Advisories · Technology

Mozilla Firefox.

Every CVE that names Mozilla Firefox among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2020-12417 CVE record

Mozilla Firefox ESR: Due to confusion about ValueTags on JavaScript Objects…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 9 Jul 2020
CVE-2020-12415 CVE record

Mozilla Firefox: When "%2F" was present in a manifest URL…
- Mozilla Firefox
Not analysed yet 9 Jul 2020
CVE-2020-12426 CVE record

Mozilla developers and community members reported memory safety bugs present in Firefox 77.
- Mozilla Firefox
Not analysed yet 9 Jul 2020
CVE-2020-12418 CVE record

Mozilla Firefox ESR: Manipulating individual parts of a URL object could have caused an out-of-bounds read…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 9 Jul 2020
CVE-2020-12424 CVE record

When constructing a permission prompt for WebRTC, a URI was supplied from the content process.
- Mozilla Firefox
Not analysed yet 9 Jul 2020
CVE-2018-12371 CVE record

Mozilla Firefox ESR: An integer overflow vulnerability in the Skia library when allocating memory for edge…
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 9 Jul 2020
CVE-2020-6831 CVE record

A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC.
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 26 May 2020
CVE-2020-12387 CVE record

A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability.
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 26 May 2020
CVE-2020-12388 CVE record

Mozilla Firefox ESR: The Firefox content processes did not sufficiently lockdown access control which could…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 26 May 2020
CVE-2020-12389 CVE record

Mozilla Firefox ESR: The Firefox content processes did not sufficiently lockdown access control which could…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 26 May 2020
CVE-2020-12390 CVE record

Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks.
- Mozilla Firefox
Not analysed yet 26 May 2020
CVE-2020-12391 CVE record

Mozilla Firefox: Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the…
- Mozilla Firefox
Not analysed yet 26 May 2020
CVE-2020-12392 CVE record

Mozilla Firefox ESR: The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 26 May 2020
CVE-2020-12393 CVE record

Mozilla Firefox ESR: The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 26 May 2020
CVE-2020-12394 CVE record

Mozilla Firefox: A logic flaw in our location bar implementation could have allowed a local attacker to…
- Mozilla Firefox
Not analysed yet 26 May 2020
CVE-2020-12395 CVE record

Mozilla Firefox ESR: Mozilla developers and community members reported memory safety bugs present in Firefox…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 26 May 2020
CVE-2020-12396 CVE record

Mozilla developers and community members reported memory safety bugs present in Firefox 75.
- Mozilla Firefox
Not analysed yet 26 May 2020
CVE-2020-6819 CVE record

CVSS 8.1 HighCritical · KEVKEV

Use after free in Mozilla Thunderbird and others
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 24 Apr 2020
CVE-2020-6820 CVE record

CVSS 8.1 HighCritical · KEVKEV

Race condition in Mozilla Thunderbird and others
- Mozilla Thunderbird
- Mozilla Firefox
- Race condition
Not analysed yet 24 Apr 2020
CVE-2020-6821 CVE record

Mozilla Thunderbird: When reading from areas partially or fully outside the source resource with WebGL's…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 24 Apr 2020
CVE-2020-6822 CVE record

Mozilla Thunderbird: On 32-bit builds, an out of bounds write could have occurred when processing an image…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 24 Apr 2020
CVE-2020-6823 CVE record

Mozilla Firefox: A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>…
- Mozilla Firefox
Not analysed yet 24 Apr 2020
CVE-2020-6824 CVE record

Mozilla Firefox: Initially, a user opens a Private Browsing Window and generates a password for a site…
- Mozilla Firefox
Not analysed yet 24 Apr 2020
CVE-2020-6826 CVE record

Mozilla Firefox: Mozilla developers Tyson Smith, Bob Clary…
- Mozilla Firefox
Not analysed yet 24 Apr 2020
CVE-2020-6825 CVE record

Mozilla Thunderbird: Mozilla developers and community members Tyson Smith and Christian Holler reported memory…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 24 Apr 2020
CVE-2020-6805 CVE record

Mozilla Thunderbird: When removing data about an origin whose tab was recently closed…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 25 Mar 2020
CVE-2020-6806 CVE record

Mozilla Thunderbird: By carefully crafting promise resolutions…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 25 Mar 2020
CVE-2020-6807 CVE record

Mozilla Thunderbird: When a device was changed while a stream was about to be destroyed…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 25 Mar 2020
CVE-2020-6808 CVE record

Mozilla Firefox: When a JavaScript URL (javascript:) is evaluated and the result is a string…
- Mozilla Firefox
Not analysed yet 25 Mar 2020
CVE-2020-6809 CVE record

Mozilla Firefox: When a Web Extension had the all-urls permission and made a fetch request with a mode set…
- Mozilla Firefox
Not analysed yet 25 Mar 2020
CVE-2020-6810 CVE record

