Advisories · Technology

Mozilla Firefox.

Every CVE that names Mozilla Firefox among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2017-5383 CVE record

Mozilla Thunderbird: URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5382 CVE record

Mozilla Firefox: Feed preview for RSS feeds can be used to capture errors and exceptions generated by…
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2017-5381 CVE record

Mozilla Firefox: The "export" function in the Certificate Viewer can force local filesystem navigation…
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2017-5380 CVE record

A potential use-after-free found through fuzzing during DOM manipulation of SVG content.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5379 CVE record

Mozilla Firefox: Use-after-free vulnerability in Web Animations when interacting with cycle collection…
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2017-5378 CVE record

Hashed codes of JavaScript objects are shared between pages.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5377 CVE record

Mozilla Firefox: A memory corruption vulnerability in Skia that can occur when using transforms to make…
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2017-5376 CVE record

Use-after-free while manipulating XSL in XSLT documents.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5375 CVE record

Mozilla Thunderbird: JIT code allocation can allow for a bypass of ASLR and DEP protections leading to…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5374 CVE record

Memory safety bugs were reported in Firefox 50.1.
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2017-5373 CVE record

Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-9904 CVE record

Mozilla Firefox: An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-9903 CVE record

Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability.
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9902 CVE record

Mozilla Firefox ESR: The Pocket toolbar button, once activated…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9901 CVE record

Mozilla Firefox ESR: HTML tags received from the Pocket server will be processed without sanitization and any…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9900 CVE record

Mozilla Firefox: External resources that should be blocked when loaded by SVG images can bypass security…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-9899 CVE record

Mozilla Firefox: Use-after-free while manipulating DOM events and removing audio elements due to errors in…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-9898 CVE record

Mozilla Firefox: Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-9897 CVE record

Mozilla Firefox: Memory corruption resulting in a potentially exploitable crash during WebGL functions…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-9896 CVE record

Use-after-free while manipulating the "navigator" object within WebVR.
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9895 CVE record

Mozilla Firefox: Event handlers on "marquee" elements were executed despite a strict Content Security…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-9894 CVE record

A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation.
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9893 CVE record

Memory safety bugs were reported in Thunderbird 45.5.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-9080 CVE record

Memory safety bugs were reported in Firefox 50.0.2.
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9079 CVE record

CVSS 7.5 HighCritical · KEV, CVSS 7+ and EPSSKEV

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 11 Jun 2018
CVE-2016-9078 CVE record

Mozilla Firefox: Redirection from an HTTP connection to a "data:" URL assigns the referring site's origin…
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9077 CVE record

Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin.
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9076 CVE record

Mozilla Firefox: An issue where a "<select>" dropdown menu can be used to cover location bar content…
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9075 CVE record

Mozilla Firefox: An issue where WebExtensions can use the mozAddonManager API to elevate privilege due to…
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9074 CVE record

An existing mitigation of timing side-channel attacks is insufficient in some circumstances.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-9073 CVE record

Mozilla Firefox: WebExtensions can bypass security checks to load privileged URLs and potentially escape…
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9072 CVE record

Mozilla Firefox: When a new Firefox profile is created on 64-bit Windows installations…
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9071 CVE record

Mozilla Firefox: Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious…
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9070 CVE record

Mozilla Firefox: A maliciously crafted page loaded to the sidebar through a bookmark can reference a…
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9068 CVE record

Mozilla Firefox: A use-after-free during web animations when working with timelines resulting in a…
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9067 CVE record

Two use-after-free errors during DOM operations resulting in potentially exploitable crashes.
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9066 CVE record

Mozilla Thunderbird: A buffer overflow resulting in a potentially exploitable crash due to memory allocation…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-9065 CVE record

Mozilla Firefox: The location bar in Firefox for Android can be spoofed by forcing a user into fullscreen…
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9064 CVE record

Mozilla Firefox ESR: Add-on updates failed to verify that the add-on ID inside the signed package matched the…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9063 CVE record

An integer overflow during the parsing of XML using the Expat library.
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9062 CVE record

Mozilla Firefox: Private browsing mode leaves metadata information, such as URLs…
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9061 CVE record

Mozilla Firefox: A previously installed malicious Android application which defines a specific…
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-5299 CVE record

Mozilla Firefox: A previously installed malicious Android application with same signature-level…
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-5298 CVE record

Mozilla Firefox: A mechanism where disruption of the loading of a new web page can cause the previous…
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-5297 CVE record

Mozilla Thunderbird: An error in argument length checking in JavaScript…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-5296 CVE record

Mozilla Thunderbird: A heap-buffer-overflow in Cairo when processing SVG content caused by compiler…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-5295 CVE record

Mozilla Firefox: This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate…
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-5294 CVE record

Mozilla Thunderbird: The Mozilla Updater can be made to choose an arbitrary target working directory for…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-5293 CVE record

Mozilla Firefox ESR: When the Mozilla Updater is run, if the Updater's log file in the working directory…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-5292 CVE record

During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash.
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-5291 CVE record

A same-origin policy bypass with local shortcut files to load arbitrary local content from disk.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-5290 CVE record

Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-5289 CVE record

Memory safety bugs were reported in Firefox 49.
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-5288 CVE record

Web content could access information in the HTTP cache if e10s is disabled.
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-5287 CVE record

A potentially exploitable use-after-free crash during actor destruction with service workers.
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2017-5461 CVE record

Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a denial of service (out-of…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 May 2017
CVE-2017-5031 CVE record

A use after free in ANGLE in Google Chrome prior to 57.0.2987.98 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 24 Apr 2017