Advisories · Technology

Mozilla Firefox.

Every CVE that names Mozilla Firefox among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2024-1549 CVE record

CVSS 6.1 Medium

Mozilla Firefox: If a website set a large custom cursor…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 20 Feb 2024
CVE-2024-1548 CVE record

CVSS 4.3 Medium

A website could have obscured the fullscreen notification by using a dropdown select input element.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 20 Feb 2024
CVE-2024-1547 CVE record

CVSS 6.5 Medium

Authentication bypass by spoofing in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Authentication bypass
Not analysed yet 20 Feb 2024
CVE-2024-1546 CVE record

CVSS 7.5 High

Out-of-bounds read in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 20 Feb 2024
CVE-2024-0754 CVE record

CVSS 6.5 Medium

Some WASM source files could have caused a crash when loaded in devtools.
- Mozilla Firefox
- CWE-248
Not analysed yet 23 Jan 2024
CVE-2024-0752 CVE record

CVSS 6.5 Medium

Use after free in Mozilla Firefox
- Mozilla Firefox
- Memory corruption
Not analysed yet 23 Jan 2024
CVE-2024-0748 CVE record

CVSS 4.3 Medium

A compromised content process could have updated the document URI.
- Mozilla Firefox
Not analysed yet 23 Jan 2024
CVE-2024-0745 CVE record

CVSS 8.8 High

Out-of-bounds write in Mozilla Firefox
- Mozilla Firefox
- Memory corruption
Not analysed yet 23 Jan 2024
CVE-2024-0744 CVE record

CVSS 7.5 High

Buffer overflow in Mozilla Firefox
- Mozilla Firefox
- Memory corruption
Not analysed yet 23 Jan 2024
CVE-2024-0743 CVE record

CVSS 7.5 High

Unchecked return value in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-252
Not analysed yet 23 Jan 2024
CVE-2024-0755 CVE record

CVSS 8.8 High

Code injection in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Code injection
Not analysed yet 23 Jan 2024
CVE-2024-0753 CVE record

CVSS 6.5 Medium

In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 23 Jan 2024
CVE-2024-0751 CVE record

CVSS 8.8 High

Improper privilege management in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Privilege escalation
Not analysed yet 23 Jan 2024
CVE-2024-0750 CVE record

CVSS 8.8 High

Mozilla Firefox: A bug in popup notifications delay calculation could have made it possible for an…
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-451
Not analysed yet 23 Jan 2024
CVE-2024-0749 CVE record

CVSS 4.3 Medium

Origin validation error in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 23 Jan 2024
CVE-2024-0747 CVE record

CVSS 6.5 Medium

Protection mechanism failure in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-693
Not analysed yet 23 Jan 2024
CVE-2024-0746 CVE record

CVSS 6.5 Medium

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 23 Jan 2024
CVE-2024-0742 CVE record

CVSS 4.3 Medium

Mozilla Firefox: It was possible for certain browser prompts and dialogs to be activated or dismissed…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 23 Jan 2024
CVE-2024-0741 CVE record

CVSS 6.5 Medium

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 23 Jan 2024
CVE-2023-6873 CVE record

Memory safety bugs present in Firefox 120.
- Mozilla Firefox
Not analysed yet 19 Dec 2023
CVE-2023-6872 CVE record

Browser tab titles were being leaked by GNOME to system logs.
- Mozilla Firefox
Not analysed yet 19 Dec 2023
CVE-2023-6871 CVE record

Mozilla Firefox: Under certain conditions, Firefox did not display a warning when a user attempted to…
- Mozilla Firefox
Not analysed yet 19 Dec 2023
CVE-2023-6870 CVE record

Mozilla Firefox: Applications which spawn a Toast notification in a background thread may have obscured…
- Mozilla Firefox
Not analysed yet 19 Dec 2023
CVE-2023-6869 CVE record

CVSS 6.5 Medium

A `<dialog>` element could have been manipulated to paint content outside of a sandboxed iframe.
- Mozilla Firefox
Not analysed yet 19 Dec 2023
CVE-2023-6868 CVE record

Mozilla Firefox: In some instances, the user-agent would allow push requests which lacked a valid VAPID…
- Mozilla Firefox
Not analysed yet 19 Dec 2023
CVE-2023-6867 CVE record

Mozilla Firefox ESR: The timing of a button click causing a popup to disappear was approximately the same…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 19 Dec 2023
CVE-2023-6866 CVE record

CVSS 8.8 High

TypedArrays can be fallible and lacked proper exception handling.
- Mozilla Firefox
Not analysed yet 19 Dec 2023
CVE-2023-6865 CVE record

`EncryptingOutputStream` was susceptible to exposing uninitialized data.
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 19 Dec 2023
CVE-2023-6135 CVE record

Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva".
- Mozilla Firefox
Not analysed yet 19 Dec 2023
CVE-2023-6864 CVE record

Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5.
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 19 Dec 2023
CVE-2023-6863 CVE record

Mozilla Firefox ESR: The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its…
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 19 Dec 2023
CVE-2023-6861 CVE record

Mozilla Firefox ESR: The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when…
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 19 Dec 2023
CVE-2023-6860 CVE record

The `VideoBridge` allowed any content process to use textures produced by remote decoders.
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 19 Dec 2023
CVE-2023-6859 CVE record

A use-after-free condition affected TLS socket creation when under memory pressure.
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 19 Dec 2023
CVE-2023-6858 CVE record

CVSS 8.8 High

Out-of-bounds write in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 19 Dec 2023
CVE-2023-6857 CVE record

Mozilla Firefox ESR: When resolving a symlink, a race may occur where the buffer passed to `readlink` may…
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 19 Dec 2023
CVE-2023-6856 CVE record

Mozilla Firefox ESR: The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when…
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 19 Dec 2023
CVE-2023-6213 CVE record

Memory safety bugs present in Firefox 119.
- Mozilla Firefox
Not analysed yet 21 Nov 2023
CVE-2023-6212 CVE record

Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 21 Nov 2023
CVE-2023-6211 CVE record

Mozilla Firefox: If an attacker needed a user to load an insecure http: page and knew that user had…
- Mozilla Firefox
Not analysed yet 21 Nov 2023
CVE-2023-6210 CVE record

Mozilla Firefox: When an https: web page created a pop-up from a "javascript:" URL…
- Mozilla Firefox
Not analysed yet 21 Nov 2023
CVE-2023-6209 CVE record

Mozilla Firefox: Relative URLs starting with three slashes were incorrectly parsed…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 21 Nov 2023
CVE-2023-6208 CVE record

Mozilla Firefox: When using X11, text selected by the page using the Selection API was erroneously copied…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 21 Nov 2023
CVE-2023-6207 CVE record

Mozilla Firefox: Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 21 Nov 2023
CVE-2023-6206 CVE record

Mozilla Firefox: The black fade animation when exiting fullscreen is roughly the length of the…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 21 Nov 2023
CVE-2023-6205 CVE record

Mozilla Firefox: It was possible to cause the use of a MessagePort after it had already been freed…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 21 Nov 2023
CVE-2023-6204 CVE record

Mozilla Firefox: On some systems—depending on the graphics settings and drivers—it was possible to force…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 21 Nov 2023
CVE-2023-5732 CVE record

Address bar spoofing via bidirectional characters
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 24 Oct 2023
CVE-2023-5731 CVE record

Memory safety bugs present in Firefox 118.
- Mozilla Firefox
Not analysed yet 24 Oct 2023
CVE-2023-5730 CVE record

Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 24 Oct 2023
CVE-2023-5729 CVE record

A malicious web site can enter fullscreen mode while simultaneously triggering a WebAuthn prompt.
- Mozilla Firefox
Not analysed yet 24 Oct 2023
CVE-2023-5728 CVE record

CVSS 7.5 High

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 24 Oct 2023
CVE-2023-5727 CVE record

Mozilla Firefox: The executable file warning was not presented when downloading .msix, .msixbundle, .appx…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 24 Oct 2023
CVE-2023-5726 CVE record

A website could have obscured the full screen notification by using the file open dialog.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 24 Oct 2023
CVE-2023-5725 CVE record

Mozilla Firefox: A malicious installed WebExtension could open arbitrary URLs…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 24 Oct 2023
CVE-2023-5724 CVE record

CVSS 7.5 High

Uncontrolled resource consumption in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Denial of service
Not analysed yet 24 Oct 2023
CVE-2023-5723 CVE record

Mozilla Firefox: An attacker with temporary script access to a site could have set a cookie containing…
- Mozilla Firefox
Not analysed yet 24 Oct 2023
CVE-2023-5722 CVE record

Mozilla Firefox: Using iterative requests an attacker was able to learn the size of an opaque response…
- Mozilla Firefox
Not analysed yet 24 Oct 2023
CVE-2023-5721 CVE record

Mozilla Firefox: It was possible for certain browser prompts and dialogs to be activated or dismissed…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 24 Oct 2023
CVE-2023-5175 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use after free in Mozilla Firefox
- Mozilla Firefox
- Memory corruption
Not analysed yet 27 Sept 2023