CVE-2019-17019

The CVE-2019-17019 entry concerns Mozilla Firefox on Windows prior to version 72, where serving a Python-encoded text/plain file could cause Python to execute the file instead of opening it as text. The issue is Windows-only and relates to how Python interaction with downloaded content could lead...

CVE-2011-0053

CVE-2011-0053 : Multiple memory-safety vulnerabilities in the Mozilla Firefox/Thunderbird/SeaMonkey browser engine were reported. The issue allows remote attackers to cause memory corruption and application crashes, and possibly execute arbitrary code via unknown vectors. The advisory details ind...

CVE-2011-0071

CVE-2011-0071 is a directory traversal vulnerability affecting Mozilla Firefox prior to 3.5.19, and Firefox 3.6.x prior to 3.6.17, Thunderbird prior to 3.1.10, and SeaMonkey prior to 2.0.14 on Windows. The issue allows remote attackers to determine the existence of arbitrary files, and potentiall...

CVE-2012-1949

CVE-2012-1949 affects Mozilla Firefox (4.x–13.0), Mozilla Thunderbird (5.0–13.0), and SeaMonkey (pre-2.11). The description cites multiple browser-engine vulnerabilities that allow remote attackers to trigger memory corruption, leading to a crash or possibly arbitrary code execution via unknown v...

CVE-2012-4187

CVE-2012-4187 is listed in the MiracleLinux/Miracle Linux AXSA advisory as affecting Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13. The vulnerability is described as an issue with managing a cert...

CVE-2013-0751

CVE-2013-0751 affects Mozilla Firefox on Android (before 18.0) and SeaMonkey (before 2.15). The root cause is that a touch event on an HTML document can be observed across multiple IFRAMEs, enabling information leakage and potentially cross-site scripting (XSS). The issue is noted in the Firefox/...

CVE-2013-0766

CVE-2013-0766 is a use-after-free in the ~nsHTMLEditRules implementation affecting Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15. The vulnerabili...

CVE-2015-0825

CVE-2015-0825 is a vulnerability in Mozilla Firefox prior to 36.0 involving a stack-based buffer underflow in mozilla::MP3FrameParser::ParseBuffer during MP3 playback, potentially allowing an attacker to leak memory contents. Related advisories confirm Firefox and ESR versions affected and that u...

CVE-2016-2801

CVE-2016-2797 describes a vulnerability in Graphite2 where the TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6 can be triggered by a crafted Graphite font, used by Firefox before 45.0 and ESR before 38.7, leading to a denial of service via a buffer over-read. The issue is due to...

CVE-2016-2817

CVE-2016-2817 describes a vulnerability in Mozilla Firefox before 46.0 where the WebExtension sandbox (browser/components/extensions/ext-tabs.js) fails to properly restrict principal inheritance during chrome.tabs.create and chrome.tabs.update API calls. This allows a crafted extension to perform...

CVE-2016-5283

Mozilla Firefox contains CVE-2016-5283: a cross-origin data disclosure via an iframe SRC fragment timing attack that can reveal cross-origin data after a document resize, effectively bypassing parts of the Same Origin Policy. The root cause is a timing-based leakage through fragment handling. Ex...

CVE-2016-5295

CVE-2016-5295 is a Windows-only privilege-escalation in Mozilla Maintenance Service that can let an attacker run malicious local files via the Mozilla Updater. Affected: Firefox before 50 on Windows. Impact: SYSTEM-level privilege elevation (confidentiality/integrity/availability at risk) as desc...

CVE-2016-9075

CVE-2016-9075 : Firefox WebExtensions can misuse mozAddonManager API to elevate privileges because privileged pages are allowed in the permissions list, enabling a malicious extension to install additional extensions without explicit user permission. Affected: Firefox versions before 50. Root cau...

CVE-2017-5420

CVE-2017-5420 affects Mozilla Firefox prior to version 52.0 (and Firefox ESR up to 45.x); a javascript: URL loaded by a malicious page can obfuscate the address bar, enabling spoofing of an existing page while the malicious page’s address is not shown. The issue is documented as a content spoofin...

CVE-2017-7820

CVE-2017-7820 : The Firefox

CVE-2017-7834

CVE-2017-7834 affects Mozilla Firefox < 57.0. A data: URL loaded in a new tab could bypass the original page’s CSP, potentially enabling JavaScript execution and cross-site scripting when the CSP wasn’t inherited. This is tied to how data: documents formerly inherited context from the original...

CVE-2023-37206

CVE-2023-37206 affects Mozilla Firefox: uploading files that contain symlinks could trick users into submitting data to a malicious site. The issue targets Firefox versions earlier than 115 and stems from insufficient validation of symbolic links in the file-system API. Public advisories and vend...

CVE-2024-4766

Firefox for Android is affected by CVE-2024-4766, which describes techniques used to obscure the fullscreen notification, potentially leading to user confusion and spoofing. The issue affects Firefox

CVE-2005-2968

The CVE-2005-2968 issue affects Firefox 1.0.6 / Mozilla 1.7.10, where a URL provided to the browser on the command line can contain shell metacharacters and be sent unfiltered to bash, allowing arbitrary command execution. Several connected advisories corroborate the vulnerability as a command-in...

CVE-2007-0995

Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 ignore trailing invalid HTML characters in attribute names, which can allow remote attackers to bypass content filters that rely on regular expressions. Affected products should be upgraded to fixed versions (Firef...

CVE-2009-3076

CVE-2009-3076 is a vulnerability in Mozilla Firefox prior to 3.0.14, where dialogs for PKCS#11 module addition/removal are not informative. This could allow remote attackers to trick users into installing/removing an arbitrary PKCS#11 module. The connected MiracleLinux advisory confirms Firefox 3...

CVE-2012-0475

The CVE-2012-0475 issue affects Mozilla Firefox 4.x–11.0, Thunderbird 5.0–11.0, and SeaMonkey before 2.9, caused by improper construction of Origin and Sec-WebSocket-Origin HTTP headers that could allow bypassing an IPv6 literal ACL via cross-site XMLHttpRequest or WebSocket on a nonstandard port...

CVE-2012-1946

CVE-2012-1946 is a Use-after-free in Mozilla’s browser engine (nsINode::ReplaceOrInsertBefore) affecting Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0 and ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The connected docs confirm this is a remote code-execution risk vi...

CVE-2012-1954

CVE-2012-1954 is a use-after-free in Mozilla Firefox’s nsDocument::AdoptNode, affecting Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, and SeaMonkey before 2.11. Exploitation can cause a denial of service (heap memory corruption) or possibly remote code execution via vect...

CVE-2012-1960

The CVE-2012-1960 entry affects Mozilla Firefox 4.x–13.0, Thunderbird 5.0–13.0, and SeaMonkey before 2.11. The qcms_transform_data_rgb_out_lut_sse2 function in the QCMS implementation may trigger an out-of-bounds read via a crafted color profile, allowing remote attackers to obtain sensitive info...

CVE-2012-4205

CVE-2012-4205 affects Mozilla Firefox (prior to 17.0), Mozilla Thunderbird (prior to 17.0), and SeaMonkey (prior to 2.14). The root cause, per the description, is that XMLHttpRequest objects created in sandboxes are assigned the system principal rather than the sandbox principal, enabling CSRF ag...

CVE-2012-4209

Mode C: The CVE-2012-4209 issue affects Mozilla-based components used in MiracleLinux 4 (firefox-10.0.11-1.0.1.AXS4, xulrunner-10.0.11-1.0.1.AXS4) and is described as allowing cross-site scripting by abusing top frame name and location access. Affected products include Mozilla Firefox and Firefox...

CVE-2014-1540

CVE-2014-1540 is a use-after-free in Mozilla Firefox affecting the Event Listener Manager, specifically nsEventListenerManager::CompileEventHandlerInternal. The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service via crafted web content, by triggering hea...

CVE-2014-1585

CVE-2014-1585 affects Mozilla Firefox and related ESR/Thunderbird builds prior to fixed versions. The issue is in the WebRTC video-sharing feature (dom/media/MediaManager.cpp) where stopping sharing actions for videos inside IFRAMEs is not recognized, allowing a remote attacker to continue an act...

CVE-2015-4503

CVE-2015-4503 affects Mozilla Firefox before 41.0. The issue arises in the TCP Socket API implementation where array boundaries are mishandled during navigator.mozTCPSocket.open and subsequent send calls, allowing a remote TCP server to read packet data from a process’s memory (via the Firefox OS...

CVE-2015-4510

CVE-2015-4510 is a race condition in Mozilla Firefox’s WorkerPrivate::NotifyFeatures that can be triggered by the interaction between shared workers and IndexedDB, allowing remote attackers to execute arbitrary code or cause a denial of service via use-after-free and application crash. This vulne...

CVE-2015-7192

CVE-2015-7192 affects Mozilla Firefox on macOS (OS X) prior to 42.0, where the accessibility-tools feature improperly interacts with the TABLE element. An NSAccessibilityIndexAttribute value referencing a row index can cause the application to crash (DoS) and may enable arbitrary code execution. ...

CVE-2016-1526

CVE-2016-1526 concerns Graphite2 Libgraphite’s TtfUtil:LocaLookup in Graphite 2 1.2.4 used by Mozilla Firefox before 43.0 and ESR 38.x before 38.6.1. The bug stems from incorrect validation of a size value in TtfUtil.cpp, enabling remote attackers to trigger an out-of-bounds read, potentially lea...

CVE-2016-1970

Firefox before 45.0 on Windows is affected by CVE-2016-1970 due to an integer underflow in srtp_unprotect within WebRTC, potentially causing memory corruption and a denial of service via unknown vectors. MFSA 2016-32 references this CVE; the fix is integration in Firefox 45.0 and later. The conne...

