Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2018-12381Manually dragging and dropping an Outlook email message into the browser will trigger a page navigation when the message's mail columns are
- CVE-2018-12379When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading
- CVE-2018-12378A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload
- CVE-2018-12377A use-after-free vulnerability can occur when refresh driver timers are refreshed in some circumstances during shutdown when the timer is de
- CVE-2018-12376Memory safety bugs present in Firefox 61 and Firefox ESR 60.1.
- CVE-2018-12375Memory safety bugs present in Firefox 61.
- CVE-2018-12374Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field.
- CVE-2018-12373dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward.
- CVE-2018-12372Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when included in a a HTML reply/forward.
- CVE-2018-12370In Reader View SameSite cookie protections are not checked on exiting.
- CVE-2018-12369WebExtensions bundled with embedded experiments were not correctly checked for proper authorization.
- CVE-2018-12368Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from
- CVE-2018-12367In the previous mitigations for Spectre, the resolution or precision of various methods was reduced to counteract the ability to measure pre
- CVE-2018-12366An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value.
- CVE-2018-12365A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent
- CVE-2018-12364NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 r
- CVE-2018-12363A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document
- CVE-2018-12362An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in a
- CVE-2018-12361An integer overflow can occur in the SwizzleData code while calculating buffer sizes.
- CVE-2018-12360A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by focusing that element.
- CVE-2018-12359A buffer overflow can occur when rendering canvas content while adjusting the height and width of the canvas element dynamically, causing da
- CVE-2018-12358Service workers can use redirection to avoid the tainting of cross-origin resources in some instances, allowing a malicious site to read res
- CVE-2016-9069A use-after-free in nsINode::ReplaceOrInsertBefore during DOM operations resulting in potentially exploitable crashes.
- CVE-2016-8635It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack.
- CVE-2018-5185Plaintext of decrypted emails can leak through by user submitting an embedded form.
- CVE-2018-5184Using remote content in encrypted messages can lead to the disclosure of plaintext.
- CVE-2018-5183Mozilla developers backported selected changes in the Skia library.
- CVE-2018-5182If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specif
- CVE-2018-5181If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child process the tab will open a
- CVE-2018-5180A use-after-free vulnerability can occur during WebGL operations.