FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  526521
Date:      2020-02-19
Time:      18:06:45Z
Committer: kwm

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
b1f7d52f-fc42-48e8-8403-87d4c9d26229mozilla -- multiple vulnerabilities

Mozilla Foundation reports:

CVE-2018-18500: Use-after-free parsing HTML5 stream

CVE-2018-18503: Memory corruption with Audio Buffer

CVE-2018-18504: Memory corruption and out-of-bounds read of texture client buffer

CVE-2018-18505: Privilege escalation through IPC channel messages

CVE-2018-18506: Proxy Auto-Configuration file can define localhost access to be proxied

CVE-2018-18502: Memory safety bugs fixed in Firefox 65

CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5


Discovery 2019-01-29
Entry 2019-01-29
Modified 2019-07-23
firefox
lt 65.0_1,1

waterfox
lt 56.2.7

seamonkey
linux-seamonkey
lt 2.53.0

firefox-esr
lt 60.5.0_1,1

linux-firefox
lt 60.5.0,2

libxul
thunderbird
linux-thunderbird
lt 60.5.0

CVE-2018-18500
CVE-2018-18501
CVE-2018-18502
CVE-2018-18503
CVE-2018-18504
CVE-2018-18505
CVE-2018-18506
https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/
https://www.mozilla.org/en-US/security/advisories/mfsa2019-02/
99029172-8253-407d-9d8b-2cfeab9abf81mozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA-2015-11 Miscellaneous memory safety hazards (rv:36.0 / rv:31.5)

MFSA-2015-12 Invoking Mozilla updater will load locally stored DLL files

MFSA-2015-13 Appended period to hostnames can bypass HPKP and HSTS protections

MFSA-2015-14 Malicious WebGL content crash when writing strings

MFSA-2015-15 TLS TURN and STUN connections silently fail to simple TCP connections

MFSA-2015-16 Use-after-free in IndexedDB

MFSA-2015-17 Buffer overflow in libstagefright during MP4 video playback

MFSA-2015-18 Double-free when using non-default memory allocators with a zero-length XHR

MFSA-2015-19 Out-of-bounds read and write while rendering SVG content

MFSA-2015-20 Buffer overflow during CSS restyling

MFSA-2015-21 Buffer underflow during MP3 playback

MFSA-2015-22 Crash using DrawTarget in Cairo graphics library

MFSA-2015-23 Use-after-free in Developer Console date with OpenType Sanitiser

MFSA-2015-24 Reading of local files through manipulation of form autocomplete

MFSA-2015-25 Local files or privileged URLs in pages can be opened into new tabs

MFSA-2015-26 UI Tour whitelisted sites in background tab can spoof foreground tabs

MFSA-2015-27 Caja Compiler JavaScript sandbox bypass


Discovery 2015-02-24
Entry 2015-02-27
firefox
lt 36.0,1

firefox-esr
lt 31.5.0,1

linux-firefox
lt 36.0,1

linux-seamonkey
lt 2.33

linux-thunderbird
lt 31.5.0

seamonkey
lt 2.33

thunderbird
lt 31.5.0

libxul
lt 31.5.0

CVE-2015-0819
CVE-2015-0820
CVE-2015-0821
CVE-2015-0822
CVE-2015-0823
CVE-2015-0824
CVE-2015-0825
CVE-2015-0826
CVE-2015-0827
CVE-2015-0828
CVE-2015-0829
CVE-2015-0830
CVE-2015-0831
CVE-2015-0832
CVE-2015-0833
CVE-2015-0834
CVE-2015-0835
CVE-2015-0836
https://www.mozilla.org/security/advisories/mfsa2015-11/
https://www.mozilla.org/security/advisories/mfsa2015-12/
https://www.mozilla.org/security/advisories/mfsa2015-13/
https://www.mozilla.org/security/advisories/mfsa2015-14/
https://www.mozilla.org/security/advisories/mfsa2015-15/
https://www.mozilla.org/security/advisories/mfsa2015-16/
https://www.mozilla.org/security/advisories/mfsa2015-17/
https://www.mozilla.org/security/advisories/mfsa2015-18/
https://www.mozilla.org/security/advisories/mfsa2015-19/
https://www.mozilla.org/security/advisories/mfsa2015-20/
https://www.mozilla.org/security/advisories/mfsa2015-21/
https://www.mozilla.org/security/advisories/mfsa2015-22/
https://www.mozilla.org/security/advisories/mfsa2015-23/
https://www.mozilla.org/security/advisories/mfsa2015-24/
https://www.mozilla.org/security/advisories/mfsa2015-25/
https://www.mozilla.org/security/advisories/mfsa2015-26/
https://www.mozilla.org/security/advisories/mfsa2015-27/
https://www.mozilla.org/security/advisories/
aa1aefe3-6e37-47db-bfda-343ef4acb1b5Mozilla -- multiple vulnerabilities

Mozilla Foundation reports:

Please reference CVE/URL list for details


Discovery 2016-08-02
Entry 2016-09-07
Modified 2016-09-20
firefox
lt 48.0,1

seamonkey
linux-seamonkey
lt 2.45

firefox-esr
lt 45.3.0,1

linux-firefox
lt 45.3.0,2

libxul
thunderbird
linux-thunderbird
lt 45.3.0

CVE-2016-0718
CVE-2016-2830
CVE-2016-2835
CVE-2016-2836
CVE-2016-2837
CVE-2016-2838
CVE-2016-2839
CVE-2016-5250
CVE-2016-5251
CVE-2016-5252
CVE-2016-5253
CVE-2016-5254
CVE-2016-5255
CVE-2016-5258
CVE-2016-5259
CVE-2016-5260
CVE-2016-5261
CVE-2016-5262
CVE-2016-5263
CVE-2016-5264
CVE-2016-5265
CVE-2016-5266
CVE-2016-5267
CVE-2016-5268
https://www.mozilla.org/en-US/security/advisories/mfsa2016-62/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-63/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-64/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-65/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-66/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-67/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-68/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-69/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-70/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-71/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-72/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-73/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-74/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-75/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-76/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-77/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-78/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-79/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-80/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-81/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-82/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-83/
https://www.mozilla.org/en-US/security/advisories/mfsa2016-84/
555b244e-6b20-4546-851f-d8eb7d6c1ffamozilla -- multiple vulnerabilities

Mozilla Foundation reports:

Please reference CVE/URL list for details


Discovery 2017-08-08
Entry 2017-08-08
firefox
lt 55.0,1

seamonkey
linux-seamonkey
lt 2.49.1

firefox-esr
lt 52.3.0,1

linux-firefox
lt 52.3.0,2

libxul
thunderbird
linux-thunderbird
lt 52.3.0

CVE-2017-7753
CVE-2017-7779
CVE-2017-7780
CVE-2017-7781
CVE-2017-7782
CVE-2017-7783
CVE-2017-7784
CVE-2017-7785
CVE-2017-7786
CVE-2017-7787
CVE-2017-7788
CVE-2017-7789
CVE-2017-7790
CVE-2017-7791
CVE-2017-7792
CVE-2017-7794
CVE-2017-7796
CVE-2017-7797
CVE-2017-7798
CVE-2017-7799
CVE-2017-7800
CVE-2017-7801
CVE-2017-7802
CVE-2017-7803
CVE-2017-7804
CVE-2017-7806
CVE-2017-7807
CVE-2017-7808
https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/
e60169c4-aa86-46b0-8ae2-0d81f683df09mozilla -- multiple vulnerabilities

Mozilla Foundation reports:

