Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2017-7840JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved bookmarks.
- CVE-2017-7839Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the paste
- CVE-2017-7838Punycode format text will be displayed for entire qualified international domain names in some instances when a sub-domain triggers the puny
- CVE-2017-7837SVG loaded through "<img>" tags can use "<meta>" tags within the SVG data to set cookies for that page.
- CVE-2017-7836The "pingsender" executable used by the Firefox Health Report dynamically loads a system copy of libcurl, which an attacker could replace.
- CVE-2017-7835Mixed content blocking of insecure (HTTP) sub-resources in a secure (HTTPS) document was not correctly applied for resources that redirect f
- CVE-2017-7834A "data:" URL loaded in a new tab did not inherit the Content Security Policy (CSP) of the original page, allowing for bypasses of the polic
- CVE-2017-7833Some Arabic and Indic vowel marker characters can be combined with Latin characters in a domain name to eclipse the non-Latin character with
- CVE-2017-7832The combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute or grave, can be spoof
- CVE-2017-7831A vulnerability where the security wrapper does not deny access to some exposed properties using the deprecated "_exposedProps_" mechanism o
- CVE-2017-7830The Resource Timing API incorrectly revealed navigations in cross-origin iframes.
- CVE-2017-7829It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient.
- CVE-2017-7828A use-after-free vulnerability can occur when flushing and resizing layout because the "PressShell" object has been freed while still in use
- CVE-2017-7827Memory safety bugs were reported in Firefox 56.
- CVE-2017-7826Memory safety bugs were reported in Firefox 56 and Firefox ESR 52.4.
- CVE-2017-7825Several fonts on OS X display some Tibetan and Arabic characters as whitespace.
- CVE-2017-7824A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content.
- CVE-2017-7823The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to behave as if the "allow
- CVE-2017-7822The AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length of 1 according to the NIST Special Publicati
- CVE-2017-7821A vulnerability where WebExtensions can download and attempt to open a file of some non-executable file types.
- CVE-2017-7820The "instanceof" operator can bypass the Xray wrapper mechanism.
- CVE-2017-7819A use-after-free vulnerability can occur in design mode when image objects are resized if objects referenced during the resizing have been f
- CVE-2017-7818A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications (ARIA) elements within containers
- CVE-2017-7817A spoofing vulnerability can occur when a page switches to fullscreen mode without user notification, allowing a fake address bar to be disp
- CVE-2017-7816WebExtensions could use popups and panels in the extension UI to load an "about:" privileged URL, violating security checks that disallow th
- CVE-2017-7815On pages containing an iframe, the "data:" protocol can be used to create a modal dialog through Javascript that will have an arbitrary doma
- CVE-2017-7814File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection
- CVE-2017-7813Inside the JavaScript parser, a cast of an integer to a narrower type can result in data read from outside the buffer being parsed.
- CVE-2017-7812If web content on a page is dragged onto portions of the browser UI, such as the tab bar, links can be opened that otherwise would not be al
- CVE-2017-7811Memory safety bugs were reported in Firefox 55.