Skip to contentMozilla vulnerabilities
Newest
- mozilla firefox, firefox esr, thunderbird +2 moreWhen encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input...CVE-2023-25732Fix available8.8 High
- mozilla firefoxDue to URL previews in the network panel of developer tools improperly storing URLs, query...CVE-2023-25731Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA background script invoking <code>requestFullscreen</code> and then blocking the main thread...CVE-2023-25730Fix available5.4 Medium
- mozilla firefox, firefox esr, thunderbird +2 morePermission prompts for opening external schemes were only shown for <code>ContentPrincipals</code...CVE-2023-25729Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreThe <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a...CVE-2023-25728Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary...CVE-2023-0767Fix available8.8 High
- mozilla thunderbirdCertificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed...CVE-2023-0430Fix available6.5 Medium
- mozilla firefoxMemory safety bugs fixed in Firefox 109CVE-2023-23606Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreMemory safety bugs fixed in Firefox 109 and Firefox ESR 102.7CVE-2023-23605Fix available8.8 High
- mozilla firefoxCreation of duplicate SystemPrincipal from less secure contextsCVE-2023-23604Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreCalls to console.log allowed bypassing Content Security Policy via format directiveCVE-2023-23603Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreContent Security Policy wasn't being correctly applied to WebSockets in WebWorkersCVE-2023-23602Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreURL being dragged from cross-origin iframe into same tab triggers navigationCVE-2023-23601Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMalicious command could be hidden in devtools output on WindowsCVE-2023-23599Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreArbitrary file read from GTK drag and drop on LinuxCVE-2023-23598Fix available6.5 Medium
- mozilla firefoxLogic bug in process allocation allowed to read arbitrary filesCVE-2023-23597Fix available6.5 Medium
- mozilla convictPrototype Pollution in convictCVE-2023-0163Fix available8.4 High
- mozilla firefoxMozilla developers Timothy Nikkel, Ashley Hale, and the Mozilla Fuzzing Team reported memory...CVE-2022-46885Fix available8.8 High
- mozilla firefoxMozilla developers Gabriele Svelto, Yulia Startsev, Andrew McCreight and the Mozilla Fuzzing Team...CVE-2022-46883Fix available8.8 High
- mozilla firefoxDuring startup, a graphics driver with an unexpected name could lead to a stack-buffer overflow...CVE-2022-409616.5 Medium
- mozilla firefox, firefox mobile +1 moreA website that had permission to access the microphone could record audio without the audio...CVE-2022-384744.3 Medium
- mozilla firefoxWhen visiting a website with an overly long URL, the user interface would start to hang. Due to...CVE-2022-36317Fix available6.5 Medium
- mozilla firefox for ios, firefox mobile +1 moreInternal URLs are protected by a secret UUID key, which could have been leaked to web page...CVE-2022-317466.5 Medium
- mozilla firefoxWhen closed or sent to the background, Firefox for Android would not properly record and persist...CVE-2022-29910Fix available6.1 Medium
- mozilla firefoxUnder certain circumstances, a JavaScript alert (or prompt) could have been shown while another...CVE-2022-22762Fix available4.3 Medium
- mozilla firefoxWhen clicking on a tel: link, USSD codes, specified after a <code>\*</code> character, would be...CVE-2022-22758Fix available8.8 High
- mozilla firefoxBy generally accepting and passing resource handles across processes, a compromised content...CVE-2022-22750Fix available6.5 Medium
- mozilla firefoxWhen scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do...CVE-2022-22749Fix available4.3 Medium
- mozilla firefoxIf Firefox was installed to a world-writable directory, a local privilege escalation could occur...CVE-2022-22736Fix available7.0 High
- mozilla firefox, firefox for ios +1 moreThe search term could have been specified externally to trigger SQL injection. This vulnerability...CVE-2022-18879.8 Critical
- mozilla vpnMozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or...CVE-2022-05177.8 High
- mozilla firefoxIf a domain name contained a RTL character, it would cause the domain to be rendered to the right...CVE-2021-42214.3 Medium
- mozilla firefoxWhen transitioning in and out of fullscreen mode, a graphics object was not correctly protected;...CVE-2021-41286.5 Medium
- mozilla vpn android 1.1.0, vpn ios 1.0.7, vpn windows +1 more +3 moreAn OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could...CVE-2020-156797.6 High
- mozilla firefoxMozilla developers and community members Lukas Bernhard, Gabriele Svelto, Randell Jesup, and the...CVE-2022-46879Fix available8.8 High
- mozilla firefox, debian linux +1 moreBy confusing the browser, the fullscreen notification could have been delayed or suppressed,...CVE-2022-46877Fix available4.3 Medium
- mozilla firefoxBecause Firefox did not implement the <code>unsafe-hashes</code> CSP directive, an attacker who...CVE-2022-46873Fix available8.8 High
- mozilla firefox, debian linux +1 moreAn out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited...CVE-2022-46871Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA use-after-free in WebGL extensions could have led to a potentially exploitable crash. This...CVE-2022-46882Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreAn optimization in WebGL was incorrect in some cases, and could have led to memory corruption and...CVE-2022-46881Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA missing check related to tex units could have led to a use-after-free and potentially...CVE-2022-46880Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team...CVE-2022-46878Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreThe executable file warning was not presented when downloading .atloc and .ftploc files, which...CVE-2022-46875Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA file with a long filename could have had its filename truncated to remove the valid extension,...CVE-2022-46874Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker who compromised a content process could have partially escaped the sandbox to read...CVE-2022-46872Fix available8.6 High
- mozilla thunderbirdIf a Thunderbird user quoted from an HTML email, for example by replying to the email, and the...CVE-2022-45414Fix available8.1 High
- davidmoreno onion, mozilla firefox +1 moredavidmoreno onion Log response.c onion_response_flush allocation of resourcesCVE-2022-40663.5 Low
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in...CVE-2022-45421Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreUse tables inside of an iframe, an attacker could have caused iframe contents to be rendered...CVE-2022-45420Fix available6.5 Medium
- mozilla firefoxIf the user added a security exception for an invalid TLS certificate, opened an ongoing TLS...CVE-2022-454196.5 Medium
- Show moreLoading…