Please reference CVE/URL list for details


Discovery 2017-01-24
Entry 2017-01-24
firefox
lt 51.0_1,1

seamonkey
linux-seamonkey
lt 2.48

firefox-esr
lt 45.7.0,1

linux-firefox
lt 45.7.0,2

libxul
thunderbird
linux-thunderbird
lt 45.7.0

CVE-2017-5373
CVE-2017-5374
CVE-2017-5375
CVE-2017-5376
CVE-2017-5377
CVE-2017-5378
CVE-2017-5379
CVE-2017-5380
CVE-2017-5381
CVE-2017-5382
CVE-2017-5383
CVE-2017-5384
CVE-2017-5385
CVE-2017-5386
CVE-2017-5387
CVE-2017-5388
CVE-2017-5389
CVE-2017-5390
CVE-2017-5391
CVE-2017-5392
CVE-2017-5393
CVE-2017-5394
CVE-2017-5395
CVE-2017-5396
https://www.mozilla.org/security/advisories/mfsa2017-01/
https://www.mozilla.org/security/advisories/mfsa2017-02/
44d9daee-940c-4179-86bb-6e3ffd617869mozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2015-59 Miscellaneous memory safety hazards (rv:39.0 / rv:31.8 / rv:38.1)

MFSA 2015-60 Local files or privileged URLs in pages can be opened into new tabs

MFSA 2015-61 Type confusion in Indexed Database Manager

MFSA 2015-62 Out-of-bound read while computing an oscillator rendering range in Web Audio

MFSA 2015-63 Use-after-free in Content Policy due to microtask execution error

MFSA 2015-64 ECDSA signature validation fails to handle some signatures correctly

MFSA 2015-65 Use-after-free in workers while using XMLHttpRequest

MFSA 2015-66 Vulnerabilities found through code inspection

MFSA 2015-67 Key pinning is ignored when overridable errors are encountered

MFSA 2015-68 OS X crash reports may contain entered key press information

MFSA 2015-69 Privilege escalation through internal workers

MFSA 2015-70 NSS accepts export-length DHE keys with regular DHE cipher suites

MFSA 2015-71 NSS incorrectly permits skipping of ServerKeyExchange


Discovery 2015-07-02
Entry 2015-07-16
Modified 2015-09-22
firefox
lt 39.0,1

linux-firefox
lt 39.0,1

seamonkey
lt 2.35

linux-seamonkey
lt 2.35

firefox-esr
lt 31.8.0,1

ge 38.0,1 lt 38.1.0,1

libxul
lt 31.8.0

ge 38.0 lt 38.1.0

thunderbird
lt 31.8.0

ge 38.0 lt 38.1.0

linux-thunderbird
lt 31.8.0

ge 38.0 lt 38.1.0

CVE-2015-2721
CVE-2015-2722
CVE-2015-2724
CVE-2015-2725
CVE-2015-2726
CVE-2015-2727
CVE-2015-2728
CVE-2015-2729
CVE-2015-2730
CVE-2015-2731
CVE-2015-2733
CVE-2015-2734
CVE-2015-2735
CVE-2015-2736
CVE-2015-2737
CVE-2015-2738
CVE-2015-2739
CVE-2015-2740
CVE-2015-2741
CVE-2015-2742
CVE-2015-2743
CVE-2015-4000
https://www.mozilla.org/security/advisories/mfsa2015-59/
https://www.mozilla.org/security/advisories/mfsa2015-60/
https://www.mozilla.org/security/advisories/mfsa2015-61/
https://www.mozilla.org/security/advisories/mfsa2015-62/
https://www.mozilla.org/security/advisories/mfsa2015-63/
https://www.mozilla.org/security/advisories/mfsa2015-64/
https://www.mozilla.org/security/advisories/mfsa2015-65/
https://www.mozilla.org/security/advisories/mfsa2015-66/
https://www.mozilla.org/security/advisories/mfsa2015-67/
https://www.mozilla.org/security/advisories/mfsa2015-68/
https://www.mozilla.org/security/advisories/mfsa2015-69/
https://www.mozilla.org/security/advisories/mfsa2015-70/
https://www.mozilla.org/security/advisories/mfsa2015-71/
6a09c80e-6ec7-442a-bc65-d72ce69fd887mozilla -- multiple vulnerabilities

Mozilla Foundation reports:

CVE-2017-7845: Buffer overflow when drawing and validating elements with ANGLE library using Direct 3D 9

CVE-2017-7846: JavaScript Execution via RSS in mailbox:// origin

CVE-2017-7847: Local path string can be leaked from RSS feed

CVE-2017-7848: RSS Feed vulnerable to new line Injection

CVE-2017-7829: Mailsploit part 1: From address with encoded null character is cut off in message header display


Discovery 2017-12-22
Entry 2017-12-25
thunderbird
linux-thunderbird
lt 52.5.2

CVE-2017-7829
CVE-2017-7845
CVE-2017-7846
CVE-2017-7847
CVE-2017-7848
https://www.mozilla.org/security/advisories/mfsa2017-30/
7dfed67b-20aa-11e3-b8d8-0025905a4771mozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 / rv:17.0.9)

MFSA 2013-77 Improper state in HTML5 Tree Builder with templates

MFSA 2013-78 Integer overflow in ANGLE library

MFSA 2013-79 Use-after-free in Animation Manager during stylesheet cloning

MFSA 2013-80 NativeKey continues handling key messages after widget is destroyed

MFSA 2013-81 Use-after-free with select element

MFSA 2013-82 Calling scope for new Javascript objects can lead to memory corruption

MFSA 2013-83 Mozilla Updater does not lock MAR file after signature verification

MFSA 2013-84 Same-origin bypass through symbolic links

MFSA 2013-85 Uninitialized data in IonMonkey

MFSA 2013-86 WebGL Information disclosure through OS X NVIDIA graphic drivers

MFSA 2013-87 Shared object library loading from writable location

MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes

MFSA 2013-89 Buffer overflow with multi-column, lists, and floats

MFSA 2013-90 Memory corruption involving scrolling

MFSA 2013-91 User-defined properties on DOM proxies get the wrong "this" object

MFSA 2013-92 GC hazard with default compartments and frame chain restoration


Discovery 2013-08-17
Entry 2013-08-18
Modified 2013-09-19
firefox
gt 18.0,1 lt 24.0,1

lt 17.0.9,1

linux-firefox
lt 17.0.9,1

linux-seamonkey
lt 2.21

linux-thunderbird
lt 17.0.9

seamonkey
lt 2.21

thunderbird
lt 24.0

CVE-2013-1718
CVE-2013-1719
CVE-2013-1720
CVE-2013-1721
CVE-2013-1722
CVE-2013-1723
CVE-2013-1724
CVE-2013-1725
CVE-2013-1726
CVE-2013-1727
CVE-2013-1728
CVE-2013-1729
CVE-2013-1730
CVE-2013-1731
CVE-2013-1732
CVE-2013-1735
CVE-2013-1736
CVE-2013-1737
CVE-2013-1738
https://www.mozilla.org/security/announce/2013/mfsa2013-76.html
https://www.mozilla.org/security/announce/2013/mfsa2013-77.html
https://www.mozilla.org/security/announce/2013/mfsa2013-78.html
https://www.mozilla.org/security/announce/2013/mfsa2013-79.html
https://www.mozilla.org/security/announce/2013/mfsa2013-80.html
https://www.mozilla.org/security/announce/2013/mfsa2013-81.html
https://www.mozilla.org/security/announce/2013/mfsa2013-82.html
https://www.mozilla.org/security/announce/2013/mfsa2013-83.html
https://www.mozilla.org/security/announce/2013/mfsa2013-84.html
https://www.mozilla.org/security/announce/2013/mfsa2013-85.html
https://www.mozilla.org/security/announce/2013/mfsa2013-86.html
https://www.mozilla.org/security/announce/2013/mfsa2013-87.html
https://www.mozilla.org/security/announce/2013/mfsa2013-88.html
https://www.mozilla.org/security/announce/2013/mfsa2013-89.html
https://www.mozilla.org/security/announce/2013/mfsa2013-90.html
https://www.mozilla.org/security/announce/2013/mfsa2013-91.html
https://www.mozilla.org/security/announce/2013/mfsa2013-92.html
http://www.mozilla.org/security/known-vulnerabilities/
5aefc41e-d304-4ec8-8c82-824f84f08244mozilla -- multiple vulnerabilities

