Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-6872Browser tab titles were being leaked by GNOME to system logs.
- CVE-2023-6871Under certain conditions, Firefox did not display a warning when a user attempted to navigate to a new protocol handler.
- CVE-2023-6870Applications which spawn a Toast notification in a background thread may have obscured fullscreen notifications displayed by Firefox.
- CVE-2023-6869A `<dialog>` element could have been manipulated to paint content outside of a sandboxed iframe.
- CVE-2023-6868In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one
- CVE-2023-6867The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission pro
- CVE-2023-6866TypedArrays can be fallible and lacked proper exception handling.
- CVE-2023-6865`EncryptingOutputStream` was susceptible to exposing uninitialized data.
- CVE-2023-6135Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva".
- CVE-2023-6864Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5.
- CVE-2023-6863The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destr
- CVE-2023-6862A use-after-free was identified in the `nsDNSService::Init`.
- CVE-2023-6861The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode.
- CVE-2023-6860The `VideoBridge` allowed any content process to use textures produced by remote decoders.
- CVE-2023-6859A use-after-free condition affected TLS socket creation when under memory pressure.
- CVE-2023-6858Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling.
- CVE-2023-6857When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary.
- CVE-2023-6856The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver.
- CVE-2023-50761The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time.
- CVE-2023-50762When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was never shown to the user.
- CVE-2023-4421The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks.
- CVE-2023-49061An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information.
- CVE-2023-49060An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the `referrerpolicy` attribute.
- CVE-2023-6213Memory safety bugs present in Firefox 119.
- CVE-2023-6212Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4.
- CVE-2023-6211If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacker could have tricked
- CVE-2023-6210When an https: web page created a pop-up from a "javascript:" URL, that pop-up was incorrectly allowed to load blockable content such as ifr
- CVE-2023-6209Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override th
- CVE-2023-6208When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not
- CVE-2023-6207Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and