Mozilla Firefox.

Mozilla Firefox: The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs…

• Mozilla Firefox

Mozilla Firefox: A mechanism to bypass Content Security Policy (CSP) protections on sites that have a…

• Mozilla Firefox

Mozilla Thunderbird: In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the…

• Mozilla Thunderbird
• Mozilla Thunderbird ESR

Mozilla Firefox: The filename appearing in the "Downloads" panel improperly renders some Unicode…

• Mozilla Firefox

Mozilla Firefox: The Live Bookmarks page and the PDF viewer can run injected script content if a user…

• Mozilla Firefox

Mozilla Firefox: If manipulated hyperlinked text with "chrome:" URL contained in it is dragged and dropped…

• Mozilla Firefox

Mozilla Thunderbird: Sites can bypass security checks on permissions to install lightweight themes by…

• Mozilla Thunderbird
• Mozilla Thunderbird ESR

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked.

• Mozilla Firefox

Mozilla Firefox: WebExtensions can use request redirection and a "filterReponseData" filter to bypass host…

• Mozilla Firefox

Mozilla Firefox: In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash…

• Mozilla Firefox

Mozilla Firefox: Content Security Policy (CSP) is not applied correctly to all parts of multipart content…

• Mozilla Firefox

Mozilla Firefox: If a malicious attacker has used another vulnerability to gain full control over a…

• Mozilla Firefox

Mozilla Firefox: WebRTC can use a "WrappedI420Buffer" pixel buffer but the owning image object can be…

• Mozilla Firefox

Mozilla Thunderbird: An integer overflow can occur in the Skia library due to 32-bit integer use in an array…

• Mozilla Thunderbird
• Mozilla Thunderbird ESR

Mozilla Firefox ESR: Same-origin protections for the PDF viewer can be bypassed…

• Mozilla Firefox ESR
• Mozilla Firefox

Mozilla Thunderbird: A use-after-free vulnerability can occur while adjusting layout during SVG animations…

• Mozilla Thunderbird
• Mozilla Thunderbird ESR

Mozilla Thunderbird: A use-after-free vulnerability can occur while enumerating attributes during SVG…

• Mozilla Thunderbird
• Mozilla Thunderbird ESR

Mozilla Firefox: If websocket data is sent with mixed text and binary in a single message…

• Mozilla Firefox

Mozilla Firefox: WebExtensions with the appropriate permissions can attach content scripts to Mozilla…

• Mozilla Firefox

Memory safety bugs were reported in Firefox 59.

• Mozilla Firefox

Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7.

• Mozilla Thunderbird
• Mozilla Thunderbird ESR

Mozilla Firefox ESR: A use-after-free vulnerability can occur in the compositor during certain graphics…

• Mozilla Firefox ESR
• Mozilla Firefox

The libtremor library has the same flaw as CVE-2018-5146.

• Mozilla Firefox ESR
• Mozilla Firefox

Mozilla Firefox: An out of bounds memory write while processing Vorbis audio data was reported through the…

• Mozilla Firefox
• Mozilla Firefox ESR

Mozilla Firefox: URLs using "javascript:" have the protocol removed when pasted into the addressbar to…

• Mozilla Firefox

Mozilla Firefox: If Media Capture and Streams API permission is requested from documents with "data:" or…

• Mozilla Firefox

Mozilla Firefox: A vulnerability in the notifications Push API where notifications can be sent through…

• Mozilla Firefox

Mozilla Firefox: Image for moz-icons can be accessed through the "moz-icon:" protocol through script in…

• Mozilla Firefox

Mozilla Firefox: A spoofing vulnerability can occur when a malicious site with an extremely long domain…

• Mozilla Firefox

Mozilla Firefox: A legacy extension's non-contentaccessible…

• Mozilla Firefox

Mozilla Firefox: A shared worker created from a "data:" URL in one tab can be shared by another tab with a…

• Mozilla Firefox

Mozilla Firefox: WebExtensions can bypass normal restrictions in some circumstances and use…

• Mozilla Firefox

Mozilla Firefox: WebExtensions may use "view-source:" URLs to view local "file:" URL content…

• Mozilla Firefox

Mozilla Firefox: If the "app.support.baseURL" preference is changed by a malicious local program to…

• Mozilla Firefox

Mozilla Firefox: The Find API for WebExtensions can search some privileged pages…

• Mozilla Firefox

Mozilla Firefox ESR: Under certain circumstances the "fetch()" API can return transient local copies of…

• Mozilla Firefox ESR
• Mozilla Firefox

Mozilla Firefox ESR: When packets with a mismatched RTP payload type are sent in WebRTC connections…

• Mozilla Firefox ESR
• Mozilla Firefox

Mozilla Thunderbird: A lack of parameter validation on IPC messages results in a potential out-of-bounds write…

• Mozilla Thunderbird
• Mozilla Firefox ESR

Mozilla Firefox: A use-after-free vulnerability can occur when manipulating elements, events…

• Mozilla Firefox

A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script.

• Mozilla Thunderbird
• Mozilla Firefox ESR

Memory safety bugs were reported in Firefox 58.

• Mozilla Firefox

Memory safety bugs were reported in Firefox 58 and Firefox ESR 52.6.

• Mozilla Thunderbird
• Mozilla Firefox ESR

A potential integer overflow in the "DoCrypt" function of WebCrypto was identified.

• Mozilla Firefox

Mozilla Firefox: Low descenders on some Tibetan characters in several fonts on OS X are clipped when…

• Mozilla Firefox

Mozilla Firefox: The reader view will display cross-origin content when CORS headers are set to prohibit…

• Mozilla Firefox

Mozilla Firefox: The screenshot images displayed in the Activity Stream page displayed when a new tab is…

• Mozilla Firefox

Mozilla Thunderbird: If right-to-left text is used in the addressbar with left-to-right alignment…

• Mozilla Thunderbird
• Mozilla Firefox ESR

Mozilla Firefox: WebExtensions with the "ActiveTab" permission are able to access frames hosted within the…

• Mozilla Firefox

Mozilla Firefox: If an HTTP authentication prompt is triggered by a background network request from a page…

• Mozilla Firefox

Mozilla Firefox: If an existing cookie is changed to be "HttpOnly" while a document is open…

• Mozilla Firefox

Mozilla Firefox: The "browser.identity.launchWebAuthFlow" function of WebExtensions is only allowed to…

• Mozilla Firefox

Mozilla Firefox: Development Tools panels of an extension are required to load URLs for the panels as…

• Mozilla Firefox

Mozilla Firefox: When the text of a specially formatted URL is dragged to the addressbar from page…

• Mozilla Firefox

Mozilla Firefox: If cursor visibility is toggled by script using from 'none' to an image and back through…

• Mozilla Firefox

Mozilla Firefox: An audio capture session can started under an incorrect origin from the site making the…

• Mozilla Firefox

Mozilla Firefox: A Blob URL can violate origin attribute segregation…

• Mozilla Firefox

Mozilla Firefox: The printing process can bypass local access protections to read files available through…

• Mozilla Firefox

Mozilla Firefox: Style editor traffic in the Developer Tools can be routed through a service worker hosted…

• Mozilla Firefox

WebExtensions can bypass user prompts to first save and then open an arbitrarily downloaded file.

• Mozilla Firefox

Mozilla Thunderbird: A use-after-free vulnerability can occur during font face manipulation when a font face…

• Mozilla Thunderbird
• Mozilla Firefox ESR