# Mozilla Firefox.

Every CVE that names Mozilla Firefox among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Mozilla Thunderbird: URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly…](https://agentprime.io/advisories/CVE-2017-5383.md)
  `CVE-2017-5383` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: Feed preview for RSS feeds can be used to capture errors and exceptions generated by…](https://agentprime.io/advisories/CVE-2017-5382.md)
  `CVE-2017-5382` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: The "export" function in the Certificate Viewer can force local filesystem navigation…](https://agentprime.io/advisories/CVE-2017-5381.md)
  `CVE-2017-5381` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [A potential use-after-free found through fuzzing during DOM manipulation of SVG content.](https://agentprime.io/advisories/CVE-2017-5380.md)
  `CVE-2017-5380` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: Use-after-free vulnerability in Web Animations when interacting with cycle collection…](https://agentprime.io/advisories/CVE-2017-5379.md)
  `CVE-2017-5379` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Hashed codes of JavaScript objects are shared between pages.](https://agentprime.io/advisories/CVE-2017-5378.md)
  `CVE-2017-5378` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: A memory corruption vulnerability in Skia that can occur when using transforms to make…](https://agentprime.io/advisories/CVE-2017-5377.md)
  `CVE-2017-5377` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Use-after-free while manipulating XSL in XSLT documents.](https://agentprime.io/advisories/CVE-2017-5376.md)
  `CVE-2017-5376` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: JIT code allocation can allow for a bypass of ASLR and DEP protections leading to…](https://agentprime.io/advisories/CVE-2017-5375.md)
  `CVE-2017-5375` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · EPSS 0.34 · Not analysed yet · Published 11 Jun 2018
- [Memory safety bugs were reported in Firefox 50.1.](https://agentprime.io/advisories/CVE-2017-5374.md)
  `CVE-2017-5374` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6.](https://agentprime.io/advisories/CVE-2017-5373.md)
  `CVE-2017-5373` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is…](https://agentprime.io/advisories/CVE-2016-9904.md)
  `CVE-2016-9904` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability.](https://agentprime.io/advisories/CVE-2016-9903.md)
  `CVE-2016-9903` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox ESR: The Pocket toolbar button, once activated…](https://agentprime.io/advisories/CVE-2016-9902.md)
  `CVE-2016-9902` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox ESR: HTML tags received from the Pocket server will be processed without sanitization and any…](https://agentprime.io/advisories/CVE-2016-9901.md)
  `CVE-2016-9901` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: External resources that should be blocked when loaded by SVG images can bypass security…](https://agentprime.io/advisories/CVE-2016-9900.md)
  `CVE-2016-9900` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: Use-after-free while manipulating DOM events and removing audio elements due to errors in…](https://agentprime.io/advisories/CVE-2016-9899.md)
  `CVE-2016-9899` · CVE record: Mozilla Firefox and 2 more · No CVSS score · EPSS 0.19 · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees…](https://agentprime.io/advisories/CVE-2016-9898.md)
  `CVE-2016-9898` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: Memory corruption resulting in a potentially exploitable crash during WebGL functions…](https://agentprime.io/advisories/CVE-2016-9897.md)
  `CVE-2016-9897` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Use-after-free while manipulating the "navigator" object within WebVR.](https://agentprime.io/advisories/CVE-2016-9896.md)
  `CVE-2016-9896` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: Event handlers on "marquee" elements were executed despite a strict Content Security…](https://agentprime.io/advisories/CVE-2016-9895.md)
  `CVE-2016-9895` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation.](https://agentprime.io/advisories/CVE-2016-9894.md)
  `CVE-2016-9894` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Memory safety bugs were reported in Thunderbird 45.5.](https://agentprime.io/advisories/CVE-2016-9893.md)
  `CVE-2016-9893` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Memory safety bugs were reported in Firefox 50.0.2.](https://agentprime.io/advisories/CVE-2016-9080.md)
  `CVE-2016-9080` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Use after free in Mozilla Firefox and others](https://agentprime.io/advisories/CVE-2016-9079.md)
  `CVE-2016-9079` · CVE record: Mozilla Firefox and 2 more · CVSS 7.5 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.87 · Not analysed yet · Published 11 Jun 2018 · Tags: Memory corruption
- [Mozilla Firefox: Redirection from an HTTP connection to a "data:" URL assigns the referring site's origin…](https://agentprime.io/advisories/CVE-2016-9078.md)
  `CVE-2016-9078` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin.](https://agentprime.io/advisories/CVE-2016-9077.md)
  `CVE-2016-9077` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: An issue where a "\<select>" dropdown menu can be used to cover location bar content…](https://agentprime.io/advisories/CVE-2016-9076.md)
  `CVE-2016-9076` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: An issue where WebExtensions can use the mozAddonManager API to elevate privilege due to…](https://agentprime.io/advisories/CVE-2016-9075.md)
  `CVE-2016-9075` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [An existing mitigation of timing side-channel attacks is insufficient in some circumstances.](https://agentprime.io/advisories/CVE-2016-9074.md)
