Skip to contentMozilla vulnerabilities
Newest
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreA use-after-free vulnerability can occur after deleting a selection element due to a weak...CVE-2018-18492Fix available9.8 Critical
- mozilla firefox, canonical ubuntu linux +1 moreA buffer overflow occurs when drawing and validating elements with the ANGLE graphics library,...CVE-2018-12407Fix available9.8 Critical
- mozilla firefox, canonical ubuntu linux +1 moreMozilla developers and community members reported memory safety bugs present in Firefox 63. Some...CVE-2018-12406Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreMozilla developers and community members reported memory safety bugs present in Firefox 63 and...CVE-2018-12405Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreDuring HTTP Live Stream playback on Firefox for Android, audio data can be accessed across...CVE-2018-123918.8 High
- mozilla firefoxA service worker can send the activate event on itself periodically which allows it to run...CVE-2018-5179Fix available7.5 High
- mozilla firefox, canonical ubuntu linux +1 moreIf a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed...CVE-2018-12403Fix available5.3 Medium
- mozilla firefox, canonical ubuntu linux +1 moreThe internal WebBrowserPersist code does not use correct origin context for a resource being...CVE-2018-12402Fix available6.5 Medium
- mozilla firefox, canonical ubuntu linux +1 moreSome special resource URIs will cause a non-exploitable crash if loaded with optional parameters...CVE-2018-12401Fix available7.5 High
- mozilla firefox, canonical ubuntu linux +1 moreWhen a new protocol handler is registered, the API accepts a title argument which can be used to...CVE-2018-12399Fix available4.3 Medium
- mozilla firefox, canonical ubuntu linux +1 moreBy using the reflected URL in some special resource URIs, such as chrome:, it is possible to...CVE-2018-12398Fix available6.5 Medium
- mozilla firefox, firefox esr, canonical ubuntu linux +5 more +7 moreA WebExtension can request access to local files without the warning prompt stating that the...CVE-2018-12397Fix available7.1 High
- mozilla firefox, firefox esr, canonical ubuntu linux +7 more +9 moreA vulnerability where a WebExtension can run content scripts in disallowed contexts following...CVE-2018-12396Fix available6.5 Medium
- mozilla firefox, firefox esr, canonical ubuntu linux +5 more +7 moreBy rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain...CVE-2018-12395Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreA potential vulnerability was found in 32-bit builds where an integer overflow during the...CVE-2018-12393Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreWhen manipulating user events in nested loops while opening a document through script, it is...CVE-2018-12392Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreMozilla developers and community members reported memory safety bugs present in Firefox 62 and...CVE-2018-12390Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreMozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2....CVE-2018-12389Fix available8.8 High
- mozilla firefox, canonical ubuntu linux +1 moreMozilla developers and community members reported memory safety bugs present in Firefox 62. Some...CVE-2018-12388Fix available8.8 High
- mozilla firefoxThe displayed addressbar URL can be spoofed on Firefox for Android using a javascript: URI in...CVE-2018-123825.3 Medium
- mozilla firefox, firefox esr, canonical ubuntu linux +7 more +9 moreA vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple...CVE-2018-12387Fix available9.1 Critical
- mozilla firefox, firefox esr, canonical ubuntu linux +7 more +9 moreA vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an...CVE-2018-12386Public exploitFix availableEPSS 13.5%8.1 High
- mozilla firefox, firefox esr +1 moreManually dragging and dropping an Outlook email message into the browser will trigger a page...CVE-2018-123815.3 Medium
- mozilla firefox, firefox esr, thunderbird +7 more +9 moreWhen the Mozilla Updater opens a MAR format file which contains a very long item filename, an out...CVE-2018-12379Fix available7.8 High
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreA potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data...CVE-2018-12385Fix available7.0 High
- mozilla firefox, firefox esr, thunderbird +2 moreA same-origin policy violation allowing the theft of cross-origin URL entries when using a meta...CVE-2018-18499Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreIf a user saved passwords before Firefox 58 and then later set a master password, an unencrypted...CVE-2018-12383Fix available5.5 Medium
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreA use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by...CVE-2018-12378Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreA use-after-free vulnerability can occur when refresh driver timers are refreshed in some...CVE-2018-12377Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreMemory safety bugs present in Firefox 61 and Firefox ESR 60.1. Some of these bugs showed evidence...CVE-2018-12376Fix available9.8 Critical
- mozilla firefox, canonical ubuntu linux +1 moreMemory safety bugs present in Firefox 61. Some of these bugs showed evidence of memory corruption...CVE-2018-12375Fix available8.8 High
- mozilla network security services (nss), network security services +1 moreWhen handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random...CVE-2018-12384Fix available5.9 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWindows 10 does not warn users before opening executable files with the SettingContent-ms...CVE-2018-123688.1 High
- apache spark, mozilla firefox +1 moreExposure of Sensitive Information to an Unauthorized Actor in Apache Spark via crafted URLCVE-2018-8024Fix available5.4 Medium
- mozilla thunderbird, canonical ubuntu linux, debian linux +4 more +6 morePlaintext of decrypted emails can leak through by user submitting an embedded form by pressing...CVE-2018-12374Fix available4.3 Medium
- mozilla thunderbird, canonical ubuntu linux, debian linux +4 more +6 moredDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when...CVE-2018-12373Fix available6.5 Medium
- mozilla thunderbird, canonical ubuntu linux, debian linux +4 more +6 moreDecrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when...CVE-2018-12372Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreMemory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8. Some of these...CVE-2018-5188Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreMemory safety bugs present in Firefox 60 and Firefox ESR 60. Some of these bugs showed evidence...CVE-2018-5187Fix available9.8 Critical
- mozilla firefox, canonical ubuntu linux +1 moreMemory safety bugs present in Firefox 60. Some of these bugs showed evidence of memory corruption...CVE-2018-5186Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreA vulnerability can occur when capturing a media stream when the media source type is changed as...CVE-2018-5156Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreAn integer overflow vulnerability in the Skia library when allocating memory for edge builders on...CVE-2018-12371Fix available8.8 High
- mozilla firefox, canonical ubuntu linux +1 moreIn Reader View SameSite cookie protections are not checked on exiting. This allows for a payload...CVE-2018-12370Fix available8.8 High
- mozilla firefox, firefox esr, canonical ubuntu linux +2 moreWebExtensions bundled with embedded experiments were not correctly checked for proper...CVE-2018-12369Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreIn the previous mitigations for Spectre, the resolution or precision of various methods was...CVE-2018-12367Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreAn invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds...CVE-2018-12366Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreA compromised IPC child process can escape the content sandbox and list the names of arbitrary...CVE-2018-12365Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreNPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by...CVE-2018-12364Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreA use-after-free vulnerability can occur when script uses mutation events to move DOM nodes...CVE-2018-12363Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +8 more +10 moreAn integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD...CVE-2018-12362Fix available8.8 High
- Show moreLoading…