Skip to contentMozilla vulnerabilities
Newest
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreA use-after-free vulnerability during XSLT processing due to the result handler being held by a...CVE-2017-5438Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreAn out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite...CVE-2017-5436Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreA use-after-free vulnerability occurs during transaction processing in the editor during design...CVE-2017-5435Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +4 more +6 moreA use-after-free vulnerability occurs when redirecting focus handling which results in a...CVE-2017-5434Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreA use-after-free vulnerability in SMIL animation functions occurs when pointers to animation...CVE-2017-5433Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreA use-after-free vulnerability occurs during certain text input selection resulting in a...CVE-2017-5432Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +3 more +5 moreMemory safety bugs were reported in Firefox 52, Firefox ESR 52, and Thunderbird 52. Some of these...CVE-2017-5430Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +4 more +6 moreMemory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird...CVE-2017-5429Fix available9.8 Critical
- mozilla firefox, firefox esr, redhat enterprise linux +5 more +7 moreAn integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest. The fix...CVE-2017-5428Fix available9.8 Critical
- mozilla firefox, firefox esr +1 moreThe Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local...CVE-2017-54095.5 Medium
- google chrome, mozilla firefox, firefox esr +2 moreA use after free in ANGLE in Google Chrome prior to 57.0.2987.98 for Windows allowed a remote...CVE-2017-5031Fix available8.8 High
- mozilla firefoxA non-existent chrome.manifest file will attempt to be loaded during startup from the primary...CVE-2017-5427Fix available5.5 Medium
- mozilla firefox, thunderbird +1 moreOn Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media...CVE-2017-5426Fix available5.3 Medium
- mozilla firefox, thunderbird +1 moreIf a malicious site uses the "view-source:" protocol in a series within a single hyperlink, it...CVE-2017-5422Fix available7.5 High
- mozilla firefox, thunderbird +1 moreA malicious site could spoof the contents of the print preview window if popup windows are...CVE-2017-5421Fix available7.5 High
- mozilla firefoxA "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL...CVE-2017-5420Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreIf a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI...CVE-2017-5419Fix available7.5 High
- mozilla firefox, thunderbird +1 moreAn out of bounds read error occurs when parsing some HTTP digest authorization responses,...CVE-2017-5418Fix available5.3 Medium
- mozilla firefoxWhen dragging content from the primary browser pane to the addressbar on a malicious site, it is...CVE-2017-5417Fix available5.3 Medium
- mozilla firefox, thunderbird +1 moreIn certain circumstances a networking event listener can be prematurely released. This appears to...CVE-2017-5416Fix available7.5 High
- mozilla firefoxAn attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:"...CVE-2017-5415Public exploitFix availableEPSS 12.3%5.3 Medium
- mozilla firefox, thunderbird +1 moreThe file picker dialog can choose and display the wrong local default directory when instantiated...CVE-2017-5414Fix available5.5 Medium
- mozilla firefox, thunderbird +1 moreA segmentation fault can occur during some bidirectional layout operations. This vulnerability...CVE-2017-5413Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreA buffer overflow read during SVG filter color value operations, resulting in data exposure. This...CVE-2017-5412Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreMemory corruption resulting in a potentially exploitable crash during garbage collection of...CVE-2017-5410Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreVideo files loaded video captions cross-origin without checking for the presence of CORS headers...CVE-2017-5408Fix available5.3 Medium
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreUsing SVG filters that don't use the fixed point math implementation on a target iframe, a...CVE-2017-5407Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreA segmentation fault can occur in the Skia graphics library during some canvas operations due to...CVE-2017-5406Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreCertain response codes in FTP connections can result in the use of uninitialized values for ports...CVE-2017-5405Fix available5.3 Medium
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreA use-after-free error can occur when manipulating ranges in selections with one node inside a...CVE-2017-5404Public exploitFix availableEPSS 16.9%9.8 Critical
- mozilla firefox, thunderbird +1 moreWhen adding a range to an object in the DOM, it is possible to use "addRange" to add the range to...CVE-2017-5403Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreA use-after-free can occur when events are fired for a "FontFace" object after the object has...CVE-2017-5402Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreA crash triggerable by web content in which an "ErrorResult" references unassigned memory due to...CVE-2017-5401Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +6 more +8 moreJIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP...CVE-2017-5400Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreMemory safety bugs were reported in Firefox 51. Some of these bugs showed evidence of memory...CVE-2017-5399Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreMemory safety bugs were reported in Thunderbird 45.7. Some of these bugs showed evidence of...CVE-2017-5398Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreA use-after-free vulnerability in the Media Decoder when working with media files when some...CVE-2017-5396Fix available9.8 Critical
- mozilla firefoxThe "mozAddonManager" allows for the installation of extensions from the CDN for addons.mozilla...CVE-2017-5393Fix available6.1 Medium
- mozilla firefoxSpecial "about:" pages used by web content, such as RSS feeds, can load privileged "about:" pages...CVE-2017-5391Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreThe JSON viewer in the Developer Tools uses insecure methods to create a communication channel...CVE-2017-5390Fix available9.8 Critical
- mozilla firefoxWebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the...CVE-2017-5389Fix available6.1 Medium
- mozilla firefoxA STUN server in conjunction with a large number of "webkitRTCPeerConnection" objects can be used...CVE-2017-5388Fix available7.5 High
- mozilla firefoxThe existence of a specifically requested local file can be found due to the double firing of the...CVE-2017-5387Fix available3.3 Low
- mozilla firefox, firefox esr, debian linux +6 more +8 moreWebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions...CVE-2017-5386Fix available7.3 High
- mozilla firefoxData sent with in multipart channels, such as the multipart/x-mixed-replace MIME type, will...CVE-2017-5385Fix available7.5 High
- mozilla firefoxProxy Auto-Config (PAC) files can specify a JavaScript function called for all URL requests with...CVE-2017-5384Fix available5.9 Medium
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreURLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger...CVE-2017-5383Fix available5.3 Medium
- mozilla firefoxFeed preview for RSS feeds can be used to capture errors and exceptions generated by privileged...CVE-2017-5382Fix available7.5 High
- mozilla firefoxThe "export" function in the Certificate Viewer can force local filesystem navigation when the ...CVE-2017-5381Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreA potential use-after-free found through fuzzing during DOM manipulation of SVG content. This...CVE-2017-5380Fix available9.8 Critical
- Show moreLoading…