Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,030

Export CSV
CVE-2017-5438

Mozilla: Use-after-free in nsAutoPtr during XSLT processing (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability during XSLT processing due to the result handler being held by a freed handler during handling. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5439

Mozilla: Use-after-free in nsTArray Length() during XSLT processing (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability during XSLT processing due to poor handling of template parameters. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5440

Mozilla: Use-after-free in txExecutionState destructor during XSLT processing (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating context, leading to objects being used when they no longer exist. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 2.9% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5441

Mozilla: Use-after-free with selection during scroll events (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability when holding a selection during scroll events. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 2.9% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5442

Mozilla: Use-after-free during style changes (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability during changes in style when manipulating DOM elements. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 2.6% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5443

Mozilla: Out-of-bounds write during BinHex decoding (MFSA 2017-11, MFSA 2017-12)

An out-of-bounds write vulnerability while decoding improperly formed BinHex format archives. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5433

Mozilla: Use-after-free in SMIL animation functions (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the animation controller while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5432

Mozilla: Use-after-free in text input selection (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability occurs during certain text input selection resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 3.1% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5434

Mozilla: Use-after-free during focus handling (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability occurs when redirecting focus handling which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 4 more
CVE-2017-5430

Mozilla: Memory safety bugs fixed in Firefox 53 and Firefox ESR 52.1 (MFSA 2017-12)

Memory safety bugs were reported in Firefox 52, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Thunderbird Enterprise Linux and 3 more
CVE-2017-5435

Mozilla: Use-after-free during transaction processing in the editor (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 3.1% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-7750

Mozilla: Use-after-free with track elements (MFSA 2017-16)

A use-after-free vulnerability during video control operations when a "<track>" element holds a reference to an older window if that window has been replaced in the DOM. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.

CVSS 3.0 · 9.8 Critical EPSS 2.8% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5407

Mozilla: Pixel and history stealing via floating-point timing side channel with SVG filters (MFSA 2017-06)

Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This can be used to extract history information and read text values across domains. This violates same-origin policy and leads to information disclosure. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 6.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5408

Mozilla: Cross-origin reading of video captions in violation of CORS (MFSA 2017-06)

Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 5.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5410

Mozilla: Memory corruption during JavaScript garbage collection incremental sweeping (MFSA 2017-06)

Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for memory cleanup. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 9.8 Critical EPSS 3.4% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5429

Mozilla: Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1 (MFSA 2017-11, MFSA 2017-12)

Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 3.4% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 4 more
CVE-2017-7752

Mozilla: Use-after-free with IME input (MFSA 2017-16)

A use-after-free vulnerability during specific user interactions with the input method editor (IME) in some languages due to how events are handled. This results in a potentially exploitable crash but would require specific user interaction to trigger. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.

CVSS 3.0 · 8.8 High EPSS 2.0% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-7753

Mozilla: Out-of-bounds read with cached style data and pseudo-elements (MFSA 2017-19)

An out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, using cached style data. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.

CVSS 3.0 · 9.1 Critical EPSS 3.1% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-5398

Mozilla: Memory safety bugs fixed in Firefox 52 and Firefox ESR 45.8 (MFSA 2017-06)

Memory safety bugs were reported in Thunderbird 45.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 7 more
CVE-2017-5400

Mozilla: asm.js JIT-spray bypass of ASLR and DEP (MFSA 2017-06)

JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS 3.0 · 9.8 Critical EPSS 3.6% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more