Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2017-7770A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar will not be rendere
- CVE-2017-7768The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by convinc
- CVE-2017-7767The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files with junk data using the Mozilla Windows
- CVE-2017-7766An attack using manipulation of "updater.ini" contents, used by the Mozilla Windows Updater, and privilege escalation through the Mozilla Ma
- CVE-2017-7765The "Mark of the Web" was not correctly saved on Windows when files with very long names were downloaded from the Internet.
- CVE-2017-7764Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of b
- CVE-2017-7763Default fonts on OS X display some Tibetan characters as whitespace.
- CVE-2017-7762When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar.
- CVE-2017-7761The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users.
- CVE-2017-7760The Mozilla Windows updater modifies some files to be updated by reading the original file and applying changes to it.
- CVE-2017-7759Android intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs to local "file:" URLs, allowing for the rea
- CVE-2017-7758An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use
- CVE-2017-7757A use-after-free vulnerability in IndexedDB when one of its objects is destroyed in memory while a method on it is still being executed.
- CVE-2017-7756A use-after-free and use-after-scope vulnerability when logging errors from headers for XML HTTP Requests (XHR).
- CVE-2017-7755The Firefox installer on Windows can be made to load malicious DLL files stored in the same directory as the installer when it is run.
- CVE-2017-7754An out-of-bounds read in WebGL with a maliciously crafted "ImageInfo" object during WebGL operations.
- CVE-2017-7753An out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, using cached style data.
- CVE-2017-7752A use-after-free vulnerability during specific user interactions with the input method editor (IME) in some languages due to how events are
- CVE-2017-7751A use-after-free vulnerability with content viewer listeners that results in a potentially exploitable crash.
- CVE-2017-7750A use-after-free vulnerability during video control operations when a "<track>" element holds a reference to an older window if that window
- CVE-2017-7749A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell.
- CVE-2017-5472A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS layout when attempting to use a node i
- CVE-2017-5471Memory safety bugs were reported in Firefox 53.
- CVE-2017-5470Memory safety bugs were reported in Firefox 53 and Firefox ESR 52.1.
- CVE-2017-5469Fixed potential buffer overflows in generated Firefox code due to CVE-2016-6354 issue in Flex.
- CVE-2017-5468An issue with incorrect ownership model of "privateBrowsing" information exposed through developer tools.
- CVE-2017-5467A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region.
- CVE-2017-5466If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will ru
- CVE-2017-5465An out-of-bounds read while processing SVG content in "ConvolvePixel".
- CVE-2017-5464During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading