Skip to contentMozilla Firefox vulnerabilities
- google chrome, mozilla firefox, firefox esr +2 moreA use after free in ANGLE in Google Chrome prior to 57.0.2987.98 for Windows allowed a remote...CVE-2017-5031Fix available8.8 High
- mozilla firefoxA non-existent chrome.manifest file will attempt to be loaded during startup from the primary...CVE-2017-5427Fix available5.5 Medium
- mozilla firefox, thunderbird +1 moreOn Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media...CVE-2017-5426Fix available5.3 Medium
- mozilla firefox, thunderbird +1 moreIf a malicious site uses the "view-source:" protocol in a series within a single hyperlink, it...CVE-2017-5422Fix available7.5 High
- mozilla firefox, thunderbird +1 moreA malicious site could spoof the contents of the print preview window if popup windows are...CVE-2017-5421Fix available7.5 High
- mozilla firefoxA "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL...CVE-2017-5420Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreIf a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI...CVE-2017-5419Fix available7.5 High
- mozilla firefox, thunderbird +1 moreAn out of bounds read error occurs when parsing some HTTP digest authorization responses,...CVE-2017-5418Fix available5.3 Medium
- mozilla firefoxWhen dragging content from the primary browser pane to the addressbar on a malicious site, it is...CVE-2017-5417Fix available5.3 Medium
- mozilla firefox, thunderbird +1 moreIn certain circumstances a networking event listener can be prematurely released. This appears to...CVE-2017-5416Fix available7.5 High
- mozilla firefoxAn attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:"...CVE-2017-5415Public exploitFix availableEPSS 12.3%5.3 Medium
- mozilla firefox, thunderbird +1 moreThe file picker dialog can choose and display the wrong local default directory when instantiated...CVE-2017-5414Fix available5.5 Medium
- mozilla firefox, thunderbird +1 moreA segmentation fault can occur during some bidirectional layout operations. This vulnerability...CVE-2017-5413Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreA buffer overflow read during SVG filter color value operations, resulting in data exposure. This...CVE-2017-5412Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreMemory corruption resulting in a potentially exploitable crash during garbage collection of...CVE-2017-5410Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreVideo files loaded video captions cross-origin without checking for the presence of CORS headers...CVE-2017-5408Fix available5.3 Medium
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreUsing SVG filters that don't use the fixed point math implementation on a target iframe, a...CVE-2017-5407Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreA segmentation fault can occur in the Skia graphics library during some canvas operations due to...CVE-2017-5406Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreCertain response codes in FTP connections can result in the use of uninitialized values for ports...CVE-2017-5405Fix available5.3 Medium
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreA use-after-free error can occur when manipulating ranges in selections with one node inside a...CVE-2017-5404Public exploitFix availableEPSS 16.9%9.8 Critical
- mozilla firefox, thunderbird +1 moreWhen adding a range to an object in the DOM, it is possible to use "addRange" to add the range to...CVE-2017-5403Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreA use-after-free can occur when events are fired for a "FontFace" object after the object has...CVE-2017-5402Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreA crash triggerable by web content in which an "ErrorResult" references unassigned memory due to...CVE-2017-5401Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +6 more +8 moreJIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP...CVE-2017-5400Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreMemory safety bugs were reported in Firefox 51. Some of these bugs showed evidence of memory...CVE-2017-5399Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreMemory safety bugs were reported in Thunderbird 45.7. Some of these bugs showed evidence of...CVE-2017-5398Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreA use-after-free vulnerability in the Media Decoder when working with media files when some...CVE-2017-5396Fix available9.8 Critical
- mozilla firefoxThe "mozAddonManager" allows for the installation of extensions from the CDN for addons.mozilla...CVE-2017-5393Fix available6.1 Medium
- mozilla firefoxSpecial "about:" pages used by web content, such as RSS feeds, can load privileged "about:" pages...CVE-2017-5391Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreThe JSON viewer in the Developer Tools uses insecure methods to create a communication channel...CVE-2017-5390Fix available9.8 Critical
- mozilla firefoxWebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the...CVE-2017-5389Fix available6.1 Medium
- mozilla firefoxA STUN server in conjunction with a large number of "webkitRTCPeerConnection" objects can be used...CVE-2017-5388Fix available7.5 High
- mozilla firefoxThe existence of a specifically requested local file can be found due to the double firing of the...CVE-2017-5387Fix available3.3 Low
- mozilla firefox, firefox esr, debian linux +6 more +8 moreWebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions...CVE-2017-5386Fix available7.3 High
- mozilla firefoxData sent with in multipart channels, such as the multipart/x-mixed-replace MIME type, will...CVE-2017-5385Fix available7.5 High
- mozilla firefoxProxy Auto-Config (PAC) files can specify a JavaScript function called for all URL requests with...CVE-2017-5384Fix available5.9 Medium
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreURLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger...CVE-2017-5383Fix available5.3 Medium
- mozilla firefoxFeed preview for RSS feeds can be used to capture errors and exceptions generated by privileged...CVE-2017-5382Fix available7.5 High
- mozilla firefoxThe "export" function in the Certificate Viewer can force local filesystem navigation when the ...CVE-2017-5381Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreA potential use-after-free found through fuzzing during DOM manipulation of SVG content. This...CVE-2017-5380Fix available9.8 Critical
- mozilla firefoxUse-after-free vulnerability in Web Animations when interacting with cycle collection found...CVE-2017-5379Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreHashed codes of JavaScript objects are shared between pages. This allows for pointer leaks...CVE-2017-5378Fix available7.5 High
- mozilla firefoxA memory corruption vulnerability in Skia that can occur when using transforms to make gradients,...CVE-2017-5377Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreUse-after-free while manipulating XSL in XSLT documents. This vulnerability affects Thunderbird <...CVE-2017-5376Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +4 more +6 moreJIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential...CVE-2017-5375Public exploitFix availableEPSS 34.1%9.8 Critical
- mozilla firefoxMemory safety bugs were reported in Firefox 50.1. Some of these bugs showed evidence of memory...CVE-2017-5374Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +4 more +6 moreMemory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed...CVE-2017-5373Fix available9.8 Critical
- libevent project libevent, debian linux, mozilla firefox +1 more +3 moreStack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent...CVE-2016-10196Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +4 more +6 moreA potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents...CVE-2016-9905Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +4 more +6 moreAn attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by...CVE-2016-9904Fix available7.5 High
- Show moreLoading…