Skip to contentMozilla vulnerabilities
Newest
- mozilla firefox, firefox esr, canonical ubuntu linux +6 more +8 moreWhen pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer...CVE-2019-17022Fix available6.1 Medium
- mozilla firefox, firefox esr, opensuse leap +2 moreDuring the initialization of a new content process, a race condition occurs that can allow a...CVE-2019-170215.3 Medium
- mozilla firefox, canonical ubuntu linux +1 moreIf an XML file is served with a Content Security Policy and the XML file includes an XSL...CVE-2019-17020Fix available6.5 Medium
- mozilla firefoxWhen Python was installed on Windows, a python file being served with the MIME type of text/plain...CVE-2019-170198.8 High
- mozilla firefoxWhen in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to...CVE-2019-170185.3 Medium
- mozilla firefox, firefox esr, canonical ubuntu linux +6 more +8 moreDue to a missing case handling object types, a type confusion vulnerability could occur,...CVE-2019-17017Fix available8.8 High
- mozilla firefox, firefox esr, canonical ubuntu linux +6 more +8 moreWhen pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer...CVE-2019-17016Fix available6.1 Medium
- mozilla firefox, firefox esr +1 moreDuring the initialization of a new content process, a pointer offset can be manipulated leading...CVE-2019-170158.8 High
- mozilla network security services, nss, netapp hci compute node +11 more +13 moreIn Network Security Services (NSS) before 3.46, several cryptographic primitives had missing...CVE-2019-17006Fix available9.8 Critical
- mozilla firefoxMozilla Firefox 20.0a1 and earlier allows remote attackers to cause a denial of service (crash),...CVE-2013-16896.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreWhen running, the updater service wrote status and log files to an unrestricted location;...CVE-2019-17009Fix available7.8 High
- mozilla firefoxIf an image had not loaded correctly (such as when it is not actually an image), it could be...CVE-2019-17014Fix available7.4 High
- mozilla firefoxMozilla developers reported memory safety bugs present in Firefox 70. Some of these bugs showed...CVE-2019-17013Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreMozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some...CVE-2019-17012Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreUnder certain conditions, when retrieving a document from a DocShell in the antitracking code, a...CVE-2019-17011Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreUnder certain conditions, when checking the Resist Fingerprinting preference during device...CVE-2019-17010Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreWhen using nested workers, a use-after-free could occur during worker destruction. This resulted...CVE-2019-17008Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreThe plain text serializer used a fixed-size array for the number of <ol> elements it could...CVE-2019-17005Fix available8.8 High
- mozilla firefoxImproper refcounting of soft token session objects could cause a use-after-free and crash (likely...CVE-2019-11756Fix available8.8 High
- mozilla network security services, nss, siemens ruggedcom rox mx5000 firmware +7 more +9 moreIn Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS...CVE-2019-17007Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +12 more +14 moreWhen encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller...CVE-2019-11745Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360...CVE-2019-11758Fix available8.8 High
- mozilla firefoxIf upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged...CVE-2019-17002Fix available4.3 Medium
- mozilla firefoxA Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to...CVE-2019-17001Fix available6.1 Medium
- mozilla firefoxAn object tag with a data URI did not correctly inherit the document's Content Security Policy....CVE-2019-17000Fix available6.1 Medium
- mozilla firefoxA compromised content process could send a message to the parent process that would cause the ...CVE-2019-11765Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMozilla developers and community members reported memory safety bugs present in Firefox 69 and...CVE-2019-11764Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreFailure to correctly handle null bytes when processing HTML entities resulted in Firefox...CVE-2019-11763Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIf two same-origin documents set document.domain differently to become cross-origin, it was...CVE-2019-11762Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreBy using a form with a data URI it was possible to gain access to the privileged JSONView object...CVE-2019-11761Fix available5.4 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted...CVE-2019-11760Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreAn attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer...CVE-2019-11759Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreWhen following the value's prototype chain, it was possible to retain a reference to a locale,...CVE-2019-11757Fix available8.8 High
- mozilla thunderbirdA crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer...CVE-2019-11755Fix available7.5 High
- mozilla firefoxWhen the pointer lock is enabled by a website though requestPointerLock(), no user notification...CVE-2019-11754Fix available4.3 Medium
- mozilla thunderbirdEncrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when...CVE-2019-11739Fix available6.5 Medium
- mozilla firefox, firefox esr +1 moreThe Firefox installer allows Firefox to be installed to a custom user writable location, leaving...CVE-2019-117537.8 High
- mozilla firefox, firefox esr +1 moreLogging-related command line parameters are not properly sanitized when Firefox is launched by...CVE-2019-117518.8 High
- mozilla firefox, firefox esr +1 moreThe Mozilla Maintenance Service does not guard against files being hardlinked to another file in...CVE-2019-117367.0 High
- mozilla firefox, firefox esr +1 moreGiven a compromised sandboxed content process due to a separate vulnerability, it is possible to...CVE-2019-9812Fix available9.3 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreIt is possible to delete an IndexedDB key value and subsequently try to extract it during...CVE-2019-11752Fix available8.8 High
- mozilla firefox, firefox esr +1 moreA type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash....CVE-2019-11750Fix available6.5 Medium
- mozilla firefox, firefox esr +1 moreA vulnerability exists in WebRTC where malicious web content can use probing techniques on the...CVE-2019-11749Fix available4.3 Medium
- mozilla firefox, firefox esr +1 moreWebRTC in Firefox will honor persisted permissions given to sites for access to microphone and...CVE-2019-11748Fix available6.5 Medium
- mozilla firefox, firefox esr +1 moreThe "Forget about this site" feature in the History pane is intended to remove all saved user...CVE-2019-11747Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA use-after-free vulnerability can occur while manipulating video elements if the body is freed...CVE-2019-11746Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreSome HTML elements, such as <title> and <textarea>, can contain literal angle...CVE-2019-11744Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreNavigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft...CVE-2019-11743Fix available3.7 Low
- mozilla firefox, firefox esr, thunderbird +2 moreA same-origin policy violation occurs allowing the theft of cross-origin images through a...CVE-2019-11742Fix available6.5 Medium
- mozilla firefoxA compromised sandboxed content process can perform a Universal Cross-site Scripting (UXSS)...CVE-2019-11741Fix available6.1 Medium
- Show moreLoading…