Mozilla Foundation reports:

CVE-2018-5183: Backport critical security fixes in Skia

CVE-2018-5154: Use-after-free with SVG animations and clip paths

CVE-2018-5155: Use-after-free with SVG animations and text paths

CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files

CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer

CVE-2018-5159: Integer overflow and out-of-bounds write in Skia

CVE-2018-5160: Uninitialized memory use by WebRTC encoder

CVE-2018-5152: WebExtensions information leak through webRequest API

CVE-2018-5153: Out-of-bounds read in mixed content websocket messages

CVE-2018-5163: Replacing cached data in JavaScript Start-up Bytecode Cache

CVE-2018-5164: CSP not applied to all multipart content sent with multipart/x-mixed-replace

CVE-2018-5166: WebExtension host permission bypass through filterReponseData

CVE-2018-5167: Improper linkification of chrome: and javascript: content in web console and JavaScript debugger

CVE-2018-5168: Lightweight themes can be installed without user interaction

CVE-2018-5169: Dragging and dropping link text onto home button can set home page to include chrome pages

CVE-2018-5172: Pasted script from clipboard can run in the Live Bookmarks page or PDF viewer

CVE-2018-5173: File name spoofing of Downloads panel with Unicode characters

CVE-2018-5174: Windows Defender SmartScreen UI runs with less secure behavior for downloaded files in Windows 10 April 2018 Update

CVE-2018-5175: Universal CSP bypass on sites using strict-dynamic in their policies

CVE-2018-5176: JSON Viewer script injection

CVE-2018-5177: Buffer overflow in XSLT during number formatting

CVE-2018-5165: Checkbox for enabling Flash protected mode is inverted in 32-bit Firefox

CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension

CVE-2018-5180: heap-use-after-free in mozilla::WebGLContext::DrawElementsInstanced

CVE-2018-5181: Local file can be displayed in noopener tab through drag and drop of hyperlink

CVE-2018-5182: Local file can be displayed from hyperlink dragged and dropped on addressbar

CVE-2018-5151: Memory safety bugs fixed in Firefox 60

CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8


Discovery 2018-05-09
Entry 2018-05-09
firefox
lt 60.0,1

waterfox
lt 56.1.0_18

seamonkey
linux-seamonkey
lt 2.49.4

firefox-esr
lt 52.8.0,1

linux-firefox
lt 52.8.0,2

libxul
thunderbird
linux-thunderbird
lt 52.8.0

CVE-2018-5150
CVE-2018-5151
CVE-2018-5152
CVE-2018-5153
CVE-2018-5154
CVE-2018-5155
CVE-2018-5157
CVE-2018-5158
CVE-2018-5159
CVE-2018-5160
CVE-2018-5163
CVE-2018-5164
CVE-2018-5165
CVE-2018-5166
CVE-2018-5167
CVE-2018-5168
CVE-2018-5169
CVE-2018-5172
CVE-2018-5173
CVE-2018-5174
CVE-2018-5175
CVE-2018-5176
CVE-2018-5177
CVE-2018-5178
CVE-2018-5180
CVE-2018-5181
CVE-2018-5182
CVE-2018-5183
https://www.mozilla.org/security/advisories/mfsa2018-11/
https://www.mozilla.org/security/advisories/mfsa2018-12/
c4f39920-781f-4aeb-b6af-17ed566c4272mozilla -- multiple vulnerabilities

Mozilla Foundation reports:

CVE-2018-12386: Type confusion in JavaScript

A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution inside the sandboxed content process when triggered.

CVE-2018-12387:

A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout. This leaks a memory address to the calling function which can be used as part of an exploit inside the sandboxed content process.


Discovery 2018-10-02
Entry 2018-10-02
Modified 2019-07-23
firefox
lt 62.0.3,1

waterfox
lt 56.2.4

seamonkey
linux-seamonkey
lt 2.53.0

firefox-esr
lt 60.2.2,1

linux-firefox
lt 60.2.2,2

libxul
thunderbird
linux-thunderbird
lt 60.2.2

CVE-2018-12386
CVE-2018-12387
https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/
7943794f-707f-4e31-9fea-3bbf1ddcedc1mozilla -- multiple vulnerabilities

The Mozilla Foundation reports:

CVE-2018-5146: Out of bounds memory write in libvorbis

An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest.

CVE-2018-5147: Out of bounds memory write in libtremor

The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms.


Discovery 2018-03-16
Entry 2018-03-16
Modified 2018-03-31
libvorbis
lt 1.3.6,3

libtremor
lt 1.2.1.s20180316

firefox
lt 59.0.1,1

waterfox
lt 56.0.4.36_3

seamonkey
linux-seamonkey
lt 2.49.3

firefox-esr
lt 52.7.2,1

linux-firefox
lt 52.7.2,2

libxul
lt 52.7.3

thunderbird
linux-thunderbird
lt 52.7.0

CVE-2018-5146
CVE-2018-5147
https://www.mozilla.org/security/advisories/mfsa2018-08/
https://www.mozilla.org/security/advisories/mfsa2018-09/
1bcfd963-e483-41b8-ab8e-bad5c3ce49c9brotli -- buffer overflow

Google Chrome Releases reports:

[583607] High CVE-2016-1624: Buffer overflow in Brotli. Credit to lukezli.

Mozilla Foundation reports:

Security researcher Luke Li reported a pointer underflow bug in the Brotli library's decompression that leads to a buffer overflow. This results in a potentially exploitable crash when triggered.


Discovery 2016-02-08
Entry 2016-03-08
Modified 2016-03-08
brotli
ge 0.3.0 lt 0.3.0_1

lt 0.2.0_2

libbrotli
lt 0.3.0_3

chromium
chromium-npapi
chromium-pulse
lt 48.0.2564.109

firefox
linux-firefox
lt 45.0,1

seamonkey
linux-seamonkey
lt 2.42

firefox-esr
lt 38.7.0,1

libxul
thunderbird
linux-thunderbird
lt 38.7.0

CVE-2016-1624
CVE-2016-1968
https://github.com/google/brotli/commit/37a320dd81db8d546cd24a45b4c61d87b45dcade
https://chromium.googlesource.com/chromium/src/+/7716418a27d561ee295a99f11fd3865580748de2%5E!/
https://www.mozilla.org/security/advisories/mfsa2016-30/
https://hg.mozilla.org/releases/mozilla-release/rev/4a5d8ade4e3e
610de647-af8d-11e3-a25b-b4b52fce4ce8mozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2014-15 Miscellaneous memory safety hazards (rv:28.0 / rv:24.4)

MFSA 2014-16 Files extracted during updates are not always read only

MFSA 2014-17 Out of bounds read during WAV file decoding

MFSA 2014-18 crypto.generateCRMFRequest does not validate type of key

MFSA 2014-19 Spoofing attack on WebRTC permission prompt

MFSA 2014-20 onbeforeunload and Javascript navigation DOS

MFSA 2014-21 Local file access via Open Link in new tab

MFSA 2014-22 WebGL content injection from one domain to rendering in another

MFSA 2014-23 Content Security Policy for data: documents not preserved by session restore

MFSA 2014-24 Android Crash Reporter open to manipulation

MFSA 2014-25 Firefox OS DeviceStorageFile object vulnerable to relative path escape

