CVE-2024-2606

CVE-2024-2606 concerns Mozilla Firefox: a flaw where passing invalid data could produce invalid WebAssembly (WASM) values, including arbitrary integers that become pointer values. The vulnerability affects Firefox versions older than 124. Root cause described in the documents is improper handling...

CVE-2017-5410

CVE-2017-5410 is a memory corruption bug during JavaScript garbage collection (incremental sweeping) that affects Firefox and Thunderbird prior to version 52. Upgrading to Firefox/Thunderbird 52.0 or later (as reflected in multiple advisories) is the remediation. Exploitation details are not prov...

CVE-2017-5442

CVE-2017-5442 is a use-after-free in Firefox/Thunderbird during DOM style changes, causing potentially exploitable crashes. Affected products/versions in the provided documents include Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox

CVE-2022-34473

Summary: CVE-2022-34473 is a vulnerability in Mozilla Firefox prior to 102 where the HTML Sanitizer failed to sanitize the xlink:href attribute of SVG elements. This could enable attacker-controlled input to bypass sanitization, potentially enabling script execution or other abuses via SVG refer...

CVE-2022-34477

CVE-2022-34477 describes a vulnerability in Mozilla Firefox where the MediaError message could leak information for same-site cross-origin resources, enabling XS-Leaks. Affected product: Firefox earlier than 102. The underlying issue is inconsistent MediaError messaging, which could disclose sens...

CVE-2023-28161

The CVE-2023-28161 issue affects Mozilla Firefox prior to version 111. When a temporary one-time permission (e.g., Camera) is granted to a document loaded via a file: URL, that permission can persist in the tab for subsequent file: URL documents. This could be risky if local files come from diffe...

CVE-2023-32213

CVE-2023-32213 affects Mozilla Firefox and Thunderbird. The flaw arises when reading a file, where an uninitialized value could be used as the read limit. Affected versions are Firefox <113, Firefox ESR <102.11, and Thunderbird

CVE-2023-37202

CVE-2023-37202 affects Firefox (including ESR) and Thunderbird. The issue is caused by cross-compartment wrappers wrapping a scripted proxy, which could store objects from other compartments in the main compartment, resulting in a use-after-free. Affected versions are Firefox <115, Firefox ESR...

CVE-2023-6865

CVE-2023-6865 describes a vulnerability in Firefox’s EncryptingOutputStream that could expose uninitialized data, potentially allowing data to be written to local disk with implications for private browsing mode. Affected products noted in the provided documents include Firefox ESR versions prior...

CVE-2023-6870

CVE-2023-6870 affects Firefox on Android (Android Firefox/Focus) and is triggered by applications that spawn a Toast notification in a background thread, potentially obscuring the fullscreen notification used by Firefox. The issue is tied to Android UI prompts and could lead to spoofing of the br...

CVE-2024-0746

CVE-2024-0746 describes a crash triggered when a Linux user opens the print preview dialog in Mozilla components. Affected products include Firefox (versions before 122) and Firefox ESR (before 115.7) as well as Thunderbird (before 115.7). The issue is reported as a crash scenario in the print-pr...

CVE-2014-1508

CVE-2014-1508 affects Mozilla Firefox family components (libxul) where libxul.so!gfxContext::Polygon can leak memory, cause out-of-bounds reads, or crash, with potential Same Origin Policy bypass via MathML polygon rendering. Affected: Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbir...

CVE-2014-1509

CVE-2014-1509 is a buffer overflow in cairo's _cairo_truetype_index_to_ucs4 function that affects Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25. The vulnerability can allow remote code execution via a crafted extension that renders f...

CVE-2014-1514

CVE-2014-1514 affects Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25. The issue arises from not validating the length of the destination array before a copy operation in TypedArrayObject, allowing remote attackers to execute arbitrary...

CVE-2017-5448

CVE-2017-5448 is an out-of-bounds write in ClearKeyDecryptor (Gecko Media Plugin sandbox). The issue allows writing arbitrary memory data, potentially causing a crash or remote code execution. Affected products include Firefox/Firefox ESR prior to patched versions; upstream advisories show fixes ...

CVE-2017-7818

Summary: CVE-2017-7818 is a use-after-free vulnerability in Thunderbird (and Firefox/ESR components) involving manipulation of ARIA element arrays via the DOM, leading to a potentially exploitable crash. The connected sources confirm the issue affects Thunderbird prior to 52.4.0 and related Mozil...

