3269 matches found
CVE-2014-8643
CVE-2014-8643 affects Mozilla Firefox on Windows (GMP sandbox escape via GMP/OpenH264 process). The OpenH264/GMP path was demonstrated to bypass sandbox protections, with vulnerable behavior tied to Firefox builds prior to 35.0 on Windows. Connected documents indicate related advisories: Firefox ...
CVE-2015-0815
CVE-2015-0815 affects Mozilla Firefox (pre-37.0), Firefox ESR (31.x before 31.6), and Thunderbird (before 31.6). The underlying issue is memory safety bugs in the Firefox/browser engine, with exploitation scenarios described as remote code execution or denial of service via unknown vectors. Affec...
CVE-2015-7200
CVE-2015-7200 concerns Mozilla Firefox’s CryptoKey interface, where the implementation in Firefox floor before 42.0 and Firefox ESR 38.x before 38.4 lacks status checking. This could allow a remote attacker to achieve an unspecified impact via a cryptographic-key related vector. The NVD lists a b...
CVE-2016-2791
Summary: CVE-2016-2791 affects the Graphite 2 font library (graphite2) shipped with Graphite-based builds and Mozilla Firefox. The issue is in graphite2::GlyphCache::glyph, where a crafted Graphite font can trigger a buffer over-read, potentially allowing a denial of service and other unspecified...
CVE-2016-2802
Summary: CVE-2016-2802 affects Graphite 2 before 1.3.6, used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7. The flaw resides in graphite2::TtfUtil::CmapSubtable4NextCodepoint and can be exploited to trigger a crash via a crafted Graphite font (buffer over-read), causing a denial...
CVE-2016-5287
CVE-2016-5287 affects Mozilla Firefox up to 49.0.2. The issue is a use-after-free crash during actor destruction with service workers, caused by a fault in nsTArray_base::SwapArrayElements. The vulnerability leads to a potentially exploitable crash (no exploit details provided in the supplied doc...
CVE-2017-5399
CVE-2017-5399 is a memory-safety vulnerability affecting Firefox and Thunderbird prior to version 52. Several connected advisories (e.g., Arch Linux ASA-201703-3, DEBIAN CVE tracker, MFSA2017-09) describe memory-safety bugs that could lead to arbitrary code execution or crashes. The documented re...
CVE-2017-7815
The CVE-2017-7815 entry relates to Mozilla Firefox's handling of iframe pages where the data: protocol can trigger a Javascript modal dialog that points to an arbitrary domain, potentially spoofing the origin seen by the user. This vulnerability affects Firefox versions before 56 (i.e., Firefox &...
CVE-2017-7825
The CVE-2017-7825 entry describes an OS X–specific issue where several fonts render Tibetan and Arabic characters as whitespace. When such characters appear in an IDN in the address bar, they enable domain name spoofing. Affected products include Mozilla Firefox versions earlier than 56 and Firef...
CVE-2017-7839
CVE-2017-7839 affects Mozilla Firefox before 57.0. Control characters prepended to pasted javascript: URLs in the address bar can cause the leading characters to be ignored, allowing the pasted JavaScript to execute instead of being blocked (self‑XSS/social engineering). Public references indicat...
CVE-2026-7322
CVE-2026-7322 affects Mozilla Firefox: memory safety bugs in Firefox 150.0.0 and Firefox ESR 115.35.0, 140.10.0. Some bugs showed evidence of memory corruption and, with enough effort, could be exploited to run arbitrary code. Affected components include Firefox core/browser memory handling acros...
CVE-2005-2871
CVE-2005-2871 describes a heap-based buffer overflow in IDN handling (soft-hyphen 0xAD) during Mozilla Firefox IDN normalization (nsStandardURL::BuildNormalizedSpec). Affects Firefox 1.0.6 and earlier, and Netscape 7.x/8.x. Exploitation could crash the browser or run arbitrary code; remote attack...
CVE-2009-0581
CVE-2009-0581 affects LittleCMS (liblcms) up to before 1.18beta2. The memory leak can be triggered by crafted image files and is used by Firefox 3.1beta, OpenJDK, and GIMP, potentially causing memory consumption and application crash (DoS). The connected documents corroborate the existence of thi...
CVE-2009-3375
CVE-2009-3375 affects Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4. The issue allows user-assisted remote attackers to bypass the Same Origin Policy and read an arbitrary content selection via document.getSelection. The connected MiracleLinux advisory lists CVE-2009-3375 among fixed...
CVE-2010-3776
CVE-2010-3776 affects Mozilla Firefox before 3.5.16 and Firefox 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11. The issue is described as memory safety/memory corruption in the browser engine, allowing a remote attacker to cause a denial of serv...
CVE-2011-0074
CVE-2011-0074 is described as an unspecified vulnerability in the Mozilla Firefox browser engine for Firefox 3.5.x (pre-3.5.19) and 3.6.x (pre-3.6.17), Thunderbird up to 3.1.10, and SeaMonkey up to 2.0.14. The issue allows remote attackers to cause memory corruption and application crash or possi...
CVE-2011-3651
CVE-2011-3651 involves Mozilla Firefox 7.0 and Thunderbird 7.0. The description cites multiple unspecified vulnerabilities in the browser engine that could allow remote attackers to cause a denial of service via memory corruption and application crash, or possibly execute arbitrary code through u...
CVE-2012-0463
The CVE-2012-0463 issue affects Mozilla Firefox browser engine in Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR before 10.0.3, and SeaMonkey before 2.8. The flaw is in the nsWindow implementation not val...
CVE-2012-1973
CVE-2012-1973 is a use-after-free vulnerability in Mozilla Firefox family components. The issue arises in nsObjectLoadingContent::LoadObject, affecting Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. Expl...
CVE-2012-3975
Technical details about CVE-2012-3975 (affected product, root cause, impact, remediation) are not provided in the connected documents. Monitor for updates.
CVE-2012-5837
CVE-2012-5837 (Developer Toolbar chrome privileges XSS) is addressed in openSUSE’s Firefox ESR update, fixed in firefox-esr-128.5.1-1.1 on GA media (openSUSE-Tumbleweed). Connected advisories (OPENSUSE-SU-2024:14572-1; OSV:OPENSUSE-SU-2024:14572-1) confirm that the Firefox ESR update resolves mul...
CVE-2013-1678
CVE-2013-1678 affects Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6, via the _cairo_xlib_surface_add_glyph function which allows remote code execution or a denial of service (invalid write) through unspecified vector...
CVE-2013-1712
CVE-2013-1712 affects Mozilla updater in Firefox (before 23.0) and Firefox ESR 17.x (before 17.0.8), as well as Thunderbird (before 17.0.8 and ESR 17.x before 17.0.8) on Windows 7/Server 2008 R2/8/Server 2012. The issue is a local privilege escalation via untrusted search path Trojan horse DLLs l...
CVE-2014-1484
CVE-2014-1484 affects Mozilla Firefox on Android 4.2 and earlier, where system logs may contain profile paths, enabling a crafted application to access sensitive information. Connected docs reference the CVE within openSUSE Firefox ESR advisories and indicate fixes in later Firefox ESR updates (e...
CVE-2014-1511
CVE-2014-1511 affects Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25. The issue is described as a remote bypass of the popup blocker via unspecified vectors. Public security advisories in 2014 consolidate Firefox/Thunderbird/SeaMonkey...
CVE-2014-1539
Technical details for CVE-2014-1539 are not publicly available in the provided documents. Please monitor for official updates or vendor advisories to obtain affected products, impact, and fixes.
CVE-2014-8640
CVE-2014-8640 affects Mozilla Firefox (before 35.0) and SeaMonkey (before 2.32) where the Web Audio API’s mozilla::dom::AudioParamTimeline::AudioNodeInputValue does not properly restrict timeline operations, enabling a remote attacker to trigger a denial of service via uninitialized-memory read a...
CVE-2015-4507
The CVE-2015-4507 entry concerns Mozilla Firefox prior to 41.0, where the SavedStacks class in the JavaScript implementation, when the Debugger API is enabled, could be exploited by a crafted web site to cause a denial of service (getSlotRef assertion failure and application exit) and potentially...
CVE-2015-7187
CVE-2015-7187 arises from the Add-on SDK in Mozilla Firefox before 42.0 misinterpreting a panel setting script: false, enabling inline script execution in third‑party extensions and potentially allowing remote XSS. The vulnerability affects Firefox’s extension panel rendering and can lead to cros...
CVE-2015-7223
CVE-2015-7223 affects Mozilla Firefox before 43.0 (and related ESR lines in some advisories) via the WebExtension APIs. Root cause: unsafe handling in WebExtension APIs that can grant privileges to a crafted site. Impact: remote attackers could gain privileges, access sensitive information, or en...
CVE-2016-2825
CVE-2016-2825 affects Mozilla Firefox up to version 47.0. The flaw allows a partial bypass of the Same-Origin Policy by setting location.host via an invalid data: URL, enabling a remote attacker to bypass some SOP protections. Remediation in the referenced openSUSE advisories is to update Firefox...
CVE-2016-5260
This CVE refers to Mozilla Firefox prior to 48.0 where changes from INPUT type="password" to INPUT type="text" within a single Session Manager session can cause cleartext passwords to be stored in a session restore file. Affected product: Mozilla Firefox (pre-48.0). Root cause: mishandling of in-...
