Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,470

Export CSV
CVE-2013-0745

Mozilla: AutoWrapperChanger fails to keep objects alive during garbage collection (MFSA 2013-08)

The AutoWrapperChanger class in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not properly interact with garbage collection, which allows remote attackers to execute arbitrary code via a crafted HTML document referencing JavaScript objects.

CVSS 2.0 · 9.3 Critical EPSS 4.5% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 6 more
CVE-2013-0746

Mozilla: Compartment mismatch with quickstubs returned values (MFSA 2013-09)

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 do not properly implement quickstubs that use the jsval data type for their return values, which allows remote attackers to execute arbitrary code or cause a denial of service (compartment mismatch and application crash) via crafted JavaScript code that is not properly handled during garbage collection.

CVSS 2.0 · 9.3 Critical EPSS 4.5% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Seamonkey and 13 more
CVE-2013-0747

Mozilla: Event manipulation in plugin handler to bypass same-origin policy (MFSA 2013-10)

The gPluginHandler.handleEvent function in the plugin handler in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not properly enforce the Same Origin Policy, which allows remote attackers to conduct clickjacking attacks via crafted JavaScript code that listens for a mutation event.

CVSS 2.0 · 6.8 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 6 more
CVE-2013-0748

Mozilla: Address space layout leaked in XBL objects (MFSA 2013-11)

The XBL.__proto__.toString implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 makes it easier for remote attackers to bypass the ASLR protection mechanism by calling the toString function of an XBL object.

CVSS 2.0 · 4.3 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Seamonkey and 13 more
CVE-2013-0749

Mozilla: Miscellaneous memory safety hazards (rv:18.0/rv:17.0.1) (MFSA 2013-01)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 9.3 Critical EPSS 5.8% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 6 more
CVE-2013-0755

Mozilla: Use-after-free in Vibrate (MFSA 2013-18)

Use-after-free vulnerability in the mozVibrate implementation in the Vibrate library in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via vectors related to the domDoc pointer.

CVSS 2.0 · 9.3 Critical EPSS 6.9% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 6 more
CVE-2013-0750

Mozilla: Buffer overflow in Javascript string concatenation (MFSA 2013-12)

Integer overflow in the JavaScript implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted string concatenation, leading to improper memory allocation and a heap-based buffer overflow.

CVSS 2.0 · 9.3 Critical EPSS 6.3% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Seamonkey and 13 more
CVE-2013-0752

Mozilla: Memory corruption in XBL with XML bindings containing SVG (MFSA 2013-13)

Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XBL file with multiple bindings that have SVG content.

CVSS 2.0 · 9.3 Critical EPSS 6.6% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 6 more
CVE-2013-0753

Mozilla: Use-after-free in serializeToStream (MFSA 2013-16)

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via crafted web content.

CVSS 2.0 · 9.3 Critical EPSS 51.3% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Seamonkey and 13 more
CVE-2013-0754

Mozilla: Use-after-free in ListenerManager (MFSA 2013-17)

Use-after-free vulnerability in the ListenerManager implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via vectors involving the triggering of garbage collection after memory allocation for listener objects.

CVSS 2.0 · 9.3 Critical EPSS 5.4% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Seamonkey and 13 more
CVE-2013-0756

Mozilla: garbage collection flaw in Javascript Proxy objects (MFSA 2013-19)

Use-after-free vulnerability in the obj_toSource function in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted web page referencing JavaScript Proxy objects that are not properly handled during garbage collection.

CVSS 2.0 · 9.3 Critical EPSS 4.2% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 6 more
CVE-2013-0757

Mozilla: Chrome Object Wrapper (COW) bypass through changing prototype (MFSA 2013-14)

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not prevent modifications to the prototype of an object, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by referencing Object.prototype.__proto__ in a crafted HTML document.

CVSS 2.0 · 9.3 Critical EPSS 60.9% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 6 more
CVE-2013-0758

Mozilla: Chrome Object Wrapper (COW) bypass through plugin objects (MFSA 2013-15)

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging improper interaction between plugin objects and SVG elements.

CVSS 2.0 · 9.3 Critical EPSS 73.4% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Seamonkey and 13 more
CVE-2013-0759

Mozilla: URL spoofing in addressbar during page loads (MFSA 2013-04)

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to spoof the address bar via vectors involving authentication information in the userinfo field of a URL, in conjunction with a 204 (aka No Content) HTTP status code.

CVSS 2.0 · 5.0 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Seamonkey and 13 more
CVE-2013-0760

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

Buffer overflow in the CharDistributionAnalysis::HandleOneChar function in Mozilla Firefox before 18.0, Thunderbird before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted document.

CVSS 2.0 · 9.3 Critical EPSS 5.3% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 6 more
CVE-2013-0761

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

Use-after-free vulnerability in the mozilla::TrackUnionStream::EndTrack implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.4% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 6 more
CVE-2013-0762

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

Use-after-free vulnerability in the imgRequest::OnStopFrame function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.7% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Seamonkey and 13 more
CVE-2013-0763

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

Use-after-free vulnerability in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to Mesa drivers and a resized WebGL canvas.

CVSS 2.0 · 9.3 Critical EPSS 4.4% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Seamonkey and 11 more
CVE-2013-0764

Mozilla: Crash due to handling of SSL on threads (MFSA 2013-07)

The nsSOCKSSocketInfo::ConnectToProxy function in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not ensure thread safety for SSL sessions, which allows remote attackers to execute arbitrary code via crafted data, as demonstrated by e-mail message data.

CVSS 2.0 · 9.3 Critical EPSS 3.1% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 6 more
CVE-2013-0765

Mozilla: Wrapped WebIDL objects can be wrapped again (MFSA 2013-23)

Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 do not prevent multiple wrapping of WebIDL objects, which allows remote attackers to bypass intended access restrictions via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 2.7% KEV · Not listed
Vendors
Canonical Mozilla Opensuse
Products
Ubuntu Linux Firefox Seamonkey and 1 more