MFSA 2014-26 Information disclosure through polygon rendering in MathML

MFSA 2014-27 Memory corruption in Cairo during PDF font rendering

MFSA 2014-28 SVG filters information disclosure through feDisplacementMap

MFSA 2014-29 Privilege escalation using WebIDL-implemented APIs

MFSA 2014-30 Use-after-free in TypeObject

MFSA 2014-31 Out-of-bounds read/write through neutering ArrayBuffer objects

MFSA 2014-32 Out-of-bounds write through TypedArrayObject after neutering


Discovery 2014-03-19
Entry 2014-03-19
Modified 2014-03-20
firefox
lt 28.0,1

firefox-esr
lt 24.4.0,1

linux-firefox
lt 28.0,1

linux-seamonkey
lt 2.25

linux-thunderbird
lt 24.4.0

seamonkey
lt 2.25

thunderbird
lt 24.4.0

CVE-2014-1493
CVE-2014-1494
CVE-2014-1496
CVE-2014-1497
CVE-2014-1498
CVE-2014-1499
CVE-2014-1500
CVE-2014-1501
CVE-2014-1502
CVE-2014-1504
CVE-2014-1505
CVE-2014-1506
CVE-2014-1507
CVE-2014-1508
CVE-2014-1509
CVE-2014-1510
CVE-2014-1511
CVE-2014-1512
CVE-2014-1513
CVE-2014-1514
https://www.mozilla.org/security/announce/2014/mfsa2014-15.html
https://www.mozilla.org/security/announce/2014/mfsa2014-16.html
https://www.mozilla.org/security/announce/2014/mfsa2014-17.html
https://www.mozilla.org/security/announce/2014/mfsa2014-18.html
https://www.mozilla.org/security/announce/2014/mfsa2014-19.html
https://www.mozilla.org/security/announce/2014/mfsa2014-20.html
https://www.mozilla.org/security/announce/2014/mfsa2014-21.html
https://www.mozilla.org/security/announce/2014/mfsa2014-22.html
https://www.mozilla.org/security/announce/2014/mfsa2014-23.html
https://www.mozilla.org/security/announce/2014/mfsa2014-24.html
https://www.mozilla.org/security/announce/2014/mfsa2014-25.html
https://www.mozilla.org/security/announce/2014/mfsa2014-26.html
https://www.mozilla.org/security/announce/2014/mfsa2014-27.html
https://www.mozilla.org/security/announce/2014/mfsa2014-28.html
https://www.mozilla.org/security/announce/2014/mfsa2014-29.html
https://www.mozilla.org/security/announce/2014/mfsa2014-30.html
https://www.mozilla.org/security/announce/2014/mfsa2014-31.html
https://www.mozilla.org/security/announce/2014/mfsa2014-32.html
http://www.mozilla.org/security/known-vulnerabilities/
6cec1b0a-da15-467d-8691-1dea392d4c8dmozilla -- multiple vulnerabilities

Mozilla Foundation reports:

Please reference CVE/URL list for details


Discovery 2017-06-13
Entry 2017-06-13
Modified 2017-09-19
firefox
lt 54.0,1

seamonkey
linux-seamonkey
lt 2.49.1

firefox-esr
lt 52.2.0,1

linux-firefox
lt 52.2.0,2

libxul
thunderbird
linux-thunderbird
lt 52.2.0

CVE-2017-5470
CVE-2017-5471
CVE-2017-5472
CVE-2017-7749
CVE-2017-7750
CVE-2017-7751
CVE-2017-7752
CVE-2017-7754
CVE-2017-7755
CVE-2017-7756
CVE-2017-7757
CVE-2017-7758
CVE-2017-7759
CVE-2017-7760
CVE-2017-7761
CVE-2017-7762
CVE-2017-7763
CVE-2017-7764
CVE-2017-7765
CVE-2017-7766
CVE-2017-7767
CVE-2017-7768
CVE-2017-7778
https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/
https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/
7c3a02b9-3273-4426-a0ba-f90fad2ff72emozilla -- multiple vulnerabilities

Mozilla Foundation reports:

CVE-2018-12391: HTTP Live Stream audio data is accessible cross-origin

CVE-2018-12392: Crash with nested event loops

CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript

CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting

CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts

CVE-2018-12397:

CVE-2018-12398: CSP bypass through stylesheet injection in resource URIs

CVE-2018-12399: Spoofing of protocol registration notification bar

CVE-2018-12400: Favicons are cached in private browsing mode on Firefox for Android

CVE-2018-12401: DOS attack through special resource URI parsing

CVE-2018-12402: SameSite cookies leak when pages are explicitly saved

CVE-2018-12403: Mixed content warning is not displayed when HTTPS page loads a favicon over HTTP

CVE-2018-12388: Memory safety bugs fixed in Firefox 63

CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3


Discovery 2018-10-23
Entry 2018-10-23
Modified 2019-07-23
firefox
lt 63.0_1,1

waterfox
lt 56.2.5

seamonkey
linux-seamonkey
lt 2.53.0

firefox-esr
lt 60.3.0,1

linux-firefox
lt 60.3.0,2

libxul
thunderbird
linux-thunderbird
lt 60.3.0

CVE-2018-12388
CVE-2018-12390
CVE-2018-12391
CVE-2018-12392
CVE-2018-12393
CVE-2018-12395
CVE-2018-12396
CVE-2018-12397
CVE-2018-12398
CVE-2018-12399
CVE-2018-12400
CVE-2018-12401
CVE-2018-12402
CVE-2018-12403
https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/
https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/
c96d416a-eae7-4d5d-bc84-40deca9329fbmozilla -- multiple vulnerabilities

Mozilla Foundation reports:

CVE-2018-12377: Use-after-free in refresh driver timers

CVE-2018-12378: Use-after-free in IndexedDB

CVE-2018-12379: Out-of-bounds write with malicious MAR file

CVE-2017-16541: Proxy bypass using automount and autofs

CVE-2018-12381: Dragging and dropping Outlook email message results in page navigation

CVE-2018-12382: Addressbar spoofing with javascript URI on Firefox for Android

CVE-2018-12383: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords

CVE-2018-12375: Memory safety bugs fixed in Firefox 62

CVE-2018-12376: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2


Discovery 2018-09-05
Entry 2018-09-05
Modified 2018-09-15
firefox
lt 62.0_1,1

waterfox
lt 56.2.3

seamonkey
linux-seamonkey
lt 2.49.5

firefox-esr
lt 60.2.0_1,1

linux-firefox
lt 60.2.0,2

libxul
thunderbird
linux-thunderbird
lt 60.2

CVE-2017-16541
CVE-2018-12375
CVE-2018-12376
CVE-2018-12377
CVE-2018-12378
CVE-2018-12379
CVE-2018-12381
CVE-2018-12382
CVE-2018-12383
https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/
https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/
888a0262-f0d9-11e3-ba0c-b4b52fce4ce8mozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2014-48 Miscellaneous memory safety hazards (rv:30.0 / rv:24.6)

MFSA 2014-49 Use-after-free and out of bounds issues found using Address Sanitizer

MFSA 2014-51 Use-after-free in Event Listener Manager

MFSA 2014-52 Use-after-free with SMIL Animation Controller

MFSA 2014-53 Buffer overflow in Web Audio Speex resampler

MFSA 2014-54 Buffer overflow in Gamepad API

MFSA 2014-55 Out of bounds write in NSPR


Discovery 2014-06-10
Entry 2014-06-10
firefox
lt 30.0,1

firefox-esr
lt 24.6.0,1

seamonkey
lt 2.26.1

linux-firefox
lt 30.0,1

linux-seamonkey
lt 2.26.1

linux-thunderbird
lt 24.6.0

nspr
lt 4.10.6

thunderbird
lt 24.6.0

CVE-2014-1533
CVE-2014-1534
CVE-2014-1536
CVE-2014-1537
CVE-2014-1540
CVE-2014-1541
CVE-2014-1542
CVE-2014-1543
CVE-2014-1545
https://www.mozilla.org/security/announce/2014/mfsa2014-48.html
https://www.mozilla.org/security/announce/2014/mfsa2014-49.html
https://www.mozilla.org/security/announce/2014/mfsa2014-51.html
https://www.mozilla.org/security/announce/2014/mfsa2014-52.html
https://www.mozilla.org/security/announce/2014/mfsa2014-53.html
https://www.mozilla.org/security/announce/2014/mfsa2014-54.html
https://www.mozilla.org/security/announce/2014/mfsa2014-55.html
44b6dfbf-4ef7-4d52-ad52-2b1b05d81272mozilla -- multiple vulnerabilities

Mozilla Foundation reports:

CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS

CVE-2019-9816: Type confusion with object groups and UnboxedObjects

CVE-2019-9817: Stealing of cross-domain images using canvas

CVE-2019-9818: Use-after-free in crash generation server

CVE-2019-9819: Compartment mismatch with fetch API

CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell

CVE-2019-9821: Use-after-free in AssertWorkerThread

CVE-2019-11691: Use-after-free in XMLHttpRequest

CVE-2019-11692: Use-after-free removing listeners in the event listener manager

CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux

CVE-2019-7317: Use-after-free in png_image_free of libpng library

CVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox

CVE-2019-11695: Custom cursor can render over user interface outside of web content

CVE-2019-11696: Java web start .JNLP files are not recognized as executable files for download prompts

CVE-2019-11697: Pressing key combinations can bypass installation prompt delays and install extensions

CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks

CVE-2019-11700: res: protocol can be used to open known local files

CVE-2019-11699: Incorrect domain name highlighting during page navigation

CVE-2019-11701: webcal: protocol default handler loads vulnerable web page

CVE-2019-9814: Memory safety bugs fixed in Firefox 67

CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7


Discovery 2019-05-21
Entry 2019-05-22
Modified 2019-07-23
firefox
lt 67.0,1

waterfox
lt 56.2.10

seamonkey
linux-seamonkey
lt 2.53.0

firefox-esr
lt 60.7.0,1

linux-firefox
lt 60.7.0,2

libxul
thunderbird
linux-thunderbird
lt 60.7.0

CVE-2019-9815
CVE-2019-9816
CVE-2019-9817
CVE-2019-9818
CVE-2019-9819
CVE-2019-9820
CVE-2019-9821
CVE-2019-11691
CVE-2019-11692
CVE-2019-11693
CVE-2019-7317
CVE-2019-11694
CVE-2019-11695
CVE-2019-11696
CVE-2019-11697
CVE-2019-11698
CVE-2019-11700
CVE-2019-11699
CVE-2019-11701
CVE-2019-9814
CVE-2019-9800
https://www.mozilla.org/security/advisories/mfsa2019-13/
https://www.mozilla.org/security/advisories/mfsa2019-14/
https://www.mozilla.org/security/advisories/mfsa2019-15/
05463e0a-abd3-4fa4-bd5f-cd5ed132d4c6mozilla -- multiple vulnerabilities

Mozilla Foundation reports:

CVE-2019-11751: Malicious code execution through command line parameters

CVE-2019-11746: Use-after-free while manipulating video

CVE-2019-11744: XSS by breaking out of title and textarea elements using innerHTML

CVE-2019-11742: Same-origin policy violation with SVG filters and canvas to steal cross-origin images

CVE-2019-11736: File manipulation and privilege escalation in Mozilla Maintenance Service

CVE-2019-11753: Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location

CVE-2019-11752: Use-after-free while extracting a key value in IndexedDB

CVE-2019-9812: Sandbox escape through Firefox Sync

CVE-2019-11741: Isolate addons.mozilla.org and accounts.firefox.com

CVE-2019-11743: Cross-origin access to unload event attributes

CVE-2019-11748: Persistence of WebRTC permissions in a third party context

CVE-2019-11749: Camera information available without prompting using getUserMedia

CVE-2019-5849: Out-of-bounds read in Skia

CVE-2019-11750: Type confusion in Spidermonkey

CVE-2019-11737: Content security policy directives ignore port and path if host is a wildcard

CVE-2019-11738: Content security policy bypass through hash-based sources in directives

CVE-2019-11747: 'Forget about this site' removes sites from pre-loaded HSTS list

CVE-2019-11734: Memory safety bugs fixed in Firefox 69

CVE-2019-11735: Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1

CVE-2019-11740: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9


Discovery 2019-09-03
Entry 2019-09-03
firefox
lt 69.0,1

waterfox
lt 56.2.14

seamonkey
linux-seamonkey
lt 2.53.0

firefox-esr
ge 61.0,1 lt 68.1.0,1

lt 60.9.0,1

linux-firefox
ge 61.0,2 lt 68.1.0,2

lt 60.9.0,2

libxul
thunderbird
linux-thunderbird
ge 61.0 lt 68.1.0

lt 60.9.0

CVE-2019-11734
CVE-2019-11735
CVE-2019-11736
CVE-2019-11737
CVE-2019-11738
CVE-2019-11740
CVE-2019-11741
CVE-2019-11742
CVE-2019-11743
CVE-2019-11744
CVE-2019-11746
CVE-2019-11747
CVE-2019-11748
CVE-2019-11749
CVE-2019-11750
CVE-2019-11751
CVE-2019-11752
CVE-2019-11753
CVE-2019-5849
CVE-2019-9812
https://www.mozilla.org/security/advisories/mfsa2019-25/
https://www.mozilla.org/security/advisories/mfsa2019-26/
https://www.mozilla.org/security/advisories/mfsa2019-27/
dd116b19-64b3-11e3-868f-0025905a4771mozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2013-116 JPEG information leak

MFSA 2013-105 Application Installation doorhanger persists on navigation

MFSA 2013-106 Character encoding cross-origin XSS attack

MFSA 2013-107 Sandbox restrictions not applied to nested object elements

MFSA 2013-108 Use-after-free in event listeners

MFSA 2013-109 Use-after-free during Table Editing

MFSA 2013-110 Potential overflow in JavaScript binary search algorithms

MFSA 2013-111 Segmentation violation when replacing ordered list elements

MFSA 2013-112 Linux clipboard information disclosure though selection paste

MFSA 2013-113 Trust settings for built-in roots ignored during EV certificate validation

MFSA 2013-114 Use-after-free in synthetic mouse movement

MFSA 2013-115 GetElementIC typed array stubs can be generated outside observed typesets

MFSA 2013-116 JPEG information leak

MFSA 2013-117 Mis-issued ANSSI/DCSSI certificate


Discovery 2013-12-09
Entry 2013-12-14
firefox
gt 25.0,1 lt 26.0,1

lt 24.2.0,1

linux-firefox
lt 26.0,1

linux-seamonkey
lt 2.23

linux-thunderbird
lt 24.2.0

seamonkey
lt 2.23

thunderbird
lt 24.2.0

CVE-2013-5619
CVE-2013-6629
CVE-2013-5615
CVE-2013-5616
CVE-2013-5618
CVE-2013-5609
CVE-2013-5610
CVE-2013-5611
CVE-2013-5612
CVE-2013-5613
CVE-2013-5614
CVE-2013-6630
CVE-2013-6671
CVE-2013-6672
CVE-2013-6673
https://www.mozilla.org/security/announce/2013/mfsa2013-104.html
https://www.mozilla.org/security/announce/2013/mfsa2013-105.html
https://www.mozilla.org/security/announce/2013/mfsa2013-106.html
https://www.mozilla.org/security/announce/2013/mfsa2013-107.html
https://www.mozilla.org/security/announce/2013/mfsa2013-108.html
https://www.mozilla.org/security/announce/2013/mfsa2013-109.html
https://www.mozilla.org/security/announce/2013/mfsa2013-110.html
https://www.mozilla.org/security/announce/2013/mfsa2013-111.html
https://www.mozilla.org/security/announce/2013/mfsa2013-112.html
https://www.mozilla.org/security/announce/2013/mfsa2013-113.html
https://www.mozilla.org/security/announce/2013/mfsa2013-114.html
https://www.mozilla.org/security/announce/2013/mfsa2013-115.html
https://www.mozilla.org/security/announce/2013/mfsa2013-116.html
https://www.mozilla.org/security/announce/2013/mfsa2013-117.html
http://www.mozilla.org/security/known-vulnerabilities/
978b0f76-122d-11e4-afe3-bc5ff4fb5e7bmozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2014-66 IFRAME sandbox same-origin access through redirect

