# Mozilla Firefox.

Every CVE that names Mozilla Firefox among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Mozilla Firefox: The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs…](https://agentprime.io/advisories/CVE-2018-5176.md)
  `CVE-2018-5176` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: A mechanism to bypass Content Security Policy (CSP) protections on sites that have a…](https://agentprime.io/advisories/CVE-2018-5175.md)
  `CVE-2018-5175` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the…](https://agentprime.io/advisories/CVE-2018-5174.md)
  `CVE-2018-5174` · CVE record: Mozilla Thunderbird and 3 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: The filename appearing in the "Downloads" panel improperly renders some Unicode…](https://agentprime.io/advisories/CVE-2018-5173.md)
  `CVE-2018-5173` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: The Live Bookmarks page and the PDF viewer can run injected script content if a user…](https://agentprime.io/advisories/CVE-2018-5172.md)
  `CVE-2018-5172` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: If manipulated hyperlinked text with "chrome:" URL contained in it is dragged and dropped…](https://agentprime.io/advisories/CVE-2018-5169.md)
  `CVE-2018-5169` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: Sites can bypass security checks on permissions to install lightweight themes by…](https://agentprime.io/advisories/CVE-2018-5168.md)
  `CVE-2018-5168` · CVE record: Mozilla Thunderbird and 3 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [The web console and JavaScript debugger do not sanitize all output that can be hyperlinked.](https://agentprime.io/advisories/CVE-2018-5167.md)
  `CVE-2018-5167` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: WebExtensions can use request redirection and a "filterReponseData" filter to bypass host…](https://agentprime.io/advisories/CVE-2018-5166.md)
  `CVE-2018-5166` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash…](https://agentprime.io/advisories/CVE-2018-5165.md)
  `CVE-2018-5165` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: Content Security Policy (CSP) is not applied correctly to all parts of multipart content…](https://agentprime.io/advisories/CVE-2018-5164.md)
  `CVE-2018-5164` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: If a malicious attacker has used another vulnerability to gain full control over a…](https://agentprime.io/advisories/CVE-2018-5163.md)
  `CVE-2018-5163` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: WebRTC can use a "WrappedI420Buffer" pixel buffer but the owning image object can be…](https://agentprime.io/advisories/CVE-2018-5160.md)
  `CVE-2018-5160` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: An integer overflow can occur in the Skia library due to 32-bit integer use in an array…](https://agentprime.io/advisories/CVE-2018-5159.md)
  `CVE-2018-5159` · CVE record: Mozilla Thunderbird and 3 more · No CVSS score · EPSS 0.21 · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox ESR: Same-origin protections for the PDF viewer can be bypassed…](https://agentprime.io/advisories/CVE-2018-5157.md)
  `CVE-2018-5157` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: A use-after-free vulnerability can occur while adjusting layout during SVG animations…](https://agentprime.io/advisories/CVE-2018-5155.md)
  `CVE-2018-5155` · CVE record: Mozilla Thunderbird and 3 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: A use-after-free vulnerability can occur while enumerating attributes during SVG…](https://agentprime.io/advisories/CVE-2018-5154.md)
  `CVE-2018-5154` · CVE record: Mozilla Thunderbird and 3 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: If websocket data is sent with mixed text and binary in a single message…](https://agentprime.io/advisories/CVE-2018-5153.md)
  `CVE-2018-5153` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: WebExtensions with the appropriate permissions can attach content scripts to Mozilla…](https://agentprime.io/advisories/CVE-2018-5152.md)
  `CVE-2018-5152` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Memory safety bugs were reported in Firefox 59.](https://agentprime.io/advisories/CVE-2018-5151.md)
  `CVE-2018-5151` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7.](https://agentprime.io/advisories/CVE-2018-5150.md)
  `CVE-2018-5150` · CVE record: Mozilla Thunderbird and 3 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox ESR: A use-after-free vulnerability can occur in the compositor during certain graphics…](https://agentprime.io/advisories/CVE-2018-5148.md)
  `CVE-2018-5148` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [The libtremor library has the same flaw as CVE-2018-5146.](https://agentprime.io/advisories/CVE-2018-5147.md)
  `CVE-2018-5147` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: An out of bounds memory write while processing Vorbis audio data was reported through the…](https://agentprime.io/advisories/CVE-2018-5146.md)
  `CVE-2018-5146` · CVE record: Mozilla Firefox and 2 more · No CVSS score · EPSS 0.12 · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: URLs using "javascript:" have the protocol removed when pasted into the addressbar to…](https://agentprime.io/advisories/CVE-2018-5143.md)
  `CVE-2018-5143` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: If Media Capture and Streams API permission is requested from documents with "data:" or…](https://agentprime.io/advisories/CVE-2018-5142.md)
  `CVE-2018-5142` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: A vulnerability in the notifications Push API where notifications can be sent through…](https://agentprime.io/advisories/CVE-2018-5141.md)
  `CVE-2018-5141` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: Image for moz-icons can be accessed through the "moz-icon:" protocol through script in…](https://agentprime.io/advisories/CVE-2018-5140.md)
  `CVE-2018-5140` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: A spoofing vulnerability can occur when a malicious site with an extremely long domain…](https://agentprime.io/advisories/CVE-2018-5138.md)
  `CVE-2018-5138` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: A legacy extension's non-contentaccessible…](https://agentprime.io/advisories/CVE-2018-5137.md)
  `CVE-2018-5137` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: A shared worker created from a "data:" URL in one tab can be shared by another tab with a…](https://agentprime.io/advisories/CVE-2018-5136.md)
  `CVE-2018-5136` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: WebExtensions can bypass normal restrictions in some circumstances and use…](https://agentprime.io/advisories/CVE-2018-5135.md)
  `CVE-2018-5135` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: WebExtensions may use "view-source:" URLs to view local "file:" URL content…](https://agentprime.io/advisories/CVE-2018-5134.md)
  `CVE-2018-5134` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: If the "app.support.baseURL" preference is changed by a malicious local program to…](https://agentprime.io/advisories/CVE-2018-5133.md)
  `CVE-2018-5133` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: The Find API for WebExtensions can search some privileged pages…](https://agentprime.io/advisories/CVE-2018-5132.md)
  `CVE-2018-5132` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox ESR: Under certain circumstances the "fetch()" API can return transient local copies of…](https://agentprime.io/advisories/CVE-2018-5131.md)
  `CVE-2018-5131` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox ESR: When packets with a mismatched RTP payload type are sent in WebRTC connections…](https://agentprime.io/advisories/CVE-2018-5130.md)
  `CVE-2018-5130` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: A lack of parameter validation on IPC messages results in a potential out-of-bounds write…](https://agentprime.io/advisories/CVE-2018-5129.md)
  `CVE-2018-5129` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: A use-after-free vulnerability can occur when manipulating elements, events…](https://agentprime.io/advisories/CVE-2018-5128.md)
  `CVE-2018-5128` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script.](https://agentprime.io/advisories/CVE-2018-5127.md)
  `CVE-2018-5127` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Memory safety bugs were reported in Firefox 58.](https://agentprime.io/advisories/CVE-2018-5126.md)
  `CVE-2018-5126` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Memory safety bugs were reported in Firefox 58 and Firefox ESR 52.6.](https://agentprime.io/advisories/CVE-2018-5125.md)
  `CVE-2018-5125` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [A potential integer overflow in the "DoCrypt" function of WebCrypto was identified.](https://agentprime.io/advisories/CVE-2018-5122.md)
  `CVE-2018-5122` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: Low descenders on some Tibetan characters in several fonts on OS X are clipped when…](https://agentprime.io/advisories/CVE-2018-5121.md)
  `CVE-2018-5121` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: The reader view will display cross-origin content when CORS headers are set to prohibit…](https://agentprime.io/advisories/CVE-2018-5119.md)
  `CVE-2018-5119` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: The screenshot images displayed in the Activity Stream page displayed when a new tab is…](https://agentprime.io/advisories/CVE-2018-5118.md)
  `CVE-2018-5118` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: If right-to-left text is used in the addressbar with left-to-right alignment…](https://agentprime.io/advisories/CVE-2018-5117.md)
  `CVE-2018-5117` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: WebExtensions with the "ActiveTab" permission are able to access frames hosted within the…](https://agentprime.io/advisories/CVE-2018-5116.md)
  `CVE-2018-5116` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: If an HTTP authentication prompt is triggered by a background network request from a page…](https://agentprime.io/advisories/CVE-2018-5115.md)
  `CVE-2018-5115` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: If an existing cookie is changed to be "HttpOnly" while a document is open…](https://agentprime.io/advisories/CVE-2018-5114.md)
  `CVE-2018-5114` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: The "browser.identity.launchWebAuthFlow" function of WebExtensions is only allowed to…](https://agentprime.io/advisories/CVE-2018-5113.md)
  `CVE-2018-5113` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: Development Tools panels of an extension are required to load URLs for the panels as…](https://agentprime.io/advisories/CVE-2018-5112.md)
  `CVE-2018-5112` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: When the text of a specially formatted URL is dragged to the addressbar from page…](https://agentprime.io/advisories/CVE-2018-5111.md)
  `CVE-2018-5111` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: If cursor visibility is toggled by script using from 'none' to an image and back through…](https://agentprime.io/advisories/CVE-2018-5110.md)
  `CVE-2018-5110` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: An audio capture session can started under an incorrect origin from the site making the…](https://agentprime.io/advisories/CVE-2018-5109.md)
  `CVE-2018-5109` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: A Blob URL can violate origin attribute segregation…](https://agentprime.io/advisories/CVE-2018-5108.md)
  `CVE-2018-5108` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: The printing process can bypass local access protections to read files available through…](https://agentprime.io/advisories/CVE-2018-5107.md)
  `CVE-2018-5107` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: Style editor traffic in the Developer Tools can be routed through a service worker hosted…](https://agentprime.io/advisories/CVE-2018-5106.md)
  `CVE-2018-5106` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [WebExtensions can bypass user prompts to first save and then open an arbitrarily downloaded file.](https://agentprime.io/advisories/CVE-2018-5105.md)
  `CVE-2018-5105` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: A use-after-free vulnerability can occur during font face manipulation when a font face…](https://agentprime.io/advisories/CVE-2018-5104.md)
  `CVE-2018-5104` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018

Newest: <https://agentprime.io/advisories/technology/mozilla-firefox.md>
Older: <https://agentprime.io/advisories/technology/mozilla-firefox.md?cursor=WyIyMDE4LTA2LTExVDIxOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAxOC01MTA0Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mozilla-firefox&cursor=WyIyMDE4LTA2LTExVDIxOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAxOC01MTc3Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mozilla-firefox/?cursor=WyIyMDE4LTA2LTExVDIxOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAxOC01MTc3Il0>. Everything for agents: <https://agentprime.io/llms.txt>.