Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2019-17025Mozilla developers reported memory safety bugs present in Firefox 71.
- CVE-2019-17024Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3.
- CVE-2019-17023After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in
- CVE-2019-17022When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters.
- CVE-2019-17021During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from
- CVE-2019-17020If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be
- CVE-2019-17019When Python was installed on Windows, a python file being served with the MIME type of text/plain could be executed by Python instead of bei
- CVE-2019-17018When in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to improve the accuracy of the keyboard.
- CVE-2019-17017Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash.
- CVE-2019-17016When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule.
- CVE-2019-17015During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially explo
- CVE-2019-17014If an image had not loaded correctly (such as when it is not actually an image), it could be dragged and dropped cross-domain, resulting in
- CVE-2019-17013Mozilla developers reported memory safety bugs present in Firefox 70.
- CVE-2019-17012Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2.
- CVE-2019-17011Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free
- CVE-2019-17010Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have c
- CVE-2019-17009When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to lo
- CVE-2019-17008When using nested workers, a use-after-free could occur during worker destruction.
- CVE-2019-17005The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the
- CVE-2019-17002If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was n
- CVE-2019-17000An object tag with a data URI did not correctly inherit the document's Content Security Policy.
- CVE-2019-11765A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown.
- CVE-2019-11764Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1.
- CVE-2019-11763Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities.
- CVE-2019-11762If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/
- CVE-2019-11761By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content.
- CVE-2019-11760A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling.
- CVE-2019-11759An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack.
- CVE-2019-11758Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed.
- CVE-2019-11757When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it.