MFSA 2014-65 Certificate parsing broken by non-standard character encoding

MFSA 2014-64 Crash in Skia library when scaling high quality images

MFSA 2014-63 Use-after-free while when manipulating certificates in the trusted cache

MFSA 2014-62 Exploitable WebGL crash with Cesium JavaScript library

MFSA 2014-61 Use-after-free with FireOnStateChange event

MFSA 2014-60 Toolbar dialog customization event spoofing

MFSA 2014-59 Use-after-free in DirectWrite font handling

MFSA 2014-58 Use-after-free in Web Audio due to incorrect control message ordering

MFSA 2014-57 Buffer overflow during Web Audio buffering for playback

MFSA 2014-56 Miscellaneous memory safety hazards (rv:31.0 / rv:24.7)


Discovery 2014-07-22
Entry 2014-07-23
firefox
lt 31.0,1

firefox-esr
lt 24.7.0,1

linux-firefox
lt 31.0,1

linux-thunderbird
lt 24.7.0

thunderbird
lt 24.7.0

nss
lt 3.16.1_2

CVE-2014-1544
CVE-2014-1547
CVE-2014-1548
CVE-2014-1549
CVE-2014-1550
CVE-2014-1551
CVE-2014-1552
CVE-2014-1555
CVE-2014-1556
CVE-2014-1557
CVE-2014-1558
CVE-2014-1559
CVE-2014-1560
CVE-2014-1561
https://www.mozilla.org/security/announce/2014/mfsa2014-56.html
https://www.mozilla.org/security/announce/2014/mfsa2014-57.html
https://www.mozilla.org/security/announce/2014/mfsa2014-58.html
https://www.mozilla.org/security/announce/2014/mfsa2014-59.html
https://www.mozilla.org/security/announce/2014/mfsa2014-60.html
https://www.mozilla.org/security/announce/2014/mfsa2014-61.html
https://www.mozilla.org/security/announce/2014/mfsa2014-62.html
https://www.mozilla.org/security/announce/2014/mfsa2014-63.html
https://www.mozilla.org/security/announce/2014/mfsa2014-64.html
https://www.mozilla.org/security/announce/2014/mfsa2014-65.html
https://www.mozilla.org/security/announce/2014/mfsa2014-66.html
https://www.mozilla.org/security/announce/
e3f0374a-7ad6-11e2-84cd-d43d7e0c7c02mozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2013-21 Miscellaneous memory safety hazards (rv:19.0 / rv:17.0.3)

MFSA 2013-22 Out-of-bounds read in image rendering

MFSA 2013-23 Wrapped WebIDL objects can be wrapped again

MFSA 2013-24 Web content bypass of COW and SOW security wrappers

MFSA 2013-25 Privacy leak in JavaScript Workers

MFSA 2013-26 Use-after-free in nsImageLoadingContent

MFSA 2013-27 Phishing on HTTPS connection through malicious proxy

MFSA 2013-28 Use-after-free, out of bounds read, and buffer overflow issues found using Address Sanitizer


Discovery 2013-02-19
Entry 2013-02-19
Modified 2013-02-20
firefox
gt 18.0,1 lt 19.0,1

lt 17.0.3,1

linux-firefox
lt 17.0.3,1

linux-seamonkey
lt 2.16

linux-thunderbird
lt 17.0.3

seamonkey
lt 2.16

thunderbird
gt 11.0 lt 17.0.3

lt 10.0.12

libxul
gt 1.9.2.* lt 10.0.12

CVE-2013-0765
CVE-2013-0772
CVE-2013-0773
CVE-2013-0774
CVE-2013-0775
CVE-2013-0776
CVE-2013-0783
CVE-2013-0784
http://www.mozilla.org/security/announce/2013/mfsa2013-20.html
http://www.mozilla.org/security/announce/2013/mfsa2013-21.html
http://www.mozilla.org/security/announce/2013/mfsa2013-22.html
http://www.mozilla.org/security/announce/2013/mfsa2013-23.html
http://www.mozilla.org/security/announce/2013/mfsa2013-24.html
http://www.mozilla.org/security/announce/2013/mfsa2013-25.html
http://www.mozilla.org/security/announce/2013/mfsa2013-26.html
http://www.mozilla.org/security/announce/2013/mfsa2013-27.html
http://www.mozilla.org/security/known-vulnerabilities/
9d04936c-75f1-4a2c-9ade-4c1708be5df9mozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2015-133 NSS and NSPR memory corruption issues

MFSA 2015-132 Mixed content WebSocket policy bypass through workers

MFSA 2015-131 Vulnerabilities found through code inspection

MFSA 2015-130 JavaScript garbage collection crash with Java applet

MFSA 2015-129 Certain escaped characters in host of Location-header are being treated as non-escaped

MFSA 2015-128 Memory corruption in libjar through zip files

MFSA 2015-127 CORS preflight is bypassed when non-standard Content-Type headers are received

MFSA 2015-126 Crash when accessing HTML tables with accessibility tools on OS X

MFSA 2015-125 XSS attack through intents on Firefox for Android

MFSA 2015-124 Android intents can be used on Firefox for Android to open privileged files

MFSA 2015-123 Buffer overflow during image interactions in canvas

MFSA 2015-122 Trailing whitespace in IP address hostnames can bypass same-origin policy

MFSA 2015-121 Disabling scripts in Add-on SDK panels has no effect

MFSA 2015-120 Reading sensitive profile files through local HTML file on Android

MFSA 2015-119 Firefox for Android addressbar can be removed after fullscreen mode

MFSA 2015-118 CSP bypass due to permissive Reader mode whitelist

MFSA 2015-117 Information disclosure through NTLM authentication

MFSA 2015-116 Miscellaneous memory safety hazards (rv:42.0 / rv:38.4)


Discovery 2015-11-03
Entry 2015-11-19
Modified 2016-04-13
nspr
lt 4.10.10

linux-c6-nspr
lt 4.10.10

nss
ge 3.20 lt 3.20.1

ge 3.19.3 lt 3.19.4

lt 3.19.2.1

firefox
lt 42.0,1

linux-firefox
lt 42.0,1

seamonkey
lt 2.39

linux-seamonkey
lt 2.39

firefox-esr
lt 38.4.0,1

libxul
lt 38.4.0

thunderbird
lt 38.4.0

linux-thunderbird
lt 38.4.0

CVE-2015-4513
CVE-2015-4514
CVE-2015-4515
CVE-2015-4518
CVE-2015-7181
CVE-2015-7182
CVE-2015-7183
CVE-2015-7185
CVE-2015-7186
CVE-2015-7187
CVE-2015-7188
CVE-2015-7189
CVE-2015-7190
CVE-2015-7191
CVE-2015-7192
CVE-2015-7193
CVE-2015-7194
CVE-2015-7195
CVE-2015-7196
CVE-2015-7197
CVE-2015-7198
CVE-2015-7199
CVE-2015-7200
https://www.mozilla.org/security/advisories/mfsa2015-116/
https://www.mozilla.org/security/advisories/mfsa2015-117/
https://www.mozilla.org/security/advisories/mfsa2015-118/
https://www.mozilla.org/security/advisories/mfsa2015-119/
https://www.mozilla.org/security/advisories/mfsa2015-120/
https://www.mozilla.org/security/advisories/mfsa2015-121/
https://www.mozilla.org/security/advisories/mfsa2015-122/
https://www.mozilla.org/security/advisories/mfsa2015-123/
https://www.mozilla.org/security/advisories/mfsa2015-124/
https://www.mozilla.org/security/advisories/mfsa2015-125/
https://www.mozilla.org/security/advisories/mfsa2015-126/
https://www.mozilla.org/security/advisories/mfsa2015-127/
https://www.mozilla.org/security/advisories/mfsa2015-128/
https://www.mozilla.org/security/advisories/mfsa2015-129/
https://www.mozilla.org/security/advisories/mfsa2015-130/
https://www.mozilla.org/security/advisories/mfsa2015-131/
https://www.mozilla.org/security/advisories/mfsa2015-132/
https://www.mozilla.org/security/advisories/mfsa2015-133/
2d56c7f4-b354-428f-8f48-38150c607a05mozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2015-96 Miscellaneous memory safety hazards (rv:41.0 / rv:38.3)

