Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,351

Export CSV
CVE-2018-5117

Mozilla: URL spoofing with right-to-left text aligned left-to-right (MFSA 2018-03)

If right-to-left text is used in the addressbar with left-to-right alignment, it is possible in some circumstances to scroll this text to spoof the displayed URL. This issue could result in the wrong URL being displayed as a location, which can mislead users to believe they are on a different site than the one loaded. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.

CVSS 3.0 · 5.3 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 7 more
CVE-2018-5104

Mozilla: Use-after-free during font face manipulation (MFSA 2018-03)

A use-after-free vulnerability can occur during font face manipulation when a font face is freed while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.

CVSS 3.0 · 9.8 Critical EPSS 7.0% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 7 more
CVE-2018-5125

Mozilla: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7 (MFSA 2018-07)

Memory safety bugs were reported in Firefox 58 and Firefox ESR 52.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox < 59.

CVSS 3.0 · 8.8 High EPSS 2.5% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 5 more
CVE-2018-5102

Mozilla: Use-after-free in HTML media elements (MFSA 2018-03)

A use-after-free vulnerability can occur when manipulating HTML media elements with media streams, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.

CVSS 3.0 · 9.8 Critical EPSS 6.9% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 7 more
CVE-2018-5103

Mozilla: Use-after-free during mouse event handling (MFSA 2018-03)

A use-after-free vulnerability can occur during mouse event handling due to issues with multiprocess support. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.

CVSS 3.0 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 7 more
CVE-2018-5127

Mozilla: Buffer overflow manipulating SVG animatedPathSegList (MFSA 2018-07)

A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox < 59.

CVSS 3.0 · 8.8 High EPSS 7.8% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 7 more
CVE-2018-5095

Mozilla: Integer overflow in Skia library during edge builder allocation (MFSA 2018-03)

An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 8 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.

CVSS 3.0 · 9.8 Critical EPSS 4.1% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 7 more
CVE-2018-5097

Mozilla: Use-after-free when source document is manipulated during XSLT (MFSA 2018-03)

A use-after-free vulnerability can occur during XSL transformations when the source document for the transformation is manipulated by script content during the transformation. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.

CVSS 3.0 · 9.8 Critical EPSS 7.0% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 7 more
CVE-2018-5098

Mozilla: Use-after-free while manipulating form input elements (MFSA 2018-03)

A use-after-free vulnerability can occur when form input elements, focus, and selections are manipulated by script content. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.

CVSS 3.0 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 7 more
CVE-2018-5099

Mozilla: Use-after-free with widget listener (MFSA 2018-03)

A use-after-free vulnerability can occur when the widget listener is holding strong references to browser objects that have previously been freed, resulting in a potentially exploitable crash when these references are used. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.

CVSS 3.0 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 7 more
CVE-2018-5129

Mozilla: Out-of-bounds write with malformed IPC messages (MFSA 2018-07)

A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages. This can potentially allow for sandbox escape through memory corruption in the parent process. This vulnerability affects Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox < 59.

CVSS 3.0 · 8.6 High EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 7 more
CVE-2018-5178

Mozilla: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension

A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable legacy extension in order to occur. This vulnerability affects Thunderbird ESR < 52.8, Thunderbird < 52.8, and Firefox ESR < 52.8.

CVSS 3.0 · 8.1 High EPSS 4.9% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 9 more
CVE-2018-5089

Mozilla: Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6 (MFSA 2018-03)

Memory safety bugs were reported in Firefox 57 and Firefox ESR 52.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.

CVSS 3.0 · 9.8 Critical EPSS 3.3% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 5 more
CVE-2018-18494

Mozilla: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs

A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 8 more
CVE-2018-18505

Mozilla: Privilege escalation through IPC channel messages

An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server parents during IPC process creation. This authentication is insufficient for channels created after the IPC process is started, leading to the authentication not being correctly applied to later channels. This could allow for a sandbox escape through IPC channels due to lack of message validation in the listener process. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65.

CVSS 3.0 · 10.0 Critical EPSS 4.4% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 8 more
CVE-2016-2815

Mozilla: Miscellaneous memory safety hazards (rv:47.0) (MFSA 2016-49)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 3.0 · 8.8 High EPSS 2.9% KEV · Not listed
Vendors
Canonical Mozilla Novell and 1 more
Products
Ubuntu Linux Firefox Suse Linux Enterprise Desktop and 4 more
CVE-2018-18493

Mozilla: Buffer overflow in accelerated 2D canvas with Skia

A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of 64-bit. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.

CVSS 3.0 · 9.8 Critical EPSS 5.0% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 8 more
CVE-2018-18492

Mozilla: Use-after-free with select element

A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.

CVSS 3.0 · 9.8 Critical EPSS 9.6% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 8 more
CVE-2014-1530

Mozilla: Cross-site scripting (XSS) using history navigations (MFSA 2014-43)

The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the loading of a URL with a spoofed baseURI property, and conduct cross-site scripting (XSS) attacks, via a crafted web site that performs history navigation.

CVSS 3.1 · 6.1 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 13 more
CVE-2014-1531

Mozilla: Use-after-free in imgLoader while resizing images (MFSA 2014-44)

Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving an imgLoader object that is not properly handled during an image-resize operation.

CVSS 3.1 · 8.8 High EPSS 5.6% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 13 more