Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2020-6806By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script exec
- CVE-2020-6807When a device was changed while a stream was about to be destroyed, the <code>stream-reinit</code> task may have been executed after the str
- CVE-2020-6808When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML document, which is then
- CVE-2020-6809When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was possible for the Web Exte
- CVE-2020-6810After a website had entered fullscreen mode, it could have used a previously opened popup to obscure the notification that indicates the bro
- CVE-2020-6811The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the web
- CVE-2020-6812The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g.
- CVE-2020-6813When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker
- CVE-2020-6814Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5.
- CVE-2020-6815Mozilla developers reported memory safety and script safety bugs present in Firefox 73.
- CVE-2020-6801Mozilla developers reported memory safety bugs present in Firefox 72.
- CVE-2020-6800Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4.
- CVE-2020-6799Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types.
- CVE-2020-6798If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be al
- CVE-2020-6797By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer.
- CVE-2020-6796A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write.
- CVE-2020-6795When processing a message that contains multiple S/MIME signatures, a bug in the MIME processing code caused a null pointer dereference, lea
- CVE-2020-6794If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still access
- CVE-2020-6793When processing an email message with an ill-formed envelope, Thunderbird could read data from a random memory location.
- CVE-2020-6792When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents.
- CVE-2019-17026Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion.
- CVE-2020-6804XSS in Mozilla WebThings Gateway
- CVE-2020-6803Open redirect in Mozilla WebThings Gateway
- CVE-2013-4227Cross-site request forgery (CSRF) vulnerability in the persona_xsrf_token function in persona.module in the Mozilla Persona module 7.x-1.x b
- CVE-2013-5594Mozilla Firefox before 25 allows modification of anonymous content of pluginProblem.xml binding
- CVE-2011-2669Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates.
- CVE-2011-2668Mozilla Firefox through 1.5.0.3 has a vulnerability in processing the content-length header
- CVE-2011-2670Mozilla Firefox before 3.6 is vulnerable to XSS via the rendering of Cascading Style Sheets
- CVE-2019-17001A Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in the protected document
- CVE-2019-9812Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.fir