Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-23599Malicious command could be hidden in devtools output on Windows
- CVE-2023-23598Arbitrary file read from GTK drag and drop on Linux
- CVE-2023-23597Logic bug in process allocation allowed to read arbitrary files
- CVE-2023-1945Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.
- CVE-2023-0767An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes
- CVE-2023-0616If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message,
- CVE-2023-0547OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be acce
- CVE-2023-0430Certificate OCSP revocation status was not checked when verifying S/Mime signatures.
- CVE-2021-43529Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages.
- CVE-2021-23980A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscrip
- CVE-2020-6817bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS).
- CVE-2020-12413The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification.
- CVE-2019-17003Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed.
- CVE-2022-46885Mozilla developers Timothy Nikkel, Ashley Hale, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105.
- CVE-2022-46883Mozilla developers Gabriele Svelto, Yulia Startsev, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Fir
- CVE-2022-46882A use-after-free in WebGL extensions could have led to a potentially exploitable crash.
- CVE-2022-46881An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash.
- CVE-2022-46880A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*: This advisory was ad
- CVE-2022-46879Mozilla developers and community members Lukas Bernhard, Gabriele Svelto, Randell Jesup, and the Mozilla Fuzzing Team reported memory safety
- CVE-2022-46878Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbir
- CVE-2022-46877By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofi
- CVE-2022-46875The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a user's computer.
- CVE-2022-46874A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place.
- CVE-2022-46873Because Firefox did not implement the <code>unsafe-hashes</code> CSP directive, an attacker who was able to inject markup into a page otherw
- CVE-2022-46872An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC mes
- CVE-2022-46871An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited.
- CVE-2022-45421Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4.
- CVE-2022-45420Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting
- CVE-2022-45419If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certifi
- CVE-2022-45418If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in