CVE-2021-29977

CVE-2021-29977 affects Mozilla Firefox prior to version 90. The connected Astra Linux and Arch Linux advisories confirm memory-safety bugs in Firefox 89 that could permit memory corruption and, with sufficient effort, potentially arbitrary code execution. The vulnerability is described as part of...

CVE-2022-45405

CVE-2022-45405 is a memory-safety use-after-free in the InputStream implementation caused by freeing arbitrary nsIInputStream on a different thread. Documents confirm impact on Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox

CVE-2023-29531

Technical details about CVE-2023-29531 (affected product, root cause, impact, or fix) are not provided in the connected documents. Monitor for updates from Mozilla and security advisories.

CVE-2023-6207

CVE-2023-6207: Ownership mismanagement leads to a use-after-free in ReadableByteStreams. Affected products include Firefox < 120 and Thunderbird

CVE-2023-6212

CVE-2023-6212 parks memory safety bugs in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4, with evidence of memory corruption and potential to exploit for arbitrary code. The issue affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird

CVE-2017-5466

CVE-2017-5466 describes an origin-confusion bug triggered when a page loaded from an original site via a hyperlink redirects to a data:text/html URL, causing the reloaded page to have an incorrect origin. This enables a cross-site scripting (XSS) risk. Affected products include Mozilla Thunderbir...

CVE-2020-15675

The CVE-2020-15675 vulnerability affects Firefox before version 81. It is a memory-corruption issue where, during surface processing, a persistent buffer’s lifetime may outlive its memory, potentially allowing a crash or exploitation. Affected component/behavior is a memory-management path in Fir...

CVE-2022-28284

CVE-2022-28284 affects Mozilla Firefox older than 99. The SVG element could load unexpected content and execute scripts, aligning Gecko with other browsers but diverging from spec-driven security expectations. Impact is high across confidentiality, integrity, and availability. Firefox 99 and lat...

CVE-2022-38475

CVE-2022-38475 affects Firefox up to version 104. An attacker could write to the first element of a zero-length JavaScript array; the value is not written to an invalid memory address, but the issue is listed with memory safety implications (I: High). Exploitation context is not described in thes...

CVE-2023-6857

CVE-2023-6857 describes a race condition when resolving symlinks in Firefox on Unix-based OSes, where the buffer passed to readlink may be too small. Affects Firefox and Thunderbird components (Firefox ESR <115.6, Firefox <121, Thunderbird

CVE-2012-1970

CVE-2012-1970 affects Mozilla Firefox before 15.0, Thunderbird before 15.0, ESR 10.x before 10.0.7, and SeaMonkey before 2.12. The issue stems from multiple unspecified vulnerabilities in the browser engine that can allow remote attackers to cause memory corruption and application crashes or pote...

CVE-2017-7803

CVE-2017-7803 affects Thunderbird and Firefox browsers with CSP in a page header containing a sandbox directive. The root cause is that when sandbox is present, other CSP directives are ignored, leading to incorrect CSP enforcement. Documents in connected sources specify affected products (Thunde...

CVE-2019-11734

CVE-2019-11734 refers to memory safety bugs in Firefox 68 that may allow arbitrary code execution and affect Firefox versions older than 69. The issue is described as memory corruption with potential exploitation but no exploit details are provided in the initial description beyond that. The vuln...

CVE-2020-15666

CVE-2020-15666 affects Firefox before 80 (desktop and Android); the issue is an information-disclosure vulnerability where loading a non-video in an audio/video context leaks the exact HTTP status code via the MediaError Message. This could enable login-status inference to services or local-netwo...

CVE-2021-23957

CVE-2021-23957 : Firefox for Android was vulnerable to navigation via Android-specific intent URL schemes that could be misused to escape the iframe sandbox, potentially bypassing sandbox protections. The advisory indicates this affected Firefox versions prior to 85 and is limited to Android; oth...

CVE-2021-23962

CVE-2021-23962 concerns Mozilla Firefox prior to version 85, where an incorrect use of the method could cause a user-after-poison condition and a potentially exploitable crash in the browser. The vulnerability is documented across multiple sources with the same root cause and impact: a crash tha...

CVE-2021-23971

CVE-2021-23971 concerns Mozilla Firefox: when processing a redirect with a conflicting Referrer-Policy, the browser would adopt the redirect’s policy, potentially leaking more information to the destination than intended by the original origin. Affected: Firefox versions earlier than 86. The conn...

CVE-2021-29972

CVE-2021-29972 is a use-after-free vulnerability linked to an out-of-date Cairo library affecting Mozilla Firefox versions earlier than 90. The issue was identified via testing and updating Cairo (and/or Firefox to a newer Firefox 90+ version) was reported to resolve the vulnerability and may als...

CVE-2022-22762

CVE-2022-22762 is a Firefox for Android issue where a JavaScript alert/prompt could be shown in a way that overlapped another website, enabling UI spoofing. The vulnerability is limited to Firefox on Android and affects versions before 97, with the CVSS base metrics showing low impact on confiden...

CVE-2022-34476

CVE-2022-34476: Mozilla Firefox ASN.1 parsing flaw where an indefinite SEQUENCE inside an indefinite GROUP could cause malformed ASN.1 to be accepted. Affected: Firefox prior to 102.0. Reported impact includes potential arbitrary code execution, information disclosure, DoS, and security bypass. R...

CVE-2024-0751

CVE-2024-0751 : A malicious devtools extension could have been used to escalate privileges. Affected: Firefox < 122, Firefox ESR < 115.7, Thunderbird

CVE-2013-0750

CVE-2013-0750 is a high-severity vulnerability in Mozilla’s JavaScript engine where an integer overflow during string concatenation can lead to heap-based memory corruption and remote code execution. Affected products include Firefox prior to 18.0 (and ESR branches), Thunderbird prior to 17.0.2, ...

CVE-2014-1477

CVE-2014-1477 affects Mozilla Firefox before 27.0 (and related ESR/Thunderbird/SeaMonkey versions) where the browser engine contains multiple unspecified vulnerabilities that could lead to memory corruption, application crashes, or possibly arbitrary code execution via unknown vectors. Exploitati...

CVE-2014-1532

CVE-2014-1532 is a use-after-free in Mozilla Firefox’s host-resolution path. Affected products include Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26, where the vulnerability resides in libxul.so's nsHostResolver::ConditionallyRefreshRecord. ...

CVE-2017-5398

CVE-2017-5398 describes memory-safety bugs in Mozilla Thunderbird (and related Firefox components) that could allow arbitrary code execution. Affected products include Thunderbird versions earlier than 45.8 (and Firefox earlier than 52; ESR lines too). Public advisories indicate fixes in Thunderb...

CVE-2019-11697

CVE-2019-11697 affects Firefox before 67.0. The vulnerability lets a malicious page bypass the prompt delay for extension installation by pressing ALT and a on the prompt, enabling spoofing and potential installation of a malicious extension. Exploitation status is not provided in the supplied do...

CVE-2020-15665

CVE-2020-15665 affects Mozilla Firefox before version 80. The issue is that the address bar is not reset after the beforeunload dialog if the user stays on the page, which could lead to an incorrect URL being shown when combined with other browser behaviors. Connected sources reiterate this descr...

CVE-2021-29975

CVE-2021-29975 affects Mozilla Firefox earlier than 90. Through DOM manipulations, an attacker could overlay a message (text only) on top of another domain while the address bar showed the new domain, potentially leading to user confusion or spoofing. The issue is tied to content spoofing in Fire...

CVE-2023-25734

CVE-2023-25734 affects Mozilla Firefox on Windows. It arises when a user opens a local Windows .url shortcut, allowing an attacker to supply a remote path that can trigger unexpected network requests and potentially leak NTLM credentials. Affected versions: Firefox before 110, Thunderbird before ...

CVE-2013-0757

CVE-2013-0757 affects Mozilla Firefox (and related Mozilla-based apps) via a Chrome Object Wrapper (COW) bypass that allows changing the prototype of an object, enabling arbitrary code execution with chrome privileges. The SUSE/openSUSE and Gentoo/Nessus summaries map this to MFSA 2013-14 and lis...

CVE-2014-1518

CVE-2014-1518 affects Mozilla Firefox and related browsers (Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, SeaMonkey before 2.26). Reported impact per the connected advisories: remote memory corruption and application crash, with potential arbitrary code execution via...

CVE-2017-5401

CVE-2017-5401 is a memory corruption crash triggered by ErrorResult handling in Firefox/Thunderbird. Affected versions are Firefox < 52 and ESR < 45.8, Thunderbird < 52 and Thunderbird

CVE-2017-5469

CVE-2017-5469 describes a potential buffer overflow in code generated by Flex (related to CVE-2016-6354). Affected products include Thunderbird < 52.1, Firefox ESR < 45.9, ESR < 52.1, and Firefox

CVE-2018-12371

CVE-2018-12371 is an integer overflow in the Skia library during edge-builder memory allocation on systems with 16 GB RAM or more. Documented impact is a potentially exploitable crash, affecting Firefox ESR < 60.1, Thunderbird < 60, and Firefox