  `CVE-2016-9074` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: WebExtensions can bypass security checks to load privileged URLs and potentially escape…](https://agentprime.io/advisories/CVE-2016-9073.md)
  `CVE-2016-9073` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: When a new Firefox profile is created on 64-bit Windows installations…](https://agentprime.io/advisories/CVE-2016-9072.md)
  `CVE-2016-9072` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious…](https://agentprime.io/advisories/CVE-2016-9071.md)
  `CVE-2016-9071` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: A maliciously crafted page loaded to the sidebar through a bookmark can reference a…](https://agentprime.io/advisories/CVE-2016-9070.md)
  `CVE-2016-9070` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: A use-after-free during web animations when working with timelines resulting in a…](https://agentprime.io/advisories/CVE-2016-9068.md)
  `CVE-2016-9068` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Two use-after-free errors during DOM operations resulting in potentially exploitable crashes.](https://agentprime.io/advisories/CVE-2016-9067.md)
  `CVE-2016-9067` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: A buffer overflow resulting in a potentially exploitable crash due to memory allocation…](https://agentprime.io/advisories/CVE-2016-9066.md)
  `CVE-2016-9066` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · EPSS 0.12 · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: The location bar in Firefox for Android can be spoofed by forcing a user into fullscreen…](https://agentprime.io/advisories/CVE-2016-9065.md)
  `CVE-2016-9065` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox ESR: Add-on updates failed to verify that the add-on ID inside the signed package matched the…](https://agentprime.io/advisories/CVE-2016-9064.md)
  `CVE-2016-9064` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [An integer overflow during the parsing of XML using the Expat library.](https://agentprime.io/advisories/CVE-2016-9063.md)
  `CVE-2016-9063` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: Private browsing mode leaves metadata information, such as URLs…](https://agentprime.io/advisories/CVE-2016-9062.md)
  `CVE-2016-9062` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: A previously installed malicious Android application which defines a specific…](https://agentprime.io/advisories/CVE-2016-9061.md)
  `CVE-2016-9061` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: A previously installed malicious Android application with same signature-level…](https://agentprime.io/advisories/CVE-2016-5299.md)
  `CVE-2016-5299` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: A mechanism where disruption of the loading of a new web page can cause the previous…](https://agentprime.io/advisories/CVE-2016-5298.md)
  `CVE-2016-5298` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: An error in argument length checking in JavaScript…](https://agentprime.io/advisories/CVE-2016-5297.md)
  `CVE-2016-5297` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: A heap-buffer-overflow in Cairo when processing SVG content caused by compiler…](https://agentprime.io/advisories/CVE-2016-5296.md)
  `CVE-2016-5296` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate…](https://agentprime.io/advisories/CVE-2016-5295.md)
  `CVE-2016-5295` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: The Mozilla Updater can be made to choose an arbitrary target working directory for…](https://agentprime.io/advisories/CVE-2016-5294.md)
  `CVE-2016-5294` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox ESR: When the Mozilla Updater is run, if the Updater's log file in the working directory…](https://agentprime.io/advisories/CVE-2016-5293.md)
  `CVE-2016-5293` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash.](https://agentprime.io/advisories/CVE-2016-5292.md)
  `CVE-2016-5292` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [A same-origin policy bypass with local shortcut files to load arbitrary local content from disk.](https://agentprime.io/advisories/CVE-2016-5291.md)
  `CVE-2016-5291` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4.](https://agentprime.io/advisories/CVE-2016-5290.md)
  `CVE-2016-5290` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Memory safety bugs were reported in Firefox 49.](https://agentprime.io/advisories/CVE-2016-5289.md)
  `CVE-2016-5289` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Web content could access information in the HTTP cache if e10s is disabled.](https://agentprime.io/advisories/CVE-2016-5288.md)
  `CVE-2016-5288` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [A potentially exploitable use-after-free crash during actor destruction with service workers.](https://agentprime.io/advisories/CVE-2016-5287.md)
  `CVE-2016-5287` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a denial of service (out-of…](https://agentprime.io/advisories/CVE-2017-5461.md)
  `CVE-2017-5461` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 May 2017
- [A use after free in ANGLE in Google Chrome prior to 57.0.2987.98 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.](https://agentprime.io/advisories/CVE-2017-5031.md)
  `CVE-2017-5031` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 24 Apr 2017

Newest: <https://agentprime.io/advisories/technology/mozilla-firefox.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mozilla-firefox&cursor=WyIyMDE4LTA2LTExVDIxOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAxNy01Mzg0Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mozilla-firefox/?cursor=WyIyMDE4LTA2LTExVDIxOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAxNy01Mzg0Il0>. Everything for agents: <https://agentprime.io/llms.txt>.