Vendor
Mozilla
2,559 known vulnerabilities.
Products
750 results · Clear filters · Feed
-
High 8.8
Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2
Memory safety bugs present in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabili…
-
High 7.5
Browsing Context potentially not cleared when closing Private Window
When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This …
-
High 8.8
Buffer Overflow in WebGL glGetProgramiv
Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow could have occurred when allocating too much private shader memory on mac OS. *This bug only affects Firefox on macOS. Other operating systems are unaffected.* This v…
-
High 7.8
Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker t…
-
High 7.5
The return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have potentially lead to a null…
-
High 7.5
A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below vers…
-
High 8.8
An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 1…
-
High 8.8
Memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruptio…
-
High 8.8
Memory safety bugs present in Firefox 110. Some of these bugs showed evidence of memory corruption and we presume that …
-
High 8.8
If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a f…
-
High 8.8
While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have…
-
High 8.8
A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permis…
-
High 8.8
An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global o…
-
High 8.8
Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run att…
-
High 8.8
Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruptio…
-
High 8.8
Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption and we presume that …
-
High 8.8
Memory safety bugs fixed in Firefox 109
Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. T…
-
High 8.8
Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7
Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108 and Firefox ESR 102.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to…
-
High 8.8
Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensi…
-
High 8.8
An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior. This…
-
High 8.8
When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not c…
-
High 8.8
Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-fr…
-
High 8.8
Memory safety bugs present in Firefox 109. Some of these bugs showed evidence of memory corruption and we presume that …
-
High 8.8
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in …
-
High 8.8
Memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume…
-
High 8.8
Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially…
-
High 8.8
After downloading a Windows <code>.scf</code> script from the local filesystem, an attacker could supply a remote path …
-
High 8.1
After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote pat…
-
High 7.5
regular expression denial-of-service (ReDoS) in Bleach
bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': […
-
High 7.6
An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL…
-
High 8.8
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated w…
-
High 8.8
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the result…
-
High 8.8
In the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred when the numbe…
-
High 8.8
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the result…
-
High 8.8
The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of these bugs showed evi…
-
High 8.8
An iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link. Thi…
-
High 8.8
When a TLS Certificate error occurs on a domain protected by the HSTS header, the browser should not allow the user to …
-
High 8.8
Within the <code>lg_init()</code> function, if several allocations succeed but then one fails, an uninitialized pointer…
-
High 7.5
The MediaError message property should be consistent to avoid leaking information about cross-origin resources; however…
-
High 7.8
Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privile…