Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2020-15681When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could have overwritten anoth
- CVE-2020-15682When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in.
- CVE-2020-15683Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3.
- CVE-2020-15684Mozilla developers reported memory safety bugs present in Firefox 81.
- CVE-2019-17007In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service
- CVE-2019-17006In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks.
- CVE-2018-18508In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resul
- CVE-2020-15646If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange autodiscovery mechan
- CVE-2020-12401During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resultin
- CVE-2020-12400When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible tim
- CVE-2020-15663If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location wi
- CVE-2020-15664By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger
- CVE-2020-15665Firefox did not reset the address bar after the beforeunload dialog was shown if the user chose to remain on the page.
- CVE-2020-15666When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the M
- CVE-2020-15667When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap overflow, leading t
- CVE-2020-15668A lock was missing when accessing a data structure and importing certificate information into the trust database.
- CVE-2020-15669When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified.
- CVE-2020-15670Mozilla developers reported memory safety bugs present in Firefox for Android 79.
- CVE-2020-15671When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input
- CVE-2020-15673Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2.
- CVE-2020-15674Mozilla developers reported memory safety bugs present in Firefox 80.
- CVE-2020-15675When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash.
- CVE-2020-15676Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed a
- CVE-2020-15677By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to
- CVE-2020-15678When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free.
- CVE-2020-15655A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential disc
- CVE-2020-15654When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interf
- CVE-2020-15653An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links.
- CVE-2020-15652By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect.
- CVE-2020-15651A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI flow to change the fi