Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2017-7810Memory safety bugs were reported in Firefox 55 and Firefox ESR 52.3.
- CVE-2017-7808A content security policy (CSP) "frame-ancestors" directive containing origins with paths allows for comparisons against those paths instead
- CVE-2017-7807A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the domain.
- CVE-2017-7806A use-after-free vulnerability can occur when the layer manager is freed too early when rendering specific SVG content, resulting in a poten
- CVE-2017-7805During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer.
- CVE-2017-7804The destructor function for the "WindowsDllDetourPatcher" class can be re-purposed by malicious code in concert with another vulnerability t
- CVE-2017-7803When a page's content security policy (CSP) header contains a "sandbox" directive, other directives are ignored.
- CVE-2017-7802A use-after-free vulnerability can occur when manipulating the DOM during the resize event of an image element.
- CVE-2017-7801A use-after-free vulnerability can occur while re-computing layout for a "marquee" element during window resizing where the updated style ob
- CVE-2017-7800A use-after-free vulnerability can occur in WebSockets when the object holding the connection is freed before the disconnection operation is
- CVE-2017-7799JavaScript in the "about:webrtc" page is not sanitized properly being assigned to "innerHTML".
- CVE-2017-7798The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page source code.
- CVE-2017-7797Response header name interning does not have same-origin protections and these headers are stored in a global registry.
- CVE-2017-7796On Windows systems, the logger run by the Windows updater deletes the file "update.log" before it runs in order to write a new log of that n
- CVE-2017-7794On Linux systems, if the content process is compromised, the sandbox broker will allow files to be truncated even though the sandbox explici
- CVE-2017-7793A use-after-free vulnerability can occur in the Fetch API when the worker or the associated window are freed when still in use, resulting in
- CVE-2017-7792A buffer overflow will occur when viewing a certificate in the certificate manager if the certificate has an extremely long object identifie
- CVE-2017-7791On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary domains following pa
- CVE-2017-7790On Windows systems, if non-null-terminated strings are copied into the crash reporter for some specific registry keys, stack memory data can
- CVE-2017-7789If a server sends two Strict-Transport-Security (STS) headers for a single connection, they will be rejected as invalid and HTTP Strict Tran
- CVE-2017-7788When an "iframe" has a "sandbox" attribute and its content is specified using "srcdoc", that content does not inherit the containing page's
- CVE-2017-7787Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on
- CVE-2017-7786A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements.
- CVE-2017-7785A buffer overflow can occur when manipulating Accessible Rich Internet Applications (ARIA) attributes within the DOM.
- CVE-2017-7783If a long user name is used in a username/password combination in a site URL (such as " http://UserName:Password@example.com"), the resultin
- CVE-2017-7782An error in the "WindowsDllDetourPatcher" where a RWX ("Read/Write/Execute") 4k block is allocated but never protected, violating DEP protec
- CVE-2017-7781An error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can yield a result "POIN
- CVE-2017-7780Memory safety bugs were reported in Firefox 54.
- CVE-2017-7779Memory safety bugs were reported in Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2.
- CVE-2017-7778A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use