CVE-2016-2804

CVE-2016-2804 concerns multiple memory-safety vulnerabilities in Mozilla Firefox’s browser engine prior to 46.0, potentially allowing a remote attacker to cause a denial of service (memory corruption/crash) or possibly execute arbitrary code via unknown vectors. Public advisories (e.g., openSUSE-...

CVE-2016-2827

CVE-2016-2827 affects Mozilla Firefox (before 49.0). The issue is in mozilla::net::IsValidReferrerPolicy: a CSP referrer directive containing zero values can trigger an out-of-bounds read, leading to a crash. Public disclosures note MFSA 2016-85 and list affected vectors, with CVSS metrics indica...

CVE-2016-2839

CVE-2016-2839 affects Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 on Linux. The vulnerability stems from calls to cairo_surface_get_extents that do not properly interact with libav header allocation in FFmpeg 0.10, enabling a remote attacker to crash the application (denial of se...

CVE-2017-7822

CVE-2017-7822 : The AES-GCM implementation in WebCrypto API accepts a 0-length IV, contrary to NIST SP 800-38D’s 1-byte minimum, potentially enabling leakage of the authentication key in some cases. Affected software is Firefox

CVE-2018-5138

CVE-2018-5138 is a domain-spoofing vulnerability limited to Firefox for Android before version 59 when opened through an Android Custom Tab with an extremely long domain name. The issue could allow an attacker to spoof which page is loaded, due to how the browser panel (Custom Tab) advertises the...

CVE-2021-29971

CVE-2021-29971 is a Mozilla Firefox vulnerability affecting Firefox for Android. The issue arises when a user grants a webpage permission and saves it; any webpage on the same host (regardless of scheme or port) could gain that permission. The advisory details that this affects Firefox versions o...

CVE-2023-37203

CVE-2023-37203 concerns Mozilla Firefox. The issue is insufficient validation in the Drag and Drop API combined with social engineering, which could trick users into creating a shortcut to local system files and potentially execute arbitrary code. Affected software is Firefox earlier than 115. Im...

CVE-2024-4765

CVE-2024-4765 affects Mozilla Firefox for Android. The issue arises from storing web application manifests using an insecure MD5 hash, which enables a hash collision to overwrite another application's manifest and could allow code execution within another app’s context. The vulnerability is limit...

CVE-2008-4069

The XBM decoder flaw CVE-2008-4069 affects Mozilla Firefox up to 2.0.0.16/17 and SeaMonkey up to 1.1.x, where processing a crafted XBM image could read uninitialized memory and reveal sensitive data. Remediation per connected advisories: upgrade Firefox to 2.0.0.17 or newer and SeaMonkey to 1.1.1...

CVE-2009-0358

In Firefox 3.x, prior to 3.0.6, Cache-Control directives no-store and no-cache for HTTPS were not applied correctly, allowing local users to access sensitive data by navigating back or via history, potentially exposing private HTTP POST response data. This CVE (CVE-2009-0358) affects Mozilla Fire...

CVE-2009-3988

CVE-2009-3988 affects Mozilla Firefox 3.0.x (before 3.0.18), Firefox 3.5.x (before 3.5.8) and SeaMonkey before 2.0.3. The issue arises from not properly restricting read access to object properties in showModalDialog, allowing a crafted dialogArguments value to bypass the Same Origin Policy and e...

CVE-2010-1197

CVE-2010-1197 affects Mozilla Firefox 3.5.x before 3.5.10, Firefox 3.6.x before 3.6.4, and SeaMonkey before 2.0.5. Root cause: Firefox/SeaMonkey fail to handle cases where both Content-Disposition: attachment and Content-Type: multipart are present in HTTP headers, enabling remote XSS via an uplo...

CVE-2011-3232

CVE-2011-3232 affects the YARR engine used by Mozilla Firefox up to 7.0, Thunderbird up to 7.0, and SeaMonkey up to 2.4. The vulnerability allows remote attackers to crash the application or potentially execute arbitrary code via crafted JavaScript. The issue arises from the JavaScript engine han...

CVE-2012-3964

CVE-2012-3964 is a use-after-free in gfxTextRun::GetUserData in Mozilla Firefox before 15.0 (and similar affected components in Thunderbird/SeaMonkey) that allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. Public/conne...

CVE-2013-5611

CVE-2013-5611 refers to Mozilla Firefox (pre-26.0) where an App Installation doorhanger isn’t properly removed, enabling a remote attacker to spoof a Web App installation site by timing page navigation. Connected sources confirm affected products and fixes: IBM/SONAS and IBM Storwize advisories l...

CVE-2014-8643

CVE-2014-8643 affects Mozilla Firefox on Windows (GMP sandbox escape via GMP/OpenH264 process). The OpenH264/GMP path was demonstrated to bypass sandbox protections, with vulnerable behavior tied to Firefox builds prior to 35.0 on Windows. Connected documents indicate related advisories: Firefox ...