Skip to contentMozilla vulnerabilities
Newest
- mozilla firefoxUse-after-free vulnerability in Web Animations when interacting with cycle collection found...CVE-2017-5379Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreHashed codes of JavaScript objects are shared between pages. This allows for pointer leaks...CVE-2017-5378Fix available7.5 High
- mozilla firefoxA memory corruption vulnerability in Skia that can occur when using transforms to make gradients,...CVE-2017-5377Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreUse-after-free while manipulating XSL in XSLT documents. This vulnerability affects Thunderbird <...CVE-2017-5376Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +4 more +6 moreJIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential...CVE-2017-5375Public exploitFix availableEPSS 34.1%9.8 Critical
- mozilla firefoxMemory safety bugs were reported in Firefox 50.1. Some of these bugs showed evidence of memory...CVE-2017-5374Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +4 more +6 moreMemory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed...CVE-2017-5373Fix available9.8 Critical
- libevent project libevent, debian linux, mozilla firefox +1 more +3 moreStack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent...CVE-2016-10196Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +4 more +6 moreA potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents...CVE-2016-9905Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +4 more +6 moreAn attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by...CVE-2016-9904Fix available7.5 High
- mozilla firefoxMozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an...CVE-2016-9903Fix available6.1 Medium
- mozilla firefox, firefox esr, redhat enterprise linux desktop +4 more +6 moreThe Pocket toolbar button, once activated, listens for events fired from it's own pages but does...CVE-2016-9902Fix available7.5 High
- mozilla firefox, firefox esr, redhat enterprise linux aus +4 more +6 moreHTML tags received from the Pocket server will be processed without sanitization and any...CVE-2016-9901Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreExternal resources that should be blocked when loaded by SVG images can bypass security...CVE-2016-9900Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreUse-after-free while manipulating DOM events and removing audio elements due to errors in the...CVE-2016-9899Public exploitFix availableEPSS 19.4%9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreUse-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the...CVE-2016-9898Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +3 more +5 moreMemory corruption resulting in a potentially exploitable crash during WebGL functions using a...CVE-2016-9897Fix available7.5 High
- mozilla firefoxUse-after-free while manipulating the "navigator" object within WebVR. Note: WebVR is not...CVE-2016-9896Fix available8.1 High
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreEvent handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP)...CVE-2016-9895Fix available6.1 Medium
- mozilla firefoxA buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation. Later...CVE-2016-9894Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreMemory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of...CVE-2016-9893Fix available9.8 Critical
- mozilla firefoxMemory safety bugs were reported in Firefox 50.0.2. Some of these bugs showed evidence of memory...CVE-2016-9080Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreThe Mozilla Updater can be made to choose an arbitrary target working directory for output files...CVE-2016-52945.5 Medium
- mozilla firefox, firefox esr, thunderbird +9 more +11 moreA use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this...CVE-2016-9079In KEVPublic exploitFix availableEPSS 87.4%7.5 High
- mozilla firefoxRedirection from an HTTP connection to a "data:" URL assigns the referring site's origin to the ...CVE-2016-9078Fix available8.8 High
- mozilla firefoxWebExtensions can bypass security checks to load privileged URLs and potentially escape the...CVE-2016-9073Fix available7.5 High
- mozilla firefoxCanvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin. The...CVE-2016-9077Fix available7.0 High
- mozilla firefoxAn issue where a "<select>" dropdown menu can be used to cover location bar content, resulting in...CVE-2016-9076Fix available5.9 Medium
- mozilla firefoxAn issue where WebExtensions can use the mozAddonManager API to elevate privilege due to...CVE-2016-9075Fix available9.8 Critical
- mozilla firefoxContent Security Policy combined with HTTP to HTTPS redirection can be used by malicious server...CVE-2016-9071Fix available5.3 Medium
- mozilla firefoxA maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged...CVE-2016-9070Fix available8.0 High
- mozilla firefoxA use-after-free in nsINode::ReplaceOrInsertBefore during DOM operations resulting in potentially...CVE-2016-9069Fix available7.8 High
- mozilla firefoxA use-after-free during web animations when working with timelines resulting in a potentially...CVE-2016-9068Fix available7.5 High
- mozilla firefoxTwo use-after-free errors during DOM operations resulting in potentially exploitable crashes....CVE-2016-9067Fix available6.5 Medium
- mozilla firefox, debian linux, python +2 moreAn integer overflow during the parsing of XML using the Expat library. This vulnerability affects...CVE-2016-9063Fix available9.8 Critical
- mozilla nss, network security services, redhat enterprise linux desktop +5 more +7 moreIt was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to...CVE-2016-8635Fix available5.3 Medium
- mozilla firefoxDuring URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This...CVE-2016-5292Fix available6.5 Medium
- mozilla firefoxMemory safety bugs were reported in Firefox 49. Some of these bugs showed evidence of memory...CVE-2016-5289Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreAn existing mitigation of timing side-channel attacks is insufficient in some circumstances. This...CVE-2016-9074Fix available5.9 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA buffer overflow resulting in a potentially exploitable crash due to memory allocation issues...CVE-2016-9066Public exploitFix availableEPSS 12.0%7.5 High
- mozilla firefox, firefox esr +1 moreAdd-on updates failed to verify that the add-on ID inside the signed package matched the ID of...CVE-2016-9064Fix available5.9 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreAn error in argument length checking in JavaScript, leading to potential integer overflows or...CVE-2016-5297Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization,...CVE-2016-5296Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA same-origin policy bypass with local shortcut files to load arbitrary local content from disk....CVE-2016-5291Fix available5.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMemory safety bugs were reported in Firefox 49 and Firefox ESR 45.4. Some of these bugs showed...CVE-2016-5290Fix available9.8 Critical
- mozilla network security services, avaya aura application enablement services, aura application server 5300 +25 more +27 moreNull pointer dereference vulnerability exists in K11_SignWithSymKey /...CVE-2016-5285Fix available7.5 High
- mozilla firefoxWeb content could access information in the HTTP cache if e10s is disabled. This can reveal some...CVE-2016-5288Fix available5.9 Medium
- mozilla firefoxA potentially exploitable use-after-free crash during actor destruction with service workers....CVE-2016-5287Fix available9.8 Critical
- mozilla firefoxMozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on...CVE-2016-5284Fix available7.4 High
- mozilla firefoxMozilla Firefox before 49.0 allows remote attackers to bypass the Same Origin Policy via a...CVE-2016-5283Fix available8.8 High
- Show moreLoading…