Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2019-11756Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service).
- CVE-2019-11745When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds wr
- CVE-2013-1689Mozilla Firefox 20.0a1 and earlier allows remote attackers to cause a denial of service (crash), related to event handling with frames.
- CVE-2016-5285A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ss
- CVE-2019-11754When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given.
- CVE-2019-11733When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog.
- CVE-2019-11734Mozilla developers and community members reported memory safety bugs present in Firefox 68.
- CVE-2019-11735Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68.
- CVE-2019-11736The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the rep
- CVE-2019-11737If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive wil
- CVE-2019-11738If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any
- CVE-2019-11739Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward.
- CVE-2019-11740Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8.
- CVE-2019-11741A compromised sandboxed content process can perform a Universal Cross-site Scripting (UXSS) attack on content from any site it can cause to
- CVE-2019-11742A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a <canvas> el
- CVE-2019-11743Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload even
- CVE-2019-11744Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup.
- CVE-2019-11746A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use.
- CVE-2019-11747The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a site.
- CVE-2019-11748WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party c
- CVE-2019-11749A vulnerability exists in WebRTC where malicious web content can use probing techniques on the getUserMedia API using constraints to reveal
- CVE-2019-11750A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash.
- CVE-2019-11751Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks o
- CVE-2019-11752It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion.
- CVE-2019-11753The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivi
- CVE-2019-11755A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature
- CVE-2019-9800Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6.
- CVE-2019-9811As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a br
- CVE-2019-9814Mozilla developers and community members reported memory safety bugs present in Firefox 66.
- CVE-2019-9815If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks.