Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2018-5111When the text of a specially formatted URL is dragged to the addressbar from page content, the displayed URL can be spoofed to show a differ
- CVE-2018-5110If cursor visibility is toggled by script using from 'none' to an image and back through script, the cursor will be rendered temporarily inv
- CVE-2018-5109An audio capture session can started under an incorrect origin from the site making the capture request.
- CVE-2018-5108A Blob URL can violate origin attribute segregation, allowing it to be accessed from a private browsing tab and for data to be passed betwee
- CVE-2018-5107The printing process can bypass local access protections to read files available through symlinks, bypassing local file restrictions.
- CVE-2018-5106Style editor traffic in the Developer Tools can be routed through a service worker hosted on a third party website if a user selects error l
- CVE-2018-5105WebExtensions can bypass user prompts to first save and then open an arbitrarily downloaded file.
- CVE-2018-5104A use-after-free vulnerability can occur during font face manipulation when a font face is freed while still in use, resulting in a potentia
- CVE-2018-5103A use-after-free vulnerability can occur during mouse event handling due to issues with multiprocess support.
- CVE-2018-5102A use-after-free vulnerability can occur when manipulating HTML media elements with media streams, resulting in a potentially exploitable cr
- CVE-2018-5101A use-after-free vulnerability can occur when manipulating floating "first-letter" style elements, resulting in a potentially exploitable cr
- CVE-2018-5100A use-after-free vulnerability can occur when arguments passed to the "IsPotentiallyScrollable" function are freed while still in use by scr
- CVE-2018-5099A use-after-free vulnerability can occur when the widget listener is holding strong references to browser objects that have previously been
- CVE-2018-5098A use-after-free vulnerability can occur when form input elements, focus, and selections are manipulated by script content.
- CVE-2018-5097A use-after-free vulnerability can occur during XSL transformations when the source document for the transformation is manipulated by script
- CVE-2018-5096A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash.
- CVE-2018-5095An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 8 GB of RAM.
- CVE-2018-5094A heap buffer overflow vulnerability may occur in WebAssembly when "shrinkElements" is called followed by garbage collection on memory that
- CVE-2018-5093A heap buffer overflow vulnerability may occur in WebAssembly during Memory/Table resizing, resulting in a potentially exploitable crash.
- CVE-2018-5092A use-after-free vulnerability can occur when the thread for a Web Worker is freed from memory prematurely instead of from memory in the mai
- CVE-2018-5091A use-after-free vulnerability can occur during WebRTC connections when interacting with the DTMF timers.
- CVE-2018-5090Memory safety bugs were reported in Firefox 57.
- CVE-2018-5089Memory safety bugs were reported in Firefox 57 and Firefox ESR 52.5.
- CVE-2017-7848RSS fields can inject new lines into the created email structure, modifying the message body.
- CVE-2017-7847Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name.
- CVE-2017-7846It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g.
- CVE-2017-7845A buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library, used for WebGL content.
- CVE-2017-7844A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image can be used to determi
- CVE-2017-7843When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely.
- CVE-2017-7842If a document's Referrer Policy attribute is set to "no-referrer" sometimes two network requests are made for "<link>" elements instead of o