Skip to contentMozilla Firefox vulnerabilities
- mozilla firefox, canonical ubuntu linux +1 moreDevelopment Tools panels of an extension are required to load URLs for the panels as relative...CVE-2018-5112Fix available7.5 High
- mozilla firefox, canonical ubuntu linux +1 moreWhen the text of a specially formatted URL is dragged to the addressbar from page content, the...CVE-2018-5111Fix available6.5 Medium
- mozilla firefox, canonical ubuntu linux +1 moreAn audio capture session can started under an incorrect origin from the site making the capture...CVE-2018-5109Fix available5.3 Medium
- mozilla firefox, canonical ubuntu linux +1 moreA Blob URL can violate origin attribute segregation, allowing it to be accessed from a private...CVE-2018-5108Fix available4.3 Medium
- mozilla firefox, canonical ubuntu linux +1 moreThe printing process can bypass local access protections to read files available through symlinks...CVE-2018-5107Fix available5.3 Medium
- mozilla firefox, canonical ubuntu linux +1 moreStyle editor traffic in the Developer Tools can be routed through a service worker hosted on a...CVE-2018-5106Fix available5.3 Medium
- mozilla firefox, canonical ubuntu linux +1 moreWebExtensions can bypass user prompts to first save and then open an arbitrarily downloaded file....CVE-2018-5105Fix available7.8 High
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreA use-after-free vulnerability can occur during font face manipulation when a font face is freed...CVE-2018-5104Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreA use-after-free vulnerability can occur during mouse event handling due to issues with...CVE-2018-5103Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreA use-after-free vulnerability can occur when manipulating HTML media elements with media streams...CVE-2018-5102Fix available9.8 Critical
- mozilla firefox, canonical ubuntu linux +1 moreA use-after-free vulnerability can occur when manipulating floating "first-letter" style elements...CVE-2018-5101Fix available7.5 High
- mozilla firefox, canonical ubuntu linux +1 moreA use-after-free vulnerability can occur when arguments passed to the "IsPotentiallyScrollable"...CVE-2018-5100Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreA use-after-free vulnerability can occur when the widget listener is holding strong references to...CVE-2018-5099Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreA use-after-free vulnerability can occur when form input elements, focus, and selections are...CVE-2018-5098Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreA use-after-free vulnerability can occur during XSL transformations when the source document for...CVE-2018-5097Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreAn integer overflow vulnerability in the Skia library when allocating memory for edge builders on...CVE-2018-5095Fix available9.8 Critical
- mozilla firefox, canonical ubuntu linux +1 moreA heap buffer overflow vulnerability may occur in WebAssembly when "shrinkElements" is called...CVE-2018-5094Fix availableEPSS 15.0%7.5 High
- mozilla firefox, canonical ubuntu linux +1 moreA heap buffer overflow vulnerability may occur in WebAssembly during Memory/Table resizing,...CVE-2018-5093Fix availableEPSS 19.4%7.5 High
- mozilla firefox, canonical ubuntu linux +1 moreA use-after-free vulnerability can occur when the thread for a Web Worker is freed from memory...CVE-2018-5092Fix available9.8 Critical
- mozilla firefox, firefox esr, canonical ubuntu linux +7 more +9 moreA use-after-free vulnerability can occur during WebRTC connections when interacting with the DTMF...CVE-2018-5091Fix available9.8 Critical
- mozilla firefox, canonical ubuntu linux +1 moreMemory safety bugs were reported in Firefox 57. Some of these bugs showed evidence of memory...CVE-2018-5090Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +5 more +7 moreMemory safety bugs were reported in Firefox 57 and Firefox ESR 52.5. Some of these bugs showed...CVE-2018-5089Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreA buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the ANGLE...CVE-2017-78458.8 High
