Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2021-29989Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12.
- CVE-2021-29990Mozilla developers and community members reported memory safety bugs present in Firefox 90.
- CVE-2021-29969If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion
- CVE-2021-29970A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash.
- CVE-2021-29971If a user had granted a permission to a webpage and saved that grant, any webpage running on the same host - irrespective of scheme or port
- CVE-2021-29972A use-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library.
- CVE-2021-29973Password autofill was enabled without user interaction on insecure websites on Firefox for Android.
- CVE-2021-29974When network partitioning was enabled, e.g.
- CVE-2021-29975Through a series of DOM manipulations, a message, over which the attacker had control of the text but not HTML or formatting, could be overl
- CVE-2021-29976Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird.
- CVE-2021-29977Mozilla developers reported memory safety bugs present in Firefox 89.
- CVE-2021-29978Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd party security audit.
- CVE-2021-29979Hubs Cloud allows users to download shared content, specifically HTML and JS, which could allow javascript execution in the Hub Cloud instan
- CVE-2021-23991If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's update
- CVE-2021-23992Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature.
- CVE-2021-23993An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent.
- CVE-2021-23994A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write.
- CVE-2021-23995When Responsive Design Mode was enabled, it used references to objects that were previously freed.
- CVE-2021-23996By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofing
- CVE-2021-23997Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache.
- CVE-2021-23998Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page.
- CVE-2021-23999If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional pri
- CVE-2021-24000A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they w
- CVE-2021-24001A compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructu
- CVE-2021-24002When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and
- CVE-2021-29944Lack of escaping allowed HTML injection when a webpage was viewed in Reader View.
- CVE-2021-29945The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash.
- CVE-2021-29946Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used
- CVE-2021-29947Mozilla developers and community members reported memory safety bugs present in Firefox 87.
- CVE-2021-29948Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local proces