Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2017-5463Android intents can be used to launch Firefox for Android in reader mode with a user specified URL.
- CVE-2017-5462A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits
- CVE-2017-5460A use-after-free vulnerability in frame selection triggered by a combination of malicious script content and key presses by a user.
- CVE-2017-5459A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash.
- CVE-2017-5458When a "javascript:" URL is drag and dropped by a user into the addressbar, the URL will be processed and executed.
- CVE-2017-5456A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message.
- CVE-2017-5455The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege if combined with ano
- CVE-2017-5454A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in
- CVE-2017-5453A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's
- CVE-2017-5452Malicious sites can display a spoofed addressbar on a page when the existing location bar on the new page is scrolled out of view if an HTML
- CVE-2017-5451A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event.
- CVE-2017-5450A mechanism to spoof the Firefox for Android addressbar using a "javascript:" URI.
- CVE-2017-5449A possibly exploitable crash triggered during layout and manipulation of bidirectional unicode text in concert with CSS animations.
- CVE-2017-5448An out-of-bounds write in "ClearKeyDecryptor" while decrypting some Clearkey-encrypted media content.
- CVE-2017-5447An out-of-bounds read during the processing of glyph widths during text layout.
- CVE-2017-5446An out-of-bounds read when an HTTP/2 connection to a servers sends "DATA" frames with incorrect data content.
- CVE-2017-5445A vulnerability while parsing "application/http-index-format" format content where uninitialized values are used to create an array.
- CVE-2017-5444A buffer overflow vulnerability while parsing "application/http-index-format" format content when the header contains improperly formatted d
- CVE-2017-5443An out-of-bounds write vulnerability while decoding improperly formed BinHex format archives.
- CVE-2017-5442A use-after-free vulnerability during changes in style when manipulating DOM elements.
- CVE-2017-5441A use-after-free vulnerability when holding a selection during scroll events.
- CVE-2017-5440A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating contex
- CVE-2017-5439A use-after-free vulnerability during XSLT processing due to poor handling of template parameters.
- CVE-2017-5438A use-after-free vulnerability during XSLT processing due to the result handler being held by a freed handler during handling.
- CVE-2017-5436An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font.
- CVE-2017-5435A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions.
- CVE-2017-5434A use-after-free vulnerability occurs when redirecting focus handling which results in a potentially exploitable crash.
- CVE-2017-5433A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the anima
- CVE-2017-5432A use-after-free vulnerability occurs during certain text input selection resulting in a potentially exploitable crash.
- CVE-2017-5430Memory safety bugs were reported in Firefox 52, Firefox ESR 52, and Thunderbird 52.