Skip to contentMozilla vulnerabilities
Newest
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreMozilla developers and community members reported memory safety bugs present in Firefox 68,...CVE-2019-11740Fix available8.8 High
- mozilla firefox, firefox esr, opensuse leap +2 moreIf a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes...CVE-2019-11738Fix available6.3 Medium
- mozilla firefoxIf a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any...CVE-2019-11737Fix available5.3 Medium
- mozilla firefox, firefox esr, opensuse leap +2 moreMozilla developers and community members reported memory safety bugs present in Firefox 68 and...CVE-2019-11735Fix available8.8 High
- mozilla firefoxMozilla developers and community members reported memory safety bugs present in Firefox 68. Some...CVE-2019-11734Fix available9.8 Critical
- mozilla firefox, firefox esr +1 moreWhen a master password is set, it is required to be entered again before stored passwords can be...CVE-2019-11733Fix available9.8 Critical
- mozilla firefoxA hyperlink using the res: protocol can be used to open local files at a known location in...CVE-2019-117006.5 Medium
- mozilla firefoxA hyperlink using protocols associated with Internet Explorer, such as IE.HTTP:, can be used to...CVE-2019-117026.5 Medium
- mozilla firefox, firefox esr, thunderbird +3 more +5 moreAs part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a...CVE-2019-9811Fix available8.3 High
- mozilla firefox, firefox esr, thunderbird +3 more +5 moreA vulnerability exists where if a user opens a locally saved HTML file, this file can use file:...CVE-2019-11730Public exploitFix availableEPSS 20.3%6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreEmpty or malformed p256-ECDH public keys may trigger a segmentation fault due values being...CVE-2019-11729Fix available7.5 High
- mozilla firefox, opensuse leap +1 moreThe HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP...CVE-2019-11728Fix available4.7 Medium
- mozilla firefoxA vulnerability exists where it possible to force Network Security Services (NSS) to sign...CVE-2019-11727Fix available5.3 Medium
- mozilla firefox, opensuse leap +1 moreWhen a user navigates to site marked as unsafe by the Safebrowsing API, warning messages are...CVE-2019-11725Fix available6.5 Medium
- mozilla firefox, opensuse leap +1 moreApplication permissions give additional remote troubleshooting permission to the site input...CVE-2019-11724Fix available6.1 Medium
- mozilla firefox, opensuse leap +1 moreA vulnerability exists during the installation of add-ons where the initial fetch ignored the...CVE-2019-11723Fix available7.5 High
- mozilla firefox, opensuse leap +1 moreThe unicode latin 'kra' character can be used to spoof a standard 'k' character in the addressbar...CVE-2019-11721Fix available6.5 Medium
- mozilla firefox, opensuse leap +1 moreSome unicode characters are incorrectly treated as whitespace during the parsing of web content...CVE-2019-11720Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible...CVE-2019-11719Fix available7.5 High
- mozilla firefox, opensuse leap +1 moreActivity Stream can display content from sent from the Snippet Service website. This content is...CVE-2019-11718Fix available5.3 Medium
- mozilla firefox, firefox esr, thunderbird +3 more +5 moreA vulnerability exists where the caret ("^") character is improperly escaped constructing some...CVE-2019-11717Fix available5.3 Medium
- mozilla firefoxUntil explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not...CVE-2019-11716Fix available8.3 High
- mozilla firefox, firefox esr, thunderbird +2 moreDue to an error while parsing page content, it is possible for properly sanitized user input to...CVE-2019-11715Fix available6.1 Medium
- mozilla firefoxNecko can access a child on the wrong thread during UDP connections, resulting in a potentially...CVE-2019-11714Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreA use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while...CVE-2019-11713Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 morePOST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response...CVE-2019-11712Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreWhen an inner window is reused, it does not consider the use of document.domain for cross-origin...CVE-2019-11711Fix available8.8 High
- mozilla firefox, opensuse leap +1 moreMozilla developers and community members reported memory safety bugs present in Firefox 67. Some...CVE-2019-11710Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +3 more +5 moreMozilla developers and community members reported memory safety bugs present in Firefox 67 and...CVE-2019-11709Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreInsufficient vetting of parameters passed with the Prompt:Open IPC message between child and...CVE-2019-11708In KEVPublic exploitFix availableEPSS 55.9%10.0 Critical
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA type confusion vulnerability can occur when manipulating JavaScript objects due to issues in...CVE-2019-11707In KEVPublic exploitFix availableEPSS 38.0%8.8 High
- mozilla thunderbirdA flaw in Thunderbird's implementation of iCal causes a type confusion in...CVE-2019-11706Public exploitFix available7.5 High
- mozilla thunderbirdA flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in...CVE-2019-11705Public exploitFix available9.8 Critical
- mozilla thunderbirdA flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in...CVE-2019-11704Public exploitFix availableEPSS 10.5%9.8 Critical
- mozilla thunderbirdA flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in...CVE-2019-11703Public exploitFix availableEPSS 10.5%9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreA race condition is present in the crash generation server used to generate data for the crash...CVE-2019-9818Fix available8.3 High
- mozilla firefox, firefox esr, thunderbird +2 moreIf hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous...CVE-2019-9815Fix available8.1 High
- mozilla firefox, firefox esr, thunderbird +2 moreA vulnerability exists in the Windows sandbox where an uninitialized value in memory can be...CVE-2019-11694Fix available7.5 High
- mozilla firefoxA use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with...CVE-2019-9821Fix available8.1 High
- mozilla firefox, firefox esr, thunderbird +2 moreA use-after-free vulnerability can occur in the chrome event handler when it is freed while still...CVE-2019-9820Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreA vulnerability where a JavaScript compartment mismatch can occur while working with the fetch...CVE-2019-9819Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreImages from a different domain can be read using a canvas object in some circumstances. This...CVE-2019-9817Fix available5.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA possible vulnerability exists where type confusion can occur when manipulating JavaScript...CVE-2019-9816Public exploitFix available5.9 Medium
- mozilla firefoxMozilla developers and community members reported memory safety bugs present in Firefox 66. Some...CVE-2019-9814Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers and community members reported memory safety bugs present in Firefox 66,...CVE-2019-9800Fix available9.8 Critical
- mozilla firefoxThe default webcal: protocol handler will load a web site vulnerable to cross-site scripting (XSS...CVE-2019-11701Fix available6.1 Medium
- mozilla firefoxA malicious page can briefly cause the wrong name to be highlighted as the domain name in the...CVE-2019-11699Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIf a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting...CVE-2019-11698Fix available5.3 Medium
- mozilla firefoxIf the ALT and "a" keys are pressed when users receive an extension installation prompt, the...CVE-2019-11697Fix available6.5 Medium
- mozilla firefoxFiles with the .JNLP extension used for "Java web start" applications are not treated as...CVE-2019-11696Fix available7.8 High
- Show moreLoading…