Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2022-38476A data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-after-free vulnerability.
- CVE-2022-38475An attacker could have written a value to the first element in a zero-length JavaScript array.
- CVE-2022-38474A website that had permission to access the microphone could record audio without the audio notification being shown.
- CVE-2022-38473A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access).
- CVE-2022-38472An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the ad
- CVE-2022-36320Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102.
- CVE-2022-36319When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed.
- CVE-2022-36318When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected.
- CVE-2022-36317When visiting a website with an overly long URL, the user interface would start to hang.
- CVE-2022-36316When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus learn whether the targ
- CVE-2022-36315When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entrie
- CVE-2022-36314When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requ
- CVE-2022-34485Mozilla developers Bryce Seager van Dyk and the Mozilla Fuzzing Team reported potential vulnerabilities present in Firefox 101.
- CVE-2022-34484The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10.
- CVE-2022-34483An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to conta
- CVE-2022-34482An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to conta
- CVE-2022-34481In the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred when the number of elements to repl
- CVE-2022-34480Within the <code>lg_init()</code> function, if several allocations succeed but then one fails, an uninitialized pointer would have been free
- CVE-2022-34479A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in pot
- CVE-2022-34478The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft applications, bypassing the
- CVE-2022-34477The MediaError message property should be consistent to avoid leaking information about cross-origin resources; however for a same-site cros
- CVE-2022-34476ASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the parser accepting malformed ASN.1.
- CVE-2022-34475SVG <code><use></code> tags that referenced a same-origin document could have resulted in script execution if attacker input was sanit
- CVE-2022-34474Even when an iframe was sandboxed with <code>allow-top-navigation-by-user-activation</code>, if it received a redirect header to an external
- CVE-2022-34473The HTML Sanitizer should have sanitized the <code>href</code> attribute of SVG <code><use></code> tags; however it incorrectly did no
- CVE-2022-34472If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrec
- CVE-2022-34471When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manif
- CVE-2022-34470Session history navigations may have led to a use-after-free and potentially exploitable crash.
- CVE-2022-34469When a TLS Certificate error occurs on a domain protected by the HSTS header, the browser should not allow the user to bypass the certificat
- CVE-2022-34468An iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link.