Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2020-15650Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but
- CVE-2020-15649Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of
- CVE-2020-15648Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header.
- CVE-2020-15647A Content Provider in Firefox for Android allowed local files accessible by the browser to be read by a remote webpage, leading to sensitive
- CVE-2020-15662A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an
- CVE-2020-15661A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for th
- CVE-2020-15659Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0.
- CVE-2020-15658The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file end
- CVE-2020-15657Firefox could be made to load attacker-supplied DLL files from the installation directory.
- CVE-2020-15656JIT optimizations involving the Javascript arguments object could confuse later optimizations.
- CVE-2020-12414IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly
- CVE-2020-12407Mozilla Developer Nicolas Silva found that when using WebRender, Firefox would under certain conditions leak arbitrary GPU memory to the vis
- CVE-2020-12402During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly i
- CVE-2020-12399NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys.
- CVE-2020-12412By navigating a tab using the history API, an attacker could cause the address bar to display the incorrect domain (with the https:// scheme
- CVE-2020-12408When browsing a document hosted on an IP address, an attacker could insert certain characters to flip domain and path information in the add
- CVE-2020-12411Mozilla developers reported memory safety bugs present in Firefox 76.
- CVE-2020-12409When using certain blank characters in a URL, they where incorrectly rendered as spaces instead of an encoded URL.
- CVE-2020-12398If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue wit
- CVE-2020-12410Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8.
- CVE-2020-12405When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash.
- CVE-2020-12406Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash.
- CVE-2020-12404For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions.
- CVE-2020-12416A VideoStreamEncoder may have been freed in a race condition with VideoBroadcaster::AddOrUpdateSink, resulting in a use-after-free, memory c
- CVE-2020-12425Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have occurred, leading to potential info
- CVE-2020-12423When the Windows DLL "webauthn.dll" was missing from the Operating System, and a malicious one was placed in a folder in the user's %PATH%,
- CVE-2020-12422In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable to overflow, resulting in an out o
- CVE-2020-12421When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by
- CVE-2020-12420When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and
- CVE-2020-12419When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-fre