Archive
11 June 2018
Vulnerabilities first published on this day (UTC), newest first.
349 results · Feed
-
Unscored —
The "export" function in the Certificate Viewer can force local filesystem navigation when the "common name" in a certi…
-
Unscored —
Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-…
-
Unscored —
Use-after-free while manipulating XSL in XSLT documents. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 4…
-
Unscored —
A memory corruption vulnerability in Skia that can occur when using transforms to make gradients, resulting in a potent…
-
Unscored —
The "mozAddonManager" allows for the installation of extensions from the CDN for addons.mozilla.org, a publicly accessi…
-
Unscored —
Weak proxy objects have weak references on multiple threads when they should only have them on one, resulting in incorr…
-
Unscored —
Malicious sites can display a spoofed location bar on a subsequently loaded page when the existing location bar on the …
-
Unscored —
The existence of a specifically requested local file can be found due to the double firing of the "onerror" when the "s…
-
Unscored —
JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. …
-
Unscored —
A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching wh…
-
Unscored —
An issue with incorrect ownership model of "privateBrowsing" information exposed through developer tools. This can resu…
-
Unscored —
Memory safety bugs were reported in Firefox 51. Some of these bugs showed evidence of memory corruption and we presume …
-
Unscored —
A use-after-free vulnerability during XSLT processing due to the result handler being held by a freed handler during ha…
-
Unscored —
A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clippin…
-
Unscored —
A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files th…
-
Unscored —
The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions. On OS OX, this mat…
-
Unscored —
A mechanism to spoof the Firefox for Android addressbar using a "javascript:" URI. On Firefox for Android, the base dom…
-
Unscored —
A buffer overflow vulnerability while parsing "application/http-index-format" format content when the header contains i…
-
Unscored —
WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permission…
-
Unscored —
A use-after-free vulnerability during changes in style when manipulating DOM elements. This results in a potentially ex…
-
Unscored —
A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are d…
-
Unscored —
The file picker dialog can choose and display the wrong local default directory when instantiated. On some operating sy…
-
Unscored —
An out of bounds read error occurs when parsing some HTTP digest authorization responses, resulting in information leak…
-
Unscored —
A use-after-free vulnerability in frame selection triggered by a combination of malicious script content and key presse…
-
Unscored —
Special "about:" pages used by web content, such as RSS feeds, can load privileged "about:" pages in an iframe. If a co…
-
Unscored —
An out-of-bounds write in "ClearKeyDecryptor" while decrypting some Clearkey-encrypted media content. The "ClearKeyDecr…
-
Unscored —
A use-after-free can occur when events are fired for a "FontFace" object after the object has been already been destroy…
-
Unscored —
A buffer overflow read during SVG filter color value operations, resulting in data exposure. This vulnerability affects…
-
Unscored —
A use-after-free vulnerability in the Media Decoder when working with media files when some events are fired after the …
-
Unscored —
A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressb…
-
Unscored —
Fixed potential buffer overflows in generated Firefox code due to CVE-2016-6354 issue in Flex. This vulnerability affec…
-
Unscored —
The cache directory on the local file system is set to be world writable. Firefox defaults to extracting libraries from…
-
Unscored —
Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of these bug…
-
Unscored —
When adding a range to an object in the DOM, it is possible to use "addRange" to add the range to an incorrect root obj…
-
Unscored —
A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error. The res…
-
Unscored —
JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potent…
-
Unscored —
A use-after-free vulnerability during XSLT processing due to poor handling of template parameters. This results in a po…
-
Unscored —
If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-respon…
-
Unscored —
Memory safety bugs were reported in Firefox 53. Some of these bugs showed evidence of memory corruption and we presume …
-
Unscored —
An out-of-bounds read while processing SVG content in "ConvolvePixel". This results in a crash and also allows for othe…