Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2019-9816A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypas
- CVE-2019-9817Images from a different domain can be read using a canvas object in some circumstances.
- CVE-2019-9818A race condition is present in the crash generation server used to generate data for the crash reporter.
- CVE-2019-9819A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable c
- CVE-2019-9820A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use.
- CVE-2019-9821A use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with shared workers.
- CVE-2019-11691A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called a
- CVE-2019-11692A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a poten
- CVE-2019-11693The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux.
- CVE-2019-11694A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a
- CVE-2019-11695A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allo
- CVE-2019-11696Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for download prompts even though
- CVE-2019-11697If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install
- CVE-2019-11698If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped
- CVE-2019-11699A malicious page can briefly cause the wrong name to be highlighted as the domain name in the addressbar during page navigations.
- CVE-2019-11700A hyperlink using the res: protocol can be used to open local files at a known location in Internet Explorer if a user approves execution wh
- CVE-2019-11701The default webcal: protocol handler will load a web site vulnerable to cross-site scripting (XSS) attacks.
- CVE-2019-11702A hyperlink using protocols associated with Internet Explorer, such as IE.HTTP:, can be used to open local files at a known location with In
- CVE-2019-11703A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages,
- CVE-2019-11704A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email
- CVE-2019-11705A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email mess
- CVE-2019-11706A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain emai
- CVE-2019-11707A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop.
- CVE-2019-11708Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxe
- CVE-2019-11709Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7.
- CVE-2019-11710Mozilla developers and community members reported memory safety bugs present in Firefox 67.
- CVE-2019-11711When an inner window is reused, it does not consider the use of document.domain for cross-origin protections.
- CVE-2019-11712POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements.
- CVE-2019-11713A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially expl
- CVE-2019-11714Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in some instances.