Advisories · Technology
Mozilla Firefox.
Every CVE that names Mozilla Firefox among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Calls to console.log allowed bypassing Content Security Policy via format directive
- Mozilla Firefox
- Mozilla Firefox ESR
- Denial of service
- CVSS 6.5 Medium
Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-754
-
URL being dragged from cross-origin iframe into same tab triggers navigation
- Mozilla Firefox
- Mozilla Firefox ESR
-
Notification permissions persisted between Normal and Private Browsing on Android
- Mozilla Firefox
-
Malicious command could be hidden in devtools output on Windows
- Mozilla Firefox
- Mozilla Firefox ESR
-
Arbitrary file read from GTK drag and drop on Linux
- Mozilla Firefox
- Mozilla Firefox ESR
-
Logic bug in process allocation allowed to read arbitrary files
- Mozilla Firefox
- CVSS 8.8 High
Mozilla Firefox: An attacker could construct a PKCS 12 cert bundle in such a way that could allow for…
- Mozilla Firefox
- Mozilla Thunderbird
- CVSS 5.9 Medium
Observable discrepancy in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Information disclosure
- CVSS 8.8 High
Out-of-bounds write in Mozilla Firefox
- Mozilla Firefox
- Memory corruption
- CVSS 8.8 High
Argument injection in Mozilla Firefox
- Mozilla Firefox
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
- CVSS 8.8 High
Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
- CVSS 6.5 Medium
Use after free in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Firefox
- Memory corruption
- CVSS 8.8 High
Out-of-bounds write in Mozilla Firefox
- Mozilla Firefox
- Memory corruption
- CVSS 8.8 High
Mozilla Firefox: Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay…
- Mozilla Firefox
- Mozilla Firefox ESR
- CVSS 4.3 Medium
Cross-site scripting in Mozilla Firefox
- Mozilla Firefox
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Improper authentication in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Authentication bypass
- CVSS 8.8 High
Code injection in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Code injection
- CVSS 8.8 High
Injection in Mozilla Firefox
- Mozilla Firefox
- Other injection
- CVSS 8.6 High
Out-of-bounds read in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
- CVSS 8.8 High
An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited.
- Mozilla Firefox
- CWE-1104
- CVSS 8.8 High
Out-of-bounds write in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Memory corruption
- CVSS 6.5 Medium
Clickjacking in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- CWE-1021
- CVSS 6.5 Medium
Improper certificate validation in Mozilla Firefox
- Mozilla Firefox
- Weak cryptography or TLS
- CVSS 6.1 Medium
Clickjacking in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- CWE-1021
- CVSS 4.3 Medium
Clickjacking in Mozilla Firefox
- Mozilla Firefox
- CWE-1021
- CVSS 6.5 Medium
Observable discrepancy in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Information disclosure
- CVSS 7.8 High
Unrestricted file upload in Mozilla Firefox
- Mozilla Firefox
- Unrestricted file upload
- CVSS 6.1 Medium
Open redirect in Mozilla Firefox
- Mozilla Firefox
- Open redirect
- CVSS 8.8 High
Symlink following in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Path traversal
- CVSS 6.1 Medium
Cross-site scripting in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Missing authorization in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Broken access control
- CVSS 8.8 High
Use after free in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Memory corruption
- CVSS 6.5 Medium
Cross-site scripting in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Cross-site scripting (XSS)
- CVSS 7.5 High
Use after free in Mozilla Firefox
- Mozilla Firefox
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Use after free in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Memory corruption
- CVSS 6.5 Medium
Use after free in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Memory corruption
- CVSS 6.5 Medium
Mozilla Firefox ESR: Through a series of popup and <code>window.print()</code> calls…
- Mozilla Firefox ESR
- Mozilla Thunderbird
- CWE-451
- CVSS 6.5 Medium
Observable discrepancy in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Information disclosure
- CVSS 8.8 High
Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
- CVSS 3.3 Low
Cleartext storage of sensitive information in Mozilla Firefox
- Mozilla Firefox
- Information disclosure
- CVSS 7.1 High
Race condition in Mozilla Firefox
- Mozilla Firefox
- Race condition
- CVSS 6.5 Medium
Uncontrolled resource consumption in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Denial of service
- CVSS 8.8 High
NULL pointer dereference in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
- CVSS 8.1 High
Origin validation error in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-346
- CVSS 8.8 High
Out-of-bounds write in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Memory corruption
- CVSS 6.5 Medium
Out-of-bounds write in Mozilla Firefox
- Mozilla Firefox
- Memory corruption
- CVSS 6.5 Medium
Use after free in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Memory corruption
- CVSS 6.5 Medium
Insecure storage of sensitive information in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Information disclosure
- CVSS 6.5 Medium
Injection in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Other injection
- CVSS 6.5 Medium
Mozilla Firefox ESR: Inconsistent data in instruction and data cache when creating wasm code could lead to a…
- Mozilla Firefox ESR
- Mozilla Thunderbird
- CWE-240
- CVSS 6.1 Medium
Cross-site scripting in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Cross-site scripting (XSS)
- CVSS 8.8 High
Out-of-bounds write in Mozilla Thunderbird and others
- Mozilla Thunderbird
- Mozilla Firefox ESR
- Memory corruption
- CVSS 8.8 High
Out-of-bounds write in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Memory corruption
- CVSS 6.5 Medium
Incorrect authorization in Mozilla Firefox
- Mozilla Firefox
- Broken access control
- CVSS 4.3 Medium
Resource exposure in Mozilla Firefox
- Mozilla Firefox
- Information disclosure
- CVSS 8.8 High
Mozilla Thunderbird: A cross-origin iframe referencing an XSLT document would inherit the parent domain's…
- Mozilla Thunderbird
- Mozilla Firefox ESR
- CWE-281
- CVSS 6.5 Medium
Origin validation error in Mozilla Thunderbird and others
- Mozilla Thunderbird
- Mozilla Firefox ESR
- CWE-346
- CVSS 9.8 CriticalCritical · CVSS 9+
Out-of-bounds write in Mozilla Firefox
- Mozilla Firefox
- Memory corruption