Skip to contentMozilla Firefox vulnerabilities
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreA vulnerability can occur when capturing a media stream when the media source type is changed as...CVE-2018-5156Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreAn integer overflow vulnerability in the Skia library when allocating memory for edge builders on...CVE-2018-12371Fix available8.8 High
- mozilla firefox, canonical ubuntu linux +1 moreIn Reader View SameSite cookie protections are not checked on exiting. This allows for a payload...CVE-2018-12370Fix available8.8 High
- mozilla firefox, firefox esr, canonical ubuntu linux +2 moreWebExtensions bundled with embedded experiments were not correctly checked for proper...CVE-2018-12369Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreIn the previous mitigations for Spectre, the resolution or precision of various methods was...CVE-2018-12367Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreAn invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds...CVE-2018-12366Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreA compromised IPC child process can escape the content sandbox and list the names of arbitrary...CVE-2018-12365Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreNPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by...CVE-2018-12364Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreA use-after-free vulnerability can occur when script uses mutation events to move DOM nodes...CVE-2018-12363Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreAn integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD...CVE-2018-12362Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreAn integer overflow can occur in the SwizzleData code while calculating buffer sizes. The...CVE-2018-12361Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreA use-after-free vulnerability can occur when deleting an input element during a mutation event...CVE-2018-12360Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreA buffer overflow can occur when rendering canvas content while adjusting the height and width of...CVE-2018-12359Fix available8.8 High
- mozilla firefox, canonical ubuntu linux +1 moreService workers can use redirection to avoid the tainting of cross-origin resources in some...CVE-2018-12358Fix available4.3 Medium
- mozilla firefoxIn 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected...CVE-2018-51655.3 Medium
- mozilla firefoxA spoofing vulnerability can occur when a malicious site with an extremely long domain name is...CVE-2018-51385.3 Medium
- mozilla firefoxLow descenders on some Tibetan characters in several fonts on OS X are clipped when rendered in...CVE-2018-51215.3 Medium
- mozilla firefoxIf cursor visibility is toggled by script using from 'none' to an image and back through script,...CVE-2018-51105.3 Medium
- mozilla firefoxA combination of an external SVG image referenced on a page and the coloring of anchor links...CVE-2017-7844Fix available6.5 Medium
- mozilla firefoxThe "pingsender" executable used by the Firefox Health Report dynamically loads a system copy of...CVE-2017-78367.8 High
- mozilla firefoxA spoofing vulnerability can occur when a page switches to fullscreen mode without user...CVE-2017-78175.3 Medium
- mozilla firefoxOn Windows systems, the logger run by the Windows updater deletes the file "update.log" before it...CVE-2017-77964.7 Medium
- mozilla firefoxOn Windows systems, if non-null-terminated strings are copied into the crash reporter for some...CVE-2017-77907.5 High
- mozilla firefoxA mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then...CVE-2017-77705.9 Medium
- google android, mozilla firefox +1 moreAndroid intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs...CVE-2017-77597.5 High
- mozilla firefoxAndroid intents can be used to launch Firefox for Android in reader mode with a user specified...CVE-2017-54635.3 Medium
- mozilla firefoxMalicious sites can display a spoofed addressbar on a page when the existing location bar on the...CVE-2017-54524.3 Medium
- mozilla firefoxA mechanism to spoof the Firefox for Android addressbar using a "javascript:" URI. On Firefox for...CVE-2017-54507.5 High
- mozilla firefoxThe cache directory on the local file system is set to be world writable. Firefox defaults to...CVE-2017-53979.8 Critical
- mozilla firefoxMalicious sites can display a spoofed location bar on a subsequently loaded page when the...CVE-2017-53954.3 Medium
- mozilla firefoxA location bar spoofing attack where the location bar of loaded page will be shown over the...CVE-2017-53948.8 High
- mozilla firefoxWeak proxy objects have weak references on multiple threads when they should only have them on...CVE-2017-53929.8 Critical
- mozilla firefoxWhen a new Firefox profile is created on 64-bit Windows installations, the sandbox for 64-bit...CVE-2016-90727.5 High
- mozilla firefoxThe location bar in Firefox for Android can be spoofed by forcing a user into fullscreen mode,...CVE-2016-90657.5 High
- mozilla firefoxPrivate browsing mode leaves metadata information, such as URLs, for sites visited in "browser.db...CVE-2016-90623.3 Low
- mozilla firefoxA previously installed malicious Android application which defines a specific signature-level...CVE-2016-90617.5 High
- mozilla firefoxA previously installed malicious Android application with same signature-level permissions as...CVE-2016-52997.5 High
- mozilla firefoxA mechanism where disruption of the loading of a new web page can cause the previous page's...CVE-2016-52986.5 Medium
- mozilla firefoxThis vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate...CVE-2016-52957.8 High
- mozilla firefox, firefox esr, debian linux +2 moreWhen the Mozilla Updater is run, if the Updater's log file in the working directory points to a...CVE-2016-52935.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIn the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the "SEE_MASK_FLAG_NO_UI...CVE-2018-51747.5 High
- mozilla firefox, canonical ubuntu linux +1 moreIf a text string that happens to be a filename in the operating system's native format is dragged...CVE-2018-5182Fix available7.5 High
- mozilla firefox, canonical ubuntu linux +1 moreIf a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a...CVE-2018-5181Fix available7.5 High
- mozilla firefox, canonical ubuntu linux +1 moreA use-after-free vulnerability can occur during WebGL operations. While this results in a...CVE-2018-5180Fix available7.5 High
- mozilla firefox, canonical ubuntu linux +1 moreA vulnerability exists in XSLT during number formatting where a negative buffer size may be...CVE-2018-5177Fix available7.5 High
- mozilla firefox, canonical ubuntu linux +1 moreThe JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including ...CVE-2018-5176Fix available6.1 Medium
- mozilla firefox, canonical ubuntu linux +1 moreA mechanism to bypass Content Security Policy (CSP) protections on sites that have a "script-src"...CVE-2018-5175Fix available6.1 Medium
- mozilla firefox, canonical ubuntu linux +1 moreThe filename appearing in the "Downloads" panel improperly renders some Unicode characters,...CVE-2018-5173Fix available5.3 Medium
- mozilla firefox, canonical ubuntu linux +1 moreThe Live Bookmarks page and the PDF viewer can run injected script content if a user pastes...CVE-2018-5172Fix available4.3 Medium
- mozilla firefox, canonical ubuntu linux +1 moreIf manipulated hyperlinked text with "chrome:" URL contained in it is dragged and dropped on the ...CVE-2018-5169Fix available6.5 Medium
- Show moreLoading…