute arbitrary script via a c...

CVE-2013-1695

Concretely, CVE-2013-1695 affects Mozilla Firefox before 22.0 and is caused by incorrect DocShell inheritance handling of the sandbox attribute on IFRAME elements. This weakness allows a FRAME inside an IFRAME to bypass intended access restrictions. The MFSA reference confirms the issue as Sandbo...

CVE-2013-1696

CVE-2013-1696 affects Mozilla Firefox prior to 22.0 where X-Frame-Options protection is not enforced when using server push with multipart responses, enabling clickjacking via crafted pages. The issue is tracked in MFSA 2013-58 and was addressed by Mozilla in Firefox 22.0 and later. OpenSUSE/NVD ...

CVE-2013-6673

Technical details about CVE-2013-6673 are not publicly available in the provided connected documents; monitor for updates.

CVE-2014-1485

CVE-2014-1485 affects Mozilla Firefox (prior to 27.0) and SeaMonkey (prior to 2.24). The CSP implementation in these browsers evaluates style-src directives for XSLT processing rather than script-src, potentially allowing remote attackers to execute arbitrary XSLT code through insufficient style-...

CVE-2014-1591

CVE-2014-1591 affects Mozilla Firefox 33.0 and SeaMonkey before 2.31, where CSP violation reports may leak path information. The issue allows a remote attacker to obtain sensitive data via a site receiving a CSP violation report after a redirect. The connected updates document that this CSP leak ...

CVE-2014-8642

Mozilla Firefox < 35.0 and SeaMonkey

CVE-2015-0834

CVE-2015-0834 affects Mozilla Firefox prior to 36.0, where the WebRTC subsystem accepts TURN/STUN URIs without TLS, enabling a man-in-the-middle to potentially discover credentials by spoofing a server and brute-forcing within a short window. Public documents indicate remediation via upgrading Fi...

CVE-2016-2799

CVE-2016-2799 is a heap-based buffer overflow in graphite2::Slot::setAttr in Graphite2 up to 1.3.6, impacting Firefox <45.0 and Firefox ESR =1.3.7) to remediate. Monitor vendor advisories for exact fixed versions per distribution.

CVE-2016-5273

CVE-2016-5273 concerns Firefox’s accessibility code: a crash in mozilla::a11y::HyperTextAccessible::GetChildOffset can be triggered by a crafted web page, potentially enabling arbitrary code execution. Public advisories in the connected documents consistently associate this CVE with Firefox 49-er...

CVE-2016-5288

CVE-2016-5288 concerns Mozilla Firefox versions prior to 49.0.2 where, when e10s is disabled, web content could read information from the HTTP cache (visited URLs and page contents). Affected products: Firefox 48 and 49 (Windows, macOS, Linux). Root cause details are not deeply described in the p...

CVE-2016-9068

CVE-2016-9068 is a heap-use-after-free in nsRefreshDriver during web animations when using timelines, affecting Firefox versions earlier than 50. The vulnerability leads to a potentially exploitable crash. Several connected advisories (e.g., openSUSE-1334, Ubuntu USN-3124-1 blocks) explicitly nam...

CVE-2017-5426

CVE-2017-5426: On Linux, when seccomp-bpf is active as Gecko Media Plugin sandbox starts, the sandbox may fail to initialize, leaving code that would run in the sandbox only protected by a weaker filter. Affected products are Firefox < 52 and Thunderbird < 52 (Linux only). This can enable s...

CVE-2005-1532

CVE-2005-1532 affects Mozilla Firefox <1.0.4 and Mozilla Suite

CVE-2006-4340

CVE-2006-4340 is a cryptographic flaw in Mozilla NSS prior to 3.11.3 (used in Firefox ≤1.5.0.7, Thunderbird ≤1.5.0.7, SeaMonkey ≤1.0.5) where RSA with exponent 3 can produce signature forgery due to improper handling of extra data in PKCS #1 v1.5 verification. This enables remote attackers to for...

CVE-2007-3845

CVE-2007-3845 affects Mozilla Firefox (before 2.0.0.6), Thunderbird (before 1.5.0.13 and 2.x before 2.0.0.6), and SeaMonkey (before 1.1.4). The issue allows remote code execution via a vector tied to launching a file handling program based on the file extension at the end of the URI, a variant of...

CVE-2008-1233

CVE-2008-1233 affects Mozilla Firefox <2.0.0.13, Thunderbird <2.0.0.13, and SeaMonkey

CVE-2009-2463

CVE-2009-2463 is a browser vulnerability described for Mozilla Firefox before 3.0.12 (and related Thunderbird/SeaMonkey components in older advisories) involving integer overflows in PL_Base64Decode/PL_Base64Encode within nsprpub/lib/libc/src/base64.c. The issue can trigger memory corruption and ...