Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,935

Export CSV
CVE-2017-5442

Mozilla: Use-after-free during style changes (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability during changes in style when manipulating DOM elements. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 2.6% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5430

Mozilla: Memory safety bugs fixed in Firefox 53 and Firefox ESR 52.1 (MFSA 2017-12)

Memory safety bugs were reported in Firefox 52, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Thunderbird Enterprise Linux and 3 more
CVE-2017-5410

Mozilla: Memory corruption during JavaScript garbage collection incremental sweeping (MFSA 2017-06)

Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for memory cleanup. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 9.8 Critical EPSS 3.4% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5407

Mozilla: Pixel and history stealing via floating-point timing side channel with SVG filters (MFSA 2017-06)

Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This can be used to extract history information and read text values across domains. This violates same-origin policy and leads to information disclosure. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 6.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5408

Mozilla: Cross-origin reading of video captions in violation of CORS (MFSA 2017-06)

Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 5.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5429

Mozilla: Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1 (MFSA 2017-11, MFSA 2017-12)

Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 3.4% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 4 more
CVE-2017-5432

Mozilla: Use-after-free in text input selection (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability occurs during certain text input selection resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 3.1% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2016-9895

Mozilla: CSP bypass using marquee tag (MFSA 2016-94, MFSA 2016-95)

Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

CVSS 3.0 · 6.1 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2016-9899

Mozilla: Use-after-free while manipulating DOM events and audio elements (MFSA 2016-94, MFSA 2016-95)

Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

CVSS 3.0 · 9.8 Critical EPSS 19.4% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2016-9900

Mozilla: Restricted external resources can be loaded by SVG images through data URLs (MFSA 2016-94, MFSA 2016-95)

External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs. This could allow for cross-domain data leakage. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

CVSS 3.0 · 7.5 High EPSS 9.6% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5401

Mozilla: Memory Corruption when handling ErrorResult (MFSA 2017-06)

A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error. The resulting crash may be exploitable. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2016-9904

Mozilla: Cross-origin information leak in shared atoms (MFSA 2016-94, MFSA 2016-95)

An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

CVSS 3.0 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 4 more
CVE-2017-5402

Mozilla: Use-after-free working with events in FontFace objects (MFSA 2017-06)

A use-after-free can occur when events are fired for a "FontFace" object after the object has been already been destroyed while working with fonts. This results in a potentially exploitable crash. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 9.8 Critical EPSS 2.8% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5449

Mozilla: Crash during bidirectional unicode manipulation with animation (MFSA 2017-11, MFSA 2017-12)

A possibly exploitable crash triggered during layout and manipulation of bidirectional unicode text in concert with CSS animations. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Thunderbird Enterprise Linux and 5 more
CVE-2017-5404

Mozilla: Use-after-free working with ranges in selections (MFSA 2017-06)

A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of it. This results in a potentially exploitable crash. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 9.8 Critical EPSS 16.9% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5456

Mozilla: Sandbox escape allowing local file system read access (MFSA 2017-12)

A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and write access to the local file system. This vulnerability affects Firefox ESR < 52.1 and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 2.7% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Enterprise Linux Enterprise Linux Desktop and 4 more
CVE-2017-5460

Mozilla: Use-after-free in frame selection (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability in frame selection triggered by a combination of malicious script content and key presses by a user. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 2.9% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5465

Mozilla: Out-of-bounds read in ConvolvePixel (MFSA 2017-11, MFSA 2017-12)

An out-of-bounds read while processing SVG content in "ConvolvePixel". This results in a crash and also allows for otherwise inaccessible memory being copied into SVG graphic content, which could then displayed. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.1 Critical EPSS 18.2% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5400

Mozilla: asm.js JIT-spray bypass of ASLR and DEP (MFSA 2017-06)

JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 9.8 Critical EPSS 3.6% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5405

Mozilla: FTP response codes can cause use of uninitialized values for ports (MFSA 2017-06)

Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 5.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more