Skip to contentMozilla vulnerabilities
Newest
- mozilla firefox, firefox for android, focus +2 more +4 moreMozilla developers Randell Jesup, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team...CVE-2023-29551Fix available8.8 High
- mozilla firefox, firefox for android, focus +2 more +4 moreUnder certain circumstances, a call to the <code>bind</code> function may have resulted in the...CVE-2023-29549Fix available6.5 Medium
- mozilla firefox, firefox for android, focus +2 more +4 moreWhen a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain...CVE-2023-29547Fix available6.5 Medium
- mozilla firefox, firefox for android, focus +2 more +4 moreIf multiple instances of resource exhaustion occurred at the incorrect time, the garbage...CVE-2023-29544Fix available6.5 Medium
- mozilla firefox, firefox for android, focus +2 more +4 moreAn attacker could have caused memory corruption and a potentially exploitable use-after-free of a...CVE-2023-29543Fix available8.8 High
- mozilla firefox, firefox for android, focus +2 more +4 moreUsing a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to...CVE-2023-29540Fix available6.1 Medium
- mozilla firefox, firefox for android, focus +2 more +4 moreUnder specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI...CVE-2023-29538Fix available4.3 Medium
- mozilla firefox, firefox for android, focus +2 more +4 moreMultiple race conditions in the font initialization could have led to memory corruption and...CVE-2023-29537Fix available7.5 High
- mozilla thunderbirdOCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted...CVE-2023-0547Fix available6.5 Medium
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreMozilla developers Randell Jesup, Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the...CVE-2023-29550Fix available8.8 High
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result....CVE-2023-29548Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreSimilar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing...CVE-2023-29545Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA newline in a filename could have been used to bypass the file extension security mechanisms...CVE-2023-29542Fix available9.8 Critical
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreFirefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be...CVE-2023-29541Fix available8.8 High
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreWhen handling the filename directive in the Content-Disposition header, the filename would be...CVE-2023-29539Fix available8.8 High
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker...CVE-2023-29536Fix available8.8 High
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreFollowing a Garbage Collector compaction, weak maps may have been accessed before they were...CVE-2023-29535Fix available6.5 Medium
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreA website could have obscured the fullscreen notification by using a combination of <code>window...CVE-2023-29533Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file...CVE-2023-29532Fix available5.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory...CVE-2023-29531Fix available9.8 Critical
- mozilla firefox esr, thunderbird +1 moreUnexpected data returned from the Safe Browsing API could have led to memory corruption and a...CVE-2023-1945Fix available6.5 Medium
- mozilla firefoxMozilla developers and community members Calixte Denizet, Gabriele Svelto, Andrew McCreight, and...CVE-2023-28177Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Timothy Nikkel, Andrew McCreight, and the Mozilla Fuzzing Team reported memory...CVE-2023-28176Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreDragging a URL from a cross-origin iframe that was removed during the drag could have led to user...CVE-2023-28164Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen downloading files through the Save As dialog on Windows with suggested filenames containing...CVE-2023-28163Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhile implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic...CVE-2023-28162Fix available8.8 High
- mozilla firefoxIf temporary "one-time" permissions, such as the ability to use the Camera, were granted to a...CVE-2023-28161Fix available8.8 High
- mozilla firefoxWhen following a redirect to a publicly accessible web extension file, the URL may have been...CVE-2023-28160Fix available6.5 Medium
- mozilla firefoxThe fullscreen notification could have been hidden on Firefox for Android by using download...CVE-2023-281594.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen accessing throttled streams, the count of available bytes needed to be checked in the...CVE-2023-25752Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreSometimes, when invalidating JIT code while following an iterator, the newly generated code could...CVE-2023-25751Fix available6.5 Medium
- mozilla firefoxUnder certain circumstances, a ServiceWorker's offline cache may have leaked to the file system...CVE-2023-25750Fix available4.3 Medium
- mozilla firefoxAndroid applications with unpatched vulnerabilities can be launched from a browser using Intents,...CVE-2023-257494.3 Medium
- mozilla firefoxBy displaying a prompt with a long description, the fullscreen notification could have been...CVE-2023-257484.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMembers of the <code>DEVMODEW</code> struct set by the printer device driver weren't being...CVE-2023-25738Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAfter downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker...CVE-2023-25734Fix available8.1 High
- mozilla firefox, firefox esr, firefox focus +2 moreA lack of in app notification for entering fullscreen mode could have lead to a malicious website...CVE-2023-257437.5 High
- mozilla thunderbirdIf a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly...CVE-2023-0616Fix available6.5 Medium
- mozilla firefox, firefox esr +1 moreThe Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To...CVE-2020-12413Fix available5.9 Medium
- mozilla firefox for ios, firefox mobile +1 moreScanning a QR code that contained a javascript: URL would have resulted in the Javascript being...CVE-2019-170036.1 Medium
- mozilla firefox esr, thunderbird +1 moreMozilla developers Philipp and Gabriele Svelto reported memory safety bugs present in Firefox ESR...CVE-2023-25746Fix available8.8 High
- mozilla firefoxMozilla developers Timothy Nikkel, Gabriele Svelto, Jeff Muizelaar and the Mozilla Fuzzing Team...CVE-2023-25745Fix available8.8 High
- mozilla firefox, firefox esr +1 moreMozilla developers Kershaw Chang and the Mozilla Fuzzing Team reported memory safety bugs present...CVE-2023-25744Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing...CVE-2023-25742Fix available6.5 Medium
- mozilla firefoxWhen dragging and dropping an image cross-origin, the image's size could potentially be leaked....CVE-2023-25741Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreModule load requests that failed were not being checked as to whether or not they were cancelled...CVE-2023-25739Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreAn invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to...CVE-2023-25737Fix available8.8 High
- mozilla firefoxAn invalid downcast from `nsHTMLDocument` to `nsIContent` could have lead to undefined behavior....CVE-2023-25736Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreCross-compartment wrappers wrapping a scripted proxy could have caused objects from other...CVE-2023-25735Fix available8.8 High
- mozilla firefoxThe return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have...CVE-2023-25733Fix available7.5 High
- Show moreLoading…