Redhat

The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege

A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files tha

A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event. The event cou

A possibly exploitable crash triggered during layout and manipulation of bidirectional unicode text in concert with CSS

An out-of-bounds write in "ClearKeyDecryptor" while decrypting some Clearkey-encrypted media content. The "ClearKeyDecry

An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitabl

An out-of-bounds read when an HTTP/2 connection to a servers sends "DATA" frames with incorrect data content. This leads

A vulnerability while parsing "application/http-index-format" format content where uninitialized values are used to crea

A buffer overflow vulnerability while parsing "application/http-index-format" format content when the header contains im

An out-of-bounds write vulnerability while decoding improperly formed BinHex format archives. This vulnerability affects

A use-after-free vulnerability during changes in style when manipulating DOM elements. This results in a potentially exp

A use-after-free vulnerability when holding a selection during scroll events. This results in a potentially exploitable

A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching whi

A use-after-free vulnerability during XSLT processing due to poor handling of template parameters. This results in a pot

A use-after-free vulnerability during XSLT processing due to the result handler being held by a freed handler during han

An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a p

A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions. This

A use-after-free vulnerability occurs when redirecting focus handling which results in a potentially exploitable crash.

A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dr

A use-after-free vulnerability occurs during certain text input selection resulting in a potentially exploitable crash.

Memory safety bugs were reported in Firefox 52, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence o

Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of these bugs

An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest. The fix for this vulnerability di

Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how

Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-o

Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pi

Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. Thi

A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and

A use-after-free can occur when events are fired for a "FontFace" object after the object has been already been destroye

A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error. The resu

JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potenti

Memory safety bugs were reported in Thunderbird 45.7. Some of these bugs showed evidence of memory corruption and we pre

A use-after-free vulnerability in the Media Decoder when working with media files when some events are fired after the m

The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing J

WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, le

URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allo

A potential use-after-free found through fuzzing during DOM manipulation of SVG content. This vulnerability affects Thun

Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address c

Use-after-free while manipulating XSL in XSLT documents. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45

JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. T

Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory corr

A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability af

An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zon

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin o

HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will b

External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of

Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption.

Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor. This vulnerabili

Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a

Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline