Mozilla

Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presum

When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @n

During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and

If an image had not loaded correctly (such as when it is not actually an image), it could be dragged and dropped cross-d

Mozilla developers reported memory safety bugs present in Firefox 70. Some of these bugs showed evidence of memory corru

Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed evi

Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could ca

Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race co

When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unpriv

When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploi

The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possi

If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that

A Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in the

An object tag with a data URI did not correctly inherit the document's Content Security Policy. This allowed a CSP bypas

A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission

Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of

Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entit

If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call ar

By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned in

A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploit

An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This co

Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installe

When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequent

Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a sm

Mozilla Firefox 20.0a1 and earlier allows remote attackers to cause a denial of service (crash), related to event handli

A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11

JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox brow

A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a val

When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given. This could all

The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from man

It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a

Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as

A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash. This vulnerability affe

A vulnerability exists in WebRTC where malicious web content can use probing techniques on the getUserMedia API using co

WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even whe

The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user

A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. This

Some HTML elements, such as &lt;title&gt; and &lt;textarea&gt;, can contain literal angle brackets without treating them

Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances

A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and

A compromised sandboxed content process can perform a Universal Cross-site Scripting (UXSS) attack on content from any s

Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox

Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/for

If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as inp

If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction

The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory,

Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68. Some of t

Mozilla developers and community members reported memory safety bugs present in Firefox 68. Some of these bugs showed ev

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved