Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,218

Export CSV
CVE-2014-1524

Mozilla: Buffer overflow when using non-XBL object as XBL (MFSA 2014-38)

The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not properly check whether objects are XBL objects, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted JavaScript code that accesses a non-XBL object as if it were an XBL object.

CVSS 3.1 · 9.8 Critical EPSS 7.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 13 more
CVE-2018-12377

Mozilla: Use-after-free in driver timers

A use-after-free vulnerability can occur when refresh driver timers are refreshed in some circumstances during shutdown when the timer is deleted while still in use. This results in a potentially exploitable crash. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1.

CVSS 3.0 · 9.8 Critical EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 8 more
CVE-2018-12378

Mozilla: Use-after-free in IndexedDB

A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload values to be stored. This results in a potentially exploitable crash. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1.

CVSS 3.0 · 9.8 Critical EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 8 more
CVE-2014-1481

Mozilla: Inconsistent JavaScript handling of access to Window objects (MFSA 2014-13)

Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to bypass intended restrictions on window objects by leveraging inconsistency in native getter methods across different JavaScript engines.

CVSS 3.1 · 7.5 High EPSS 3.9% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2014-1486

Mozilla: Use-after-free with imgRequestProxy and image proccessing (MFSA 2014-08)

Use-after-free vulnerability in the imgRequestProxy function in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving unspecified Content-Type values for image data.

CVSS 3.1 · 9.8 Critical EPSS 7.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 14 more
CVE-2014-1487

Mozilla: Cross-origin information leak through web workers (MFSA 2014-09)

The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass the Same Origin Policy and obtain sensitive authentication information via vectors involving error messages.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2013-6673

Mozilla: Trust settings for built-in roots ignored during EV certificate validation (MFSA 2013-113)

Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 do not recognize a user's removal of trust from an EV X.509 certificate, which makes it easier for man-in-the-middle attackers to spoof SSL servers in opportunistic circumstances via a valid certificate that is unacceptable to the user.

CVSS 3.1 · 5.9 Medium EPSS 2.9% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 2 more
Products
Ubuntu Linux Fedora Firefox and 6 more
CVE-2014-1497

Mozilla: Out of bounds read during WAV file decoding (MFSA 2014-17)

The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process heap memory, cause a denial of service (out-of-bounds read and application crash), or possibly have unspecified other impact via a crafted WAV file.

CVSS 3.1 · 8.8 High EPSS 2.8% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 14 more
CVE-2013-6671

Mozilla: Segmentation violation when replacing ordered list elements (MFSA 2013-111)

The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code via crafted use of JavaScript code for ordered list elements.

CVSS 3.1 · 9.8 Critical EPSS 11.1% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 3 more
Products
Ubuntu Linux Fedora Firefox and 14 more
CVE-2014-1508

Mozilla: Information disclosure through polygon rendering in MathML (MFSA 2014-26)

The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process memory, cause a denial of service (out-of-bounds read and application crash), or possibly bypass the Same Origin Policy via vectors involving MathML polygon rendering.

CVSS 3.1 · 9.1 Critical EPSS 4.2% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 14 more
CVE-2018-5187

Mozilla: Memory safety bugs fixed in Firefox 60 and Firefox ESR 60.1

Memory safety bugs present in Firefox 60 and Firefox ESR 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61.

CVSS 3.0 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Mozilla
Products
Ubuntu Linux Debian Linux Firefox and 1 more
CVE-2014-1511

Mozilla: Privilege escalation using WebIDL-implemented APIs (MFSA 2014-29)

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified vectors.

CVSS 3.1 · 9.8 Critical EPSS 83.5% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 14 more
CVE-2014-1513

Mozilla: Out-of-bounds read/write through neutering ArrayBuffer objects (MFSA 2014-31)

TypedArrayObject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not prevent a zero-length transition during use of an ArrayBuffer object, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based out-of-bounds write or read) via a crafted web site.

CVSS 3.1 · 8.8 High EPSS 5.5% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 14 more
CVE-2014-1514

Mozilla: Out-of-bounds write through TypedArrayObject after neutering (MFSA 2014-32)

vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the length of the destination array before a copy operation, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by triggering incorrect use of the TypedArrayObject class.

CVSS 3.1 · 9.8 Critical EPSS 6.0% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 14 more
CVE-2013-5615

Mozilla: GetElementIC typed array stubs can be generated outside observed typesets (MFSA 2013-115)

The JavaScript implementation in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 does not properly enforce certain typeset restrictions on the generation of GetElementIC typed array stubs, which has unspecified impact and remote attack vectors.

CVSS 3.1 · 9.8 Critical EPSS 4.2% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 2 more
Products
Ubuntu Linux Fedora Firefox and 6 more
CVE-2013-5616

Mozilla: Use-after-free in event listeners (MFSA 2013-108)

Use-after-free vulnerability in the nsEventListenerManager::HandleEventSubType function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to mListeners event listeners.

CVSS 3.1 · 9.8 Critical EPSS 6.7% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 3 more
Products
Ubuntu Linux Fedora Firefox and 14 more
CVE-2013-5613

Mozilla: Use-after-free in synthetic mouse movement (MFSA 2013-114)

Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving synthetic mouse movement, related to the RestyleManager::GetHoverGeneration function.

CVSS 3.1 · 9.8 Critical EPSS 9.4% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 3 more
Products
Ubuntu Linux Fedora Firefox and 14 more
CVE-2013-5618

Mozilla: Use-after-free during Table Editing (MFSA 2013-109)

Use-after-free vulnerability in the nsNodeUtils::LastRelease function in the table-editing user interface in the editor component in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code by triggering improper garbage collection.

CVSS 3.1 · 9.8 Critical EPSS 10.4% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 3 more
Products
Ubuntu Linux Fedora Firefox and 14 more
CVE-2013-6629

libjpeg: information leak (read of uninitialized memory)

The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.

CVSS 2.0 · 5.0 Medium EPSS 9.7% KEV · Not listed
Vendors
Artifex Canonical Debian and 7 more
Products
Gpl Ghostscript Ubuntu Linux Debian Linux and 12 more
CVE-2013-5609

Mozilla: Miscellaneous memory safety hazards (rv:24.2) (MFSA 2013-104)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 3.1 · 9.8 Critical EPSS 8.1% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 3 more
Products
Ubuntu Linux Fedora Firefox and 14 more