Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 626

Export CSV
CVE-2014-1481

Mozilla: Inconsistent JavaScript handling of access to Window objects (MFSA 2014-13)

Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to bypass intended restrictions on window objects by leveraging inconsistency in native getter methods across different JavaScript engines.

CVSS 3.1 · 7.5 High EPSS 3.9% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2017-5455

Mozilla: Sandbox escape through internal feed reader APIs (MFSA 2017-12)

The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege if combined with another vulnerability that resulted in remote code execution inside the sandboxed process. This vulnerability affects Firefox ESR < 52.1 and Firefox < 53.

CVSS 3.0 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Enterprise Linux Enterprise Linux Desktop and 4 more
CVE-2014-1482

Mozilla: Incorrect use of discarded images by RasterImage (MFSA 2014-04)

RasterImage.cpp in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent access to discarded data, which allows remote attackers to execute arbitrary code or cause a denial of service (incorrect write operations) via crafted image data, as demonstrated by Goo Create.

CVSS 3.1 · 8.8 High EPSS 6.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2017-5459

Mozilla: Buffer overflow in WebGL (MFSA 2017-11, MFSA 2017-12)

A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.8 Critical EPSS 4.5% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2014-1487

Mozilla: Cross-origin information leak through web workers (MFSA 2014-09)

The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass the Same Origin Policy and obtain sensitive authentication information via vectors involving error messages.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2017-5465

Mozilla: Out-of-bounds read in ConvolvePixel (MFSA 2017-11, MFSA 2017-12)

An out-of-bounds read while processing SVG content in "ConvolvePixel". This results in a crash and also allows for otherwise inaccessible memory being copied into SVG graphic content, which could then displayed. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.0 · 9.1 Critical EPSS 18.2% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2016-9895

Mozilla: CSP bypass using marquee tag (MFSA 2016-94, MFSA 2016-95)

Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

CVSS 3.0 · 6.1 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2016-9900

Mozilla: Restricted external resources can be loaded by SVG images through data URLs (MFSA 2016-94, MFSA 2016-95)

External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs. This could allow for cross-domain data leakage. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

CVSS 3.0 · 7.5 High EPSS 9.6% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-7754

Mozilla: Out-of-bounds read in WebGL with ImageInfo object (MFSA 2017-16)

An out-of-bounds read in WebGL with a maliciously crafted "ImageInfo" object during WebGL operations. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.

CVSS 3.0 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-7750

Mozilla: Use-after-free with track elements (MFSA 2017-16)

A use-after-free vulnerability during video control operations when a "<track>" element holds a reference to an older window if that window has been replaced in the DOM. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.

CVSS 3.0 · 9.8 Critical EPSS 2.8% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2014-1508

Mozilla: Information disclosure through polygon rendering in MathML (MFSA 2014-26)

The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process memory, cause a denial of service (out-of-bounds read and application crash), or possibly bypass the Same Origin Policy via vectors involving MathML polygon rendering.

CVSS 3.1 · 9.1 Critical EPSS 4.2% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 14 more
CVE-2017-7752

Mozilla: Use-after-free with IME input (MFSA 2017-16)

A use-after-free vulnerability during specific user interactions with the input method editor (IME) in some languages due to how events are handled. This results in a potentially exploitable crash but would require specific user interaction to trigger. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.

CVSS 3.0 · 8.8 High EPSS 2.0% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2017-7749

Mozilla: Use-after-free during docshell reloading (MFSA 2017-16)

A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.

CVSS 3.0 · 9.8 Critical EPSS 2.6% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2014-1505

Mozilla: SVG filters information disclosure through feDisplacementMap (MFSA 2014-28)

The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information, and possibly bypass the Same Origin Policy and read text from a different domain, via a timing attack involving feDisplacementMap elements, a related issue to CVE-2013-1693.

CVSS 3.1 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Canonical Debian Mozilla and 4 more
Products
Ubuntu Linux Debian Linux Firefox and 14 more
CVE-2014-1509

Mozilla: Memory corruption in Cairo during PDF font rendering (MFSA 2014-27)

Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, as used in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25, allows remote attackers to execute arbitrary code via a crafted extension that renders fonts in a PDF document.

CVSS 3.1 · 8.8 High EPSS 5.0% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Seamonkey and 13 more
CVE-2017-7751

Mozilla: Use-after-free with content viewer listeners (MFSA 2017-16)

A use-after-free vulnerability with content viewer listeners that results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.

CVSS 3.0 · 9.8 Critical EPSS 2.8% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2014-1510

Mozilla: Privilege escalation using WebIDL-implemented APIs (MFSA 2014-29)

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript code with chrome privileges by using an IDL fragment to trigger a window.open call.

CVSS 3.1 · 9.8 Critical EPSS 82.2% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 14 more
CVE-2016-9898

Mozilla: Use-after-free in Editor while manipulating DOM subtrees (MFSA 2016-94, MFSA 2016-95)

Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

CVSS 3.0 · 9.8 Critical EPSS 3.4% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2014-1511

Mozilla: Privilege escalation using WebIDL-implemented APIs (MFSA 2014-29)

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified vectors.

CVSS 3.1 · 9.8 Critical EPSS 83.5% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 14 more
CVE-2017-7758

Mozilla: Out-of-bounds read in Opus encoder (MFSA 2017-16)

An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.

CVSS 3.0 · 9.1 Critical EPSS 3.0% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more