Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,935

Export CSV
CVE-2017-5407

Mozilla: Pixel and history stealing via floating-point timing side channel with SVG filters (MFSA 2017-06)

Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This can be used to extract history information and read text values across domains. This violates same-origin policy and leads to information disclosure. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 6.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5408

Mozilla: Cross-origin reading of video captions in violation of CORS (MFSA 2017-06)

Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 5.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5404

Mozilla: Use-after-free working with ranges in selections (MFSA 2017-06)

A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of it. This results in a potentially exploitable crash. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 9.8 Critical EPSS 16.9% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5405

Mozilla: FTP response codes can cause use of uninitialized values for ports (MFSA 2017-06)

Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 5.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5410

Mozilla: Memory corruption during JavaScript garbage collection incremental sweeping (MFSA 2017-06)

Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for memory cleanup. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 9.8 Critical EPSS 3.4% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5401

Mozilla: Memory Corruption when handling ErrorResult (MFSA 2017-06)

A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error. The resulting crash may be exploitable. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5402

Mozilla: Use-after-free working with events in FontFace objects (MFSA 2017-06)

A use-after-free can occur when events are fired for a "FontFace" object after the object has been already been destroyed while working with fonts. This results in a potentially exploitable crash. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 9.8 Critical EPSS 2.8% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5429

Mozilla: Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1 (MFSA 2017-11, MFSA 2017-12)

Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 3.4% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 4 more
CVE-2017-5386

Mozilla: WebExtensions can use data: protocol to affect other extensions (MFSA 2017-02)

WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions. This vulnerability affects Firefox ESR < 45.7 and Firefox < 51.

CVSS 3.0 · 7.3 High EPSS 2.2% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Enterprise Linux and 5 more
CVE-2017-5390

Mozilla: Insecure communication methods in Developer Tools JSON viewer (MFSA 2017-02)

The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing JSON or HTTP headers data, allowing for potential privilege escalation. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

CVSS 3.0 · 9.8 Critical EPSS 3.8% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5380

Mozilla: Potential use-after-free during DOM manipulations (MFSA 2017-02)

A potential use-after-free found through fuzzing during DOM manipulation of SVG content. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

CVSS 3.0 · 9.8 Critical EPSS 3.1% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5378

Mozilla: Pointer and frame data leakage of Javascript objects (MFSA 2017-02)

Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address can be discovered through hash codes, and also allows for data leakage of an object's content using these hash codes. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

CVSS 3.0 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5383

Mozilla: Location bar spoofing with unicode characters (MFSA 2017-02)

URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

CVSS 3.0 · 5.3 Medium EPSS 2.4% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5396

Mozilla: Use-after-free with Media Decoder (MFSA 2017-02)

A use-after-free vulnerability in the Media Decoder when working with media files when some events are fired after the media elements are freed from memory. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

CVSS 3.0 · 9.8 Critical EPSS 4.0% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5373

Mozilla: Memory safety bugs fixed in Firefox 51 and Firefox ESR 45.7 (MFSA 2017-01)

Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

CVSS 3.0 · 9.8 Critical EPSS 3.3% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 4 more
CVE-2017-5375

Mozilla: Excessive JIT code allocation allows bypass of ASLR and DEP (MFSA 2017-02)

JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

CVSS 3.0 · 9.8 Critical EPSS 34.1% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 4 more
CVE-2013-6671

Mozilla: Segmentation violation when replacing ordered list elements (MFSA 2013-111)

The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code via crafted use of JavaScript code for ordered list elements.

CVSS 3.1 · 9.8 Critical EPSS 11.1% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 3 more
Products
Ubuntu Linux Fedora Firefox and 14 more
CVE-2014-1532

Mozilla: Use-after-free in nsHostResolver (MFSA 2014-46)

Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to host resolution.

CVSS 3.1 · 9.8 Critical EPSS 4.6% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 13 more
CVE-2017-5376

Mozilla: Use-after-free in XSL (MFSA 2017-02)

Use-after-free while manipulating XSL in XSLT documents. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

CVSS 3.0 · 9.8 Critical EPSS 3.1% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5398

Mozilla: Memory safety bugs fixed in Firefox 52 and Firefox ESR 45.8 (MFSA 2017-06)

Memory safety bugs were reported in Thunderbird 45.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 7 more