- mozilla firefox, firefox esr +1 moreThe Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary...CVE-2017-77675.5 Medium
- mozilla firefox, firefox esr +1 moreAn attack using manipulation of "updater.ini" contents, used by the Mozilla Windows Updater, and...CVE-2017-77667.8 High
- mozilla firefox, firefox esr +1 moreThe Mozilla Windows updater modifies some files to be updated by reading the original file and...CVE-2017-77607.8 High
- mozilla firefox, thunderbird +1 moreThe Gecko Media Plugin sandbox allows access to local files that match specific regular...CVE-2017-54257.5 High
- mozilla firefox, thunderbird +1 moreA use-after-free can occur during buffer storage operations within the ANGLE graphics library,...CVE-2017-54117.5 High
- mozilla firefox, firefox esr, debian linux +5 more +7 moreWhen Private Browsing mode is used, it is possible for a web worker to write persistent data to...CVE-2017-7843Fix available7.5 High
- mozilla firefoxIf a document's Referrer Policy attribute is set to "no-referrer" sometimes two network requests...CVE-2017-7842Fix available5.3 Medium
- mozilla firefoxJavaScript can be injected into an exported bookmarks file by placing JavaScript code into user...CVE-2017-7840Fix available6.1 Medium
- mozilla firefoxControl characters prepended before "javascript:" URLs pasted in the addressbar can cause the...CVE-2017-7839Fix available6.1 Medium
- mozilla firefoxPunycode format text will be displayed for entire qualified international domain names in some...CVE-2017-7838Fix available5.3 Medium
- mozilla firefoxSVG loaded through "<img>" tags can use "<meta>" tags within the SVG data to set cookies for that...CVE-2017-7837Fix available5.3 Medium
- mozilla firefoxMixed content blocking of insecure (HTTP) sub-resources in a secure (HTTPS) document was not...CVE-2017-7835Fix available7.3 High
- mozilla firefoxA "data:" URL loaded in a new tab did not inherit the Content Security Policy (CSP) of the...CVE-2017-7834Fix available6.1 Medium
- mozilla firefoxSome Arabic and Indic vowel marker characters can be combined with Latin characters in a domain...CVE-2017-7833Fix available5.3 Medium
- mozilla firefoxThe combined, single character, version of the letter 'i' with any of the potential accents in...CVE-2017-7832Fix available5.3 Medium
- mozilla firefoxA vulnerability where the security wrapper does not deny access to some exposed properties using...CVE-2017-7831Fix available5.3 Medium
- mozilla firefox, firefox esr, thunderbird +6 more +8 moreThe Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same...CVE-2017-7830Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +6 more +8 moreA use-after-free vulnerability can occur when flushing and resizing layout because the ...CVE-2017-7828Fix available9.8 Critical
- mozilla firefoxMemory safety bugs were reported in Firefox 56. Some of these bugs showed evidence of memory...CVE-2017-7827Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreMemory safety bugs were reported in Firefox 56 and Firefox ESR 52.4. Some of these bugs showed...CVE-2017-7826Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreSeveral fonts on OS X display some Tibetan and Arabic characters as whitespace. When used in the...CVE-2017-78255.3 Medium
- mozilla firefoxThe AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length...CVE-2017-7822Fix available5.3 Medium
- mozilla firefoxA vulnerability where WebExtensions can download and attempt to open a file of some non...CVE-2017-7821Fix available9.8 Critical
- mozilla firefoxThe "instanceof" operator can bypass the Xray wrapper mechanism. When called on web content from...CVE-2017-7820Fix available5.3 Medium
- mozilla firefoxWebExtensions could use popups and panels in the extension UI to load an "about:" privileged URL,...CVE-2017-7816Fix available5.3 Medium
- mozilla firefoxOn pages containing an iframe, the "data:" protocol can be used to create a modal dialog through...CVE-2017-7815Fix available5.3 Medium
- mozilla firefoxInside the JavaScript parser, a cast of an integer to a narrower type can result in data read...CVE-2017-7813Fix available8.2 High
- Show moreLoading…