Mozilla Firefox: After a website had entered fullscreen mode…
- Mozilla Firefox
Not analysed yet 25 Mar 2020
CVE-2020-6811 CVE record

Mozilla Thunderbird: The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 25 Mar 2020
CVE-2020-6812 CVE record

Mozilla Thunderbird: The first time AirPods are connected to an iPhone…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 25 Mar 2020
CVE-2020-6813 CVE record

Mozilla Firefox: When protecting CSS blocks with the nonce feature of Content Security Policy…
- Mozilla Firefox
Not analysed yet 25 Mar 2020
CVE-2020-6814 CVE record

Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5.
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 25 Mar 2020
CVE-2020-6815 CVE record

Mozilla developers reported memory safety and script safety bugs present in Firefox 73.
- Mozilla Firefox
Not analysed yet 25 Mar 2020
CVE-2020-6801 CVE record

Mozilla developers reported memory safety bugs present in Firefox 72.
- Mozilla Firefox
Not analysed yet 2 Mar 2020
CVE-2020-6800 CVE record

Mozilla Thunderbird: Mozilla developers and community members reported memory safety bugs present in Firefox…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 2 Mar 2020
CVE-2020-6799 CVE record

Mozilla Firefox: Command line arguments could have been injected during Firefox invocation as a shell…
- Mozilla Firefox
Not analysed yet 2 Mar 2020
CVE-2020-6798 CVE record

Mozilla Thunderbird: If a template tag was used in a select tag…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 2 Mar 2020
CVE-2020-6797 CVE record

Mozilla Thunderbird: By downloading a file with the .fileloc extension…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 2 Mar 2020
CVE-2020-6796 CVE record

Mozilla Firefox: A content process could have modified shared memory relating to crash reporting…
- Mozilla Firefox
Not analysed yet 2 Mar 2020
CVE-2019-17026 CVE record

CVSS 8.8 HighCritical · KEV, CVSS 7+ and EPSSKEV

Type confusion in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 2 Mar 2020
CVE-2013-5594 CVE record

Mozilla Firefox before 25 allows modification of anonymous content of pluginProblem.xml binding
- Mozilla Firefox
Not analysed yet 18 Feb 2020
CVE-2011-2669 CVE record

Mozilla Firefox: Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of…
- Mozilla Firefox
Not analysed yet 21 Jan 2020
CVE-2011-2668 CVE record

Mozilla Firefox through 1.5.0.3 has a vulnerability in processing the content-length header
- Mozilla Firefox
Not analysed yet 21 Jan 2020
CVE-2011-2670 CVE record

Mozilla Firefox before 3.6 is vulnerable to XSS via the rendering of Cascading Style Sheets
- Mozilla Firefox
Not analysed yet 13 Jan 2020
CVE-2019-17001 CVE record

Mozilla Firefox: A Content-Security-Policy that blocks in-line scripts could be bypassed using an object…
- Mozilla Firefox
Not analysed yet 8 Jan 2020
CVE-2019-9812 CVE record

Mozilla Firefox ESR: Given a compromised sandboxed content process due to a separate vulnerability…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 8 Jan 2020
CVE-2019-17025 CVE record

Mozilla developers reported memory safety bugs present in Firefox 71.
- Mozilla Firefox
Not analysed yet 8 Jan 2020
CVE-2019-17024 CVE record

Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3.
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 8 Jan 2020
CVE-2019-17023 CVE record

Mozilla Firefox: After a HelloRetryRequest has been sent…
- Mozilla Firefox
Not analysed yet 8 Jan 2020
CVE-2019-17022 CVE record

Mozilla Firefox ESR: When pasting a <style> tag from the clipboard into a rich text editor…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 8 Jan 2020
CVE-2019-17021 CVE record

Mozilla Firefox ESR: During the initialization of a new content process…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 8 Jan 2020
CVE-2019-17020 CVE record

Mozilla Firefox: If an XML file is served with a Content Security Policy and the XML file includes an XSL…
- Mozilla Firefox
Not analysed yet 8 Jan 2020
CVE-2019-17019 CVE record

Mozilla Firefox: When Python was installed on Windows…
- Mozilla Firefox
Not analysed yet 8 Jan 2020
CVE-2019-17018 CVE record

Mozilla Firefox: When in Private Browsing Mode on Windows 10…
- Mozilla Firefox
Not analysed yet 8 Jan 2020
CVE-2019-17017 CVE record

Mozilla Firefox ESR: Due to a missing case handling object types, a type confusion vulnerability could occur…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 8 Jan 2020
CVE-2019-17016 CVE record

Mozilla Firefox ESR: When pasting a <style> tag from the clipboard into a rich text editor…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 8 Jan 2020
CVE-2019-17015 CVE record

Mozilla Firefox ESR: During the initialization of a new content process…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 8 Jan 2020