Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2016-9899Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption.
- CVE-2016-9898Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor.
- CVE-2016-9897Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within
- CVE-2016-9896Use-after-free while manipulating the "navigator" object within WebVR.
- CVE-2016-9895Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript.
- CVE-2016-9894A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation.
- CVE-2016-9893Memory safety bugs were reported in Thunderbird 45.5.
- CVE-2016-9080Memory safety bugs were reported in Firefox 50.0.2.
- CVE-2016-9079A use-after-free vulnerability in SVG Animation has been discovered.
- CVE-2016-9078Redirection from an HTTP connection to a "data:" URL assigns the referring site's origin to the "data:" URL in some circumstances.
- CVE-2016-9077Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin.
- CVE-2016-9076An issue where a "<select>" dropdown menu can be used to cover location bar content, resulting in potential spoofing attacks.
- CVE-2016-9075An issue where WebExtensions can use the mozAddonManager API to elevate privilege due to privileged pages being allowed in the permissions l
- CVE-2016-9074An existing mitigation of timing side-channel attacks is insufficient in some circumstances.
- CVE-2016-9073WebExtensions can bypass security checks to load privileged URLs and potentially escape the WebExtension sandbox.
- CVE-2016-9072When a new Firefox profile is created on 64-bit Windows installations, the sandbox for 64-bit NPAPI plugins is not enabled by default.
- CVE-2016-9071Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious server to verify whether a known site is within a u
- CVE-2016-9070A maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged chrome window and engage in limited JavaScrip
- CVE-2016-9068A use-after-free during web animations when working with timelines resulting in a potentially exploitable crash.
- CVE-2016-9067Two use-after-free errors during DOM operations resulting in potentially exploitable crashes.
- CVE-2016-9066A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amounts of incoming data.
- CVE-2016-9065The location bar in Firefox for Android can be spoofed by forcing a user into fullscreen mode, blocking its exiting, and creating of a fake
- CVE-2016-9064Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated.
- CVE-2016-9063An integer overflow during the parsing of XML using the Expat library.
- CVE-2016-9062Private browsing mode leaves metadata information, such as URLs, for sites visited in "browser.db" and "browser.db-wal" files within the Fir
- CVE-2016-9061A previously installed malicious Android application which defines a specific signature-level permissions used by Firefox can access API key
- CVE-2016-5299A previously installed malicious Android application with same signature-level permissions as Firefox can intercept AuthTokens meant for Fir
- CVE-2016-5298A mechanism where disruption of the loading of a new web page can cause the previous page's favicon and SSL indicator to not be reset when t
- CVE-2016-5297An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues.
- CVE-2016-5296A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash.