Vulnerabilidades de Mozilla
CVEs publicadas que afetam produtos de Mozilla: 642 registro(s), com severidade, exploração e correções.
Firefox 606Thunderbird 523Firefox Mobile 17Firefox ESR 11Firefox Focus 4Focus 3Thunderbird Esr 2Firefox for Android 2Firefox Os 1Seamonkey 1Thin-vec 10din Scanner 1Rhino 1Klar 1Node-convict 1Network Security Services 1
CVE-2022-26485
Alta · 8.8
KEV Alta · 61 Exploit público CWE-416 22/12/2022
Mozilla Firefox Use-After-Free Vulnerability
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
CVE-2022-26486
Crítica · 9.6
KEV Alta · 58 CWE-416 22/12/2022
Mozilla Firefox Use-After-Free Vulnerability
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
CVE-2020-6820
Alta · 8.1
KEV Alta · 55 CWE-362 24/04/2020
Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.
CVE-2020-6819
Alta · 8.1
KEV Alta · 54 CWE-362 24/04/2020
Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.
CVE-2019-17026
Alta · 8.8
KEV Urgente · 70 Exploit público CWE-843 02/03/2020
Mozilla Firefox And Thunderbird Type Confusion Vulnerability
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.
CVE-2019-11708
Crítica · 10.0
KEV Urgente · 74 Exploit público CWE-20 23/07/2019
Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.
CVE-2019-11707
Alta · 8.8
KEV Urgente · 70 Exploit público CWE-843 23/07/2019
Mozilla Firefox and Thunderbird Type Confusion Vulnerability
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.
CVE-2017-5436
Alta · 8.8
CWE-787 11/06/2018
An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite...
An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.
CVE-2016-9079
Alta · 7.5
KEV Urgente · 79 Exploit público CWE-416 11/06/2018
Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
CVE-2016-9063
Crítica · 9.8
CWE-190 11/06/2018
Integer Overflow or Wraparound em Mozilla Firefox
An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.
CVE-2016-0718
Crítica · 9.8
CWE-119 26/05/2016
Buffer Errors (Improper Restriction of Operations within Memory Bounds) em Mozilla Firefox
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
CVE-2015-7575
Média · 5.9
CWE-19 09/01/2016
Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2...
Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.
CVE-2015-4495
Alta · 8.8
KEV Urgente · 76 Exploit público CWE-346 07/08/2015
Mozilla Firefox Security Feature Bypass Vulnerability
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.
CVE-2013-1690
Alta · 8.8
KEV Urgente · 76 Exploit público CWE-119 26/06/2013
Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.
CVE-2013-1675
Média · 6.5
KEV Alta · 52 CWE-665 16/05/2013
Mozilla Firefox Information Disclosure Vulnerability
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
CVE-2011-3389
Média · 4.3
Exploit público CWE-326 06/09/2011
Inadequate Encryption Strength em Google Chrome
The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.
CVE-2010-3765
Crítica · 9.8
KEV Urgente · 83 Exploit público CWE-119 27/10/2010
Mozilla Multiple Products Remote Code Execution Vulnerability
Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.