Skip to contentMozilla vulnerabilities
Newest
- mozilla firefox, firefox esr, thunderbird +2 moreCertain input to the CSS Sanitizer confused it, resulting in incorrect components being removed....CVE-2020-26973Fix available8.8 High
- mozilla firefoxThe lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former...CVE-2020-26972Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreCertain blit values provided by the user were not properly constrained leading to a heap buffer...CVE-2020-26971Fix available8.8 High
- mozilla firefox, firefox mobile +1 moreIf the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version...CVE-2020-26964Fix available6.8 Medium
- mozilla firefox, firefox mobile +1 moreOneCRL was non-functional in the new Firefox for Android due to a missing service initialization....CVE-2020-26957Fix available6.5 Medium
- mozilla firefox, firefox mobile +1 moreWhen a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re...CVE-2020-26955Fix available6.5 Medium
- mozilla firefox, firefox mobile +1 moreWhen accepting a malicious intent from other installed apps, Firefox for Android accepted...CVE-2020-26954Fix available4.3 Medium
- mozilla thunderbirdWhen reading SMTP server status codes, Thunderbird writes an integer value to a position on the...CVE-2020-26970Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreSearching for a single word from the address bar caused an mDNS request to be sent on the local...CVE-2020-26966Fix available6.5 Medium
- mozilla firefoxMozilla developers reported memory safety bugs present in Firefox 82. Some of these bugs showed...CVE-2020-26969Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some...CVE-2020-26968Fix available8.8 High
- mozilla firefoxWhen listening for page changes with a Mutation Observer, a malicious web page could confuse...CVE-2020-26967Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreSome websites have a feature "Show Password" where clicking a button will change a password field...CVE-2020-26965Fix available6.5 Medium
- mozilla firefoxRepeated calls to the history and location interfaces could have been used to hang the browser....CVE-2020-26963Fix available4.3 Medium
- mozilla firefoxCross-origin iframes that contained a login form could have been recognized by the login autofill...CVE-2020-26962Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the...CVE-2020-26961Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIf the Compact() method was called on an nsTArray, the array could have been reallocated without...CVE-2020-26960Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreDuring browser shutdown, reference decrementing could have occured on a previously freed object,...CVE-2020-26959Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreFirefox did not block execution of scripts with incorrect MIME types when the response was...CVE-2020-26958Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIn some cases, removing HTML elements during sanitization would keep existing SVG event handlers...CVE-2020-26956Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIt was possible to cause the browser to enter fullscreen mode without displaying the security UI;...CVE-2020-26953Fix available4.3 Medium
- mozilla firefoxIncorrect bookkeeping of functions inlined during JIT compilation could have led to memory...CVE-2020-26952Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire...CVE-2020-26951Fix available6.1 Medium
- google chrome, mozilla firefox +1 moreSide-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a...CVE-2020-16012Public exploitFix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIn certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions...CVE-2020-26950Public exploitFix availableEPSS 42.3%8.8 High
- mozilla firefoxMozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed...CVE-2020-15684Fix available9.8 Critical
- mozilla firefoxWhen a link to an external protocol was clicked, a prompt was presented that allowed the user to...CVE-2020-15682Fix available6.5 Medium
- mozilla firefoxWhen multiple WASM threads had a reference to a module, and were looking up exported functions,...CVE-2020-15681Fix available7.5 High
- mozilla firefoxIf a valid external protocol handler was referenced in an image tag, the resulting broken image...CVE-2020-15680Fix available5.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreMozilla developers and community members reported memory safety bugs present in Firefox 81 and...CVE-2020-15683Fix available9.8 Critical
- mozilla nss, fedoraproject fedora, mozilla network security services +4 more +6 moreA flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw...CVE-2020-25648Fix available7.5 High
- mozilla firefoxWhen processing a MAR update file, after the signature has been validated, an invalid name length...CVE-2020-15667Fix available8.8 High
- mozilla firefox for android, firefox mobile +1 moreWhen typing in a password under certain conditions, a race may have occured where the...CVE-2020-156713.1 Low
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreWhen recursing through graphical layers while scrolling, an iterator may have become invalid,...CVE-2020-15678Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreBy exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the...CVE-2020-15677Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreFirefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to...CVE-2020-15676Fix available6.1 Medium
- mozilla firefoxWhen processing surfaces, the lifetime may outlive a persistent buffer leading to memory...CVE-2020-15675Fix available8.8 High
- mozilla firefoxMozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed...CVE-2020-15674Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreMozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some...CVE-2020-15673Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreIf Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would...CVE-2020-15663Fix available8.8 High
- mozilla firefox, firefox esr, firefox for android +2 more +4 moreMozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these...CVE-2020-15670Fix available8.8 High
- mozilla firefox esr, thunderbird +1 moreWhen aborting an operation, such as a fetch, an abort signal may be deleted while alerting the...CVE-2020-15669Fix available8.8 High
- mozilla firefox, firefox for android, firefox mobile +2 moreA lock was missing when accessing a data structure and importing certificate information into the...CVE-2020-15668Fix available4.3 Medium
- mozilla firefox, firefox for android, firefox mobile +2 moreWhen trying to load a non-video in an audio/video context the exact status code (200, 302, 404,...CVE-2020-15666Fix available6.5 Medium
- mozilla firefoxFirefox did not reset the address bar after the beforeunload dialog was shown if the user chose...CVE-2020-15665Fix available4.3 Medium
- mozilla firefox, firefox esr, firefox for android +2 more +4 moreBy holding a reference to the eval() function from an about:blank window, a malicious webpage...CVE-2020-15664Fix available6.5 Medium
- mozilla nssA flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55....CVE-2020-12403Fix available9.1 Critical
- mozilla firefox, firefox for ios +1 moreA unicode RTL order character in the downloaded file name can be used to change the file's name...CVE-2020-156514.3 Medium
- mozilla firefox esrGiven an installed malicious file picker application, an attacker was able to overwrite local...CVE-2020-15650Fix available5.5 Medium
- mozilla firefox esrGiven an installed malicious file picker application, an attacker was able to steal and upload...CVE-2020-15649Fix available5.5 Medium
- Show moreLoading…