CVE-2017-5415
CVE-2017-5415 is a blob URL address-bar spoofing vulnerability in Mozilla Firefox (affecting Firefox < 52). The issue enables spoofing the address bar through a blob: URL, potentially confusing users and enabling follow-on spoofing. IBM SONAS bulletin confirms CVE-2017-5415 alongside other Fir...
CVE-2017-7756
CVE-2017-7756 is a use-after-free/use-after-scope vulnerability affecting Firefox <54, Firefox ESR <52.2, and Thunderbird
CVE-2017-7806
CVE-2017-7806 is a use-after-free vulnerability in Firefox
CVE-2017-7811
CVE-2017-7811 : Firefox 55 contains memory safety bugs that could allow memory corruption and potentially arbitrary code execution; affected products are Firefox versions older than 56. Remediation: upgrade to Firefox 56 or later (as referenced in mfsa2017-21). The connected Nessus entries also r...
CVE-2021-29968
The CVE-2021-29968 vulnerability affects Mozilla Firefox on Windows (Firefox
CVE-2023-6866
Summary: CVE-2023-6866 affects Mozilla Firefox prior to version 121. The issue arises from how TypedArrays can be fallible due to insufficient exception handling, which can enable abuse in other APIs that rely on TypedArrays to succeed. Technical details found in connected documents: Firefox
CVE-2025-8032
CVE-2025-8032 involves an XSLT loading flaw where the source document was not propagated, allowing a CSP bypass in Mozilla components. Affected products/versions (per provided sources): Firefox and Thunderbird lines including Firefox < 141, Firefox ESR < 128.13 and < 140.1, Thunderbird &...
CVE-2007-0780
CVE-2007-0780 is a cross-site scripting vulnerability in Firefox 1.5.x up to 1.5.0.9 and Firefox 2.x up to 2.0.0.x, and SeaMonkey up to 1.0.7, where the requesting URI is used to identify child windows. This enables remote XSS when a blocked popup originating from a javascript: URI is opened acro...
CVE-2008-0016
The CVE-2008-0016 issue is a stack-based buffer overflow in the UTF-8 URL parser that affects Mozilla Firefox prior to 2.0.0.17 and SeaMonkey prior to 1.1.12, enabling remote code execution via a crafted URL. Connected advisories confirm the vulnerability and list affected Mozilla products; explo...
CVE-2010-1210
CVE-2010-1210 affects Mozilla Firefox before 3.6.7 and Thunderbird before 3.1.1, where undefined positions in certain 8‑bit encodings map to U+FFFD, potentially enabling cross‑site scripting (XSS) via crafted text. The NVD entry shows a base score of 4.3 (MEDIUM) with network access and no user i...
CVE-2011-0070
Summary of CVE-2011-0070 (as per provided documents) Affected products/versions: Mozilla Firefox up to 3.5.18 (3.5.x before 3.5.19), Firefox 3.6.x before 3.6.17, Firefox 4.x before 4.0.1; Mozilla Thunderbird before 3.1.10; SeaMonkey before 2.0.14. Root cause/impact (from description): Unspecified...
CVE-2011-0085
CVE-2011-0085 is a use-after-free in the nsXULCommandDispatcher of Mozilla Firefox prior to 3.6.18, Thunderbird prior to 3.1.11, and SeaMonkey up to 2.0.14. The flaw allows remote attackers to execute arbitrary code by crafting an XUL document that dequeues the current command updater, enabling c...
CVE-2013-0770
CVE-2013-0770 affects Mozilla Firefox (pre-18.0), Thunderbird (pre-17.0.2), and SeaMonkey (pre-2.15). The issue is described as multiple unspecified vulnerabilities in the browser engine that can cause memory corruption and application crashes, with potential for arbitrary code execution via unkn...
CVE-2014-1522
Technical details for CVE-2014-1522 are not publicly provided in the connected documents. No specifics on affected products, versions, root cause, impact, or fixes are available; monitor for updates.
CVE-2015-4502
CVE-2015-4502 affects Mozilla Firefox where the JS file js/src/proxy/Proxy.cpp mishandles certain receiver arguments, allowing a crafted web site to bypass intended window access restrictions. The description in the initial document states this as a remote‑level issue enabling a restriction bypas...
CVE-2017-5395
CVE-2017-5395 affects Firefox for Android and describes a location-bar spoofing issue: malicious sites can cause a spoofed address bar on a subsequent page if navigations between pages are timed so the prior page’s bar scrolls out of view. The vulnerability exists in Firefox
CVE-2018-18496
CVE-2018-18496 is a clickjacking vulnerability in Mozilla Firefox’s feed preview page about:feeds. When the RSS Feed preview is framed in another page, scripted content can coerce a user into downloading and executing an executable from a temporary directory. It affects Firefox versions earlier t...