Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2017-5429Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52.
- CVE-2017-5428An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest.
- CVE-2017-5427A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory.
- CVE-2017-5426On Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media Plugin sandbox is started, the sandbox fails
- CVE-2017-5425The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions.
- CVE-2017-5422If a malicious site uses the "view-source:" protocol in a series within a single hyperlink, it can trigger a non-exploitable browser crash w
- CVE-2017-5421A malicious site could spoof the contents of the print preview window if popup windows are enabled, resulting in user confusion of what site
- CVE-2017-5420A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an a
- CVE-2017-5419If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-responsive, requiring shutd
- CVE-2017-5418An out of bounds read error occurs when parsing some HTTP digest authorization responses, resulting in information leakage through the readi
- CVE-2017-5417When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the addressbar so that t
- CVE-2017-5416In certain circumstances a networking event listener can be prematurely released.
- CVE-2017-5415An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leading to user confusion
- CVE-2017-5414The file picker dialog can choose and display the wrong local default directory when instantiated.
- CVE-2017-5413A segmentation fault can occur during some bidirectional layout operations.
- CVE-2017-5412A buffer overflow read during SVG filter color value operations, resulting in data exposure.
- CVE-2017-5411A use-after-free can occur during buffer storage operations within the ANGLE graphics library, used for WebGL content.
- CVE-2017-5410Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweepin
- CVE-2017-5409The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callba
- CVE-2017-5408Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading t
- CVE-2017-5407Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a ta
- CVE-2017-5406A segmentation fault can occur in the Skia graphics library during some canvas operations due to issues with mask/clip intersection and empt
- CVE-2017-5405Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations.
- CVE-2017-5404A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of
- CVE-2017-5403When adding a range to an object in the DOM, it is possible to use "addRange" to add the range to an incorrect root object.
- CVE-2017-5402A use-after-free can occur when events are fired for a "FontFace" object after the object has been already been destroyed while working with
- CVE-2017-5401A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error.
- CVE-2017-5400JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption
- CVE-2017-5399Memory safety bugs were reported in Firefox 51.
- CVE-2017-5398Memory safety bugs were reported in Thunderbird 45.7.