MFSA 2015-97 Memory leak in mozTCPSocket to servers

MFSA 2015-98 Out of bounds read in QCMS library with ICC V4 profile attributes

MFSA 2015-99 Site attribute spoofing on Android by pasting URL with unknown scheme

MFSA 2015-100 Arbitrary file manipulation by local user through Mozilla updater

MFSA 2015-101 Buffer overflow in libvpx while parsing vp9 format video

MFSA 2015-102 Crash when using debugger with SavedStacks in JavaScript

MFSA 2015-103 URL spoofing in reader mode

MFSA 2015-104 Use-after-free with shared workers and IndexedDB

MFSA 2015-105 Buffer overflow while decoding WebM video

MFSA 2015-106 Use-after-free while manipulating HTML media content

MFSA 2015-107 Out-of-bounds read during 2D canvas display on Linux 16-bit color depth systems

MFSA 2015-108 Scripted proxies can access inner window

MFSA 2015-109 JavaScript immutable property enforcement can be bypassed

MFSA 2015-110 Dragging and dropping images exposes final URL after redirects

MFSA 2015-111 Errors in the handling of CORS preflight request headers

MFSA 2015-112 Vulnerabilities found through code inspection

MFSA 2015-113 Memory safety errors in libGLES in the ANGLE graphics library

MFSA 2015-114 Information disclosure via the High Resolution Time API


Discovery 2015-09-22
Entry 2015-09-22
firefox
lt 41.0,1

linux-firefox
lt 41.0,1

seamonkey
lt 2.38

linux-seamonkey
lt 2.38

firefox-esr
lt 38.3.0,1

libxul
lt 38.3.0

thunderbird
lt 38.3.0

linux-thunderbird
lt 38.3.0

CVE-2015-4476
CVE-2015-4500
CVE-2015-4501
CVE-2015-4502
CVE-2015-4503
CVE-2015-4504
CVE-2015-4505
CVE-2015-4506
CVE-2015-4507
CVE-2015-4508
CVE-2015-4509
CVE-2015-4510
CVE-2015-4512
CVE-2015-4516
CVE-2015-4517
CVE-2015-4519
CVE-2015-4520
CVE-2015-4521
CVE-2015-4522
CVE-2015-7174
CVE-2015-7175
CVE-2015-7176
CVE-2015-7177
CVE-2015-7178
CVE-2015-7179
CVE-2015-7180
https://www.mozilla.org/security/advisories/mfsa2015-96/
https://www.mozilla.org/security/advisories/mfsa2015-97/
https://www.mozilla.org/security/advisories/mfsa2015-98/
https://www.mozilla.org/security/advisories/mfsa2015-99/
https://www.mozilla.org/security/advisories/mfsa2015-100/
https://www.mozilla.org/security/advisories/mfsa2015-101/
https://www.mozilla.org/security/advisories/mfsa2015-102/
https://www.mozilla.org/security/advisories/mfsa2015-103/
https://www.mozilla.org/security/advisories/mfsa2015-104/
https://www.mozilla.org/security/advisories/mfsa2015-105/
https://www.mozilla.org/security/advisories/mfsa2015-106/
https://www.mozilla.org/security/advisories/mfsa2015-107/
https://www.mozilla.org/security/advisories/mfsa2015-108/
https://www.mozilla.org/security/advisories/mfsa2015-109/
https://www.mozilla.org/security/advisories/mfsa2015-110/
https://www.mozilla.org/security/advisories/mfsa2015-111/
https://www.mozilla.org/security/advisories/mfsa2015-112/
https://www.mozilla.org/security/advisories/mfsa2015-113/
https://www.mozilla.org/security/advisories/mfsa2015-114/
96eca031-1313-4daf-9be2-9d6e1c4f1eb5mozilla -- multiple vulnerabilities

Mozilla Foundation reports:

Please reference CVE/URL list for details


Discovery 2017-03-07
Entry 2017-03-07
firefox
lt 52.0_1,1

seamonkey
linux-seamonkey
lt 2.49

firefox-esr
ge 46.0,1 lt 52.0,1

lt 45.8.0_1,1

linux-firefox
ge 46.0,2 lt 52.0,2

lt 45.8.0_1,2

libxul
ge 46.0 lt 52.0

lt 45.8.0_1

thunderbird
linux-thunderbird
ge 46.0 lt 52.0

lt 45.8.0

CVE-2017-5400
CVE-2017-5401
CVE-2017-5402
CVE-2017-5403
CVE-2017-5404
CVE-2017-5406
CVE-2017-5407
CVE-2017-5410
CVE-2017-5411
CVE-2017-5409
CVE-2017-5408
CVE-2017-5412
CVE-2017-5413
CVE-2017-5414
CVE-2017-5415
CVE-2017-5416
CVE-2017-5417
CVE-2017-5425
CVE-2017-5426
CVE-2017-5427
CVE-2017-5418
CVE-2017-5419
CVE-2017-5420
CVE-2017-5405
CVE-2017-5421
CVE-2017-5422
CVE-2017-5399
CVE-2017-5398
https://www.mozilla.org/security/advisories/mfsa2017-05/
https://www.mozilla.org/security/advisories/mfsa2017-06/
d10b49b2-8d02-49e8-afde-0844626317afmozilla -- multiple vulnerabilities

Mozilla Foundation reports:

CVE-2018-12407: Buffer overflow with ANGLE library when using VertexBuffer11 module

CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11

CVE-2018-18492: Use-after-free with select element

CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia

CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs

CVE-2018-18495: WebExtension content scripts can be loaded in about: pages

CVE-2018-18496: Embedded feed preview page can be abused for clickjacking

CVE-2018-18497: WebExtensions can load arbitrary URLs through pipe separators

CVE-2018-18498: Integer overflow when calculating buffer sizes for images

CVE-2018-12406: Memory safety bugs fixed in Firefox 64

CVE-2018-12405: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4


Discovery 2018-12-11
Entry 2018-12-11
Modified 2019-07-23
firefox
lt 64.0_3,1

waterfox
lt 56.2.6

seamonkey
linux-seamonkey
lt 2.53.0

firefox-esr
lt 60.4.0,1

linux-firefox
lt 60.4.0,2

libxul
thunderbird
linux-thunderbird
lt 60.4.0

CVE-2018-12405
CVE-2018-12406
CVE-2018-12407
CVE-2018-17466
CVE-2018-18492
CVE-2018-18493
CVE-2018-18494
CVE-2018-18495
CVE-2018-18496
CVE-2018-18497
CVE-2018-18498
https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/
https://www.mozilla.org/en-US/security/advisories/mfsa2018-30/
2225c5b4-1e5a-44fc-9920-b3201c384a15mozilla -- multiple vulnerabilities

Mozilla Foundation reports:

MFSA 2016-16 Miscellaneous memory safety hazards (rv:45.0 / rv:38.7)

MFSA 2016-17 Local file overwriting and potential privilege escalation through CSP reports

MFSA 2016-18 CSP reports fail to strip location information for embedded iframe pages

MFSA 2016-19 Linux video memory DOS with Intel drivers

MFSA 2016-20 Memory leak in libstagefright when deleting an array during MP4 processing

MFSA 2016-21 Displayed page address can be overridden

MFSA 2016-22 Service Worker Manager out-of-bounds read in Service Worker Manager

MFSA 2016-23 Use-after-free in HTML5 string parser

MFSA 2016-24 Use-after-free in SetBody

MFSA 2016-25 Use-after-free when using multiple WebRTC data channels

MFSA 2016-26 Memory corruption when modifying a file being read by FileReader

MFSA 2016-27 Use-after-free during XML transformations

MFSA 2016-28 Addressbar spoofing though history navigation and Location protocol property

MFSA 2016-29 Same-origin policy violation using perfomance.getEntries and history navigation with session restore

MFSA 2016-31 Memory corruption with malicious NPAPI plugin

MFSA 2016-32 WebRTC and LibVPX vulnerabilities found through code inspection

MFSA 2016-33 Use-after-free in GetStaticInstance in WebRTC

MFSA 2016-34 Out-of-bounds read in HTML parser following a failed allocation


Discovery 2016-03-08
Entry 2016-03-08
Modified 2016-03-08
firefox
linux-firefox
lt 45.0,1

seamonkey
linux-seamonkey
lt 2.42

firefox-esr
lt 38.7.0,1

libxul
thunderbird
linux-thunderbird
lt 38.7.0

CVE-2016-1952
CVE-2016-1953
CVE-2016-1954
CVE-2016-1955
CVE-2016-1956
CVE-2016-1957
CVE-2016-1958
CVE-2016-1959
CVE-2016-1960
CVE-2016-1961
CVE-2016-1962
CVE-2016-1963
CVE-2016-1964
CVE-2016-1965
CVE-2016-1966
CVE-2016-1967
CVE-2016-1970
CVE-2016-1971
CVE-2016-1972
CVE-2016-1973
CVE-2016-1974
CVE-2016-1975
CVE-2016-1976
https://www.mozilla.org/security/advisories/mfsa2016-16/
https://www.mozilla.org/security/advisories/mfsa2016-17/
https://www.mozilla.org/security/advisories/mfsa2016-18/
https://www.mozilla.org/security/advisories/mfsa2016-19/
https://www.mozilla.org/security/advisories/mfsa2016-20/
https://www.mozilla.org/security/advisories/mfsa2016-21/
https://www.mozilla.org/security/advisories/mfsa2016-22/
https://www.mozilla.org/security/advisories/mfsa2016-23/
https://www.mozilla.org/security/advisories/mfsa2016-24/
https://www.mozilla.org/security/advisories/mfsa2016-25/
https://www.mozilla.org/security/advisories/mfsa2016-26/
https://www.mozilla.org/security/advisories/mfsa2016-27/
https://www.mozilla.org/security/advisories/mfsa2016-28/
https://www.mozilla.org/security/advisories/mfsa2016-29/
https://www.mozilla.org/security/advisories/mfsa2016-31/
https://www.mozilla.org/security/advisories/mfsa2016-32/
https://www.mozilla.org/security/advisories/mfsa2016-33/
https://www.mozilla.org/security/advisories/mfsa2016-34/
2c2d1c39-1396-459a-91f5-ca03ee7c64c6mozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2015-134 Miscellaneous memory safety hazards (rv:43.0 / rv:38.5)

MFSA 2015-135 Crash with JavaScript variable assignment with unboxed objects

MFSA 2015-136 Same-origin policy violation using perfomance.getEntries and history navigation

MFSA 2015-137 Firefox allows for control characters to be set in cookies

MFSA 2015-138 Use-after-free in WebRTC when datachannel is used after being destroyed

MFSA 2015-139 Integer overflow allocating extremely large textures

MFSA 2015-140 Cross-origin information leak through web workers error events

MFSA 2015-141 Hash in data URI is incorrectly parsed

MFSA 2015-142 DOS due to malformed frames in HTTP/2

MFSA 2015-143 Linux file chooser crashes on malformed images due to flaws in Jasper library

MFSA 2015-144 Buffer overflows found through code inspection

MFSA 2015-145 Underflow through code inspection

MFSA 2015-146 Integer overflow in MP4 playback in 64-bit versions

MFSA 2015-147 Integer underflow and buffer overflow processing MP4 metadata in libstagefright

MFSA 2015-148 Privilege escalation vulnerabilities in WebExtension APIs

MFSA 2015-149 Cross-site reading attack through data and view-source URIs


Discovery 2015-12-15
Entry 2015-12-15
firefox
lt 43.0,1

linux-firefox
lt 43.0,1

seamonkey
lt 2.40

linux-seamonkey
lt 2.40

firefox-esr
lt 38.5.0,1

libxul
lt 38.5.0

thunderbird
lt 38.5.0

linux-thunderbird
lt 38.5.0

CVE-2015-7201
CVE-2015-7202
CVE-2015-7203
CVE-2015-7204
CVE-2015-7205
CVE-2015-7207
CVE-2015-7208
CVE-2015-7210
CVE-2015-7211
CVE-2015-7212
CVE-2015-7213
CVE-2015-7214
CVE-2015-7215
CVE-2015-7216
CVE-2015-7217
CVE-2015-7218
CVE-2015-7219
CVE-2015-7220
CVE-2015-7221
CVE-2015-7222
CVE-2015-7223
https://www.mozilla.org/security/advisories/mfsa2015-134/
https://www.mozilla.org/security/advisories/mfsa2015-135/
https://www.mozilla.org/security/advisories/mfsa2015-136/
https://www.mozilla.org/security/advisories/mfsa2015-137/
https://www.mozilla.org/security/advisories/mfsa2015-138/
https://www.mozilla.org/security/advisories/mfsa2015-139/
https://www.mozilla.org/security/advisories/mfsa2015-140/
https://www.mozilla.org/security/advisories/mfsa2015-141/
https://www.mozilla.org/security/advisories/mfsa2015-142/
https://www.mozilla.org/security/advisories/mfsa2015-143/
https://www.mozilla.org/security/advisories/mfsa2015-144/
https://www.mozilla.org/security/advisories/mfsa2015-145/
https://www.mozilla.org/security/advisories/mfsa2015-146/
https://www.mozilla.org/security/advisories/mfsa2015-147/
https://www.mozilla.org/security/advisories/mfsa2015-148/
https://www.mozilla.org/security/advisories/mfsa2015-149/
d1853110-07f4-4645-895b-6fd462ad0589mozilla -- multiple vulnerabilities

Mozilla Foundation reports:

Please reference CVE/URL list for details


Discovery 2016-11-15
Entry 2016-11-16
firefox
lt 50.0_1,1

seamonkey
linux-seamonkey
lt 2.47

firefox-esr
lt 45.5.0,1

linux-firefox
lt 45.5.0,2

libxul
thunderbird
linux-thunderbird
lt 45.5.0

CVE-2016-5289
CVE-2016-5290
CVE-2016-5291
CVE-2016-5292
CVE-2016-5293
CVE-2016-5294
CVE-2016-5295
CVE-2016-5296
CVE-2016-5297
CVE-2016-5298
CVE-2016-5299
CVE-2016-9061
CVE-2016-9062
CVE-2016-9063
CVE-2016-9064
CVE-2016-9065
CVE-2016-9066
CVE-2016-9067
CVE-2016-9068
CVE-2016-9070
CVE-2016-9071
CVE-2016-9072
CVE-2016-9073
CVE-2016-9074
CVE-2016-9075
CVE-2016-9076
CVE-2016-9077
https://www.mozilla.org/security/advisories/mfsa2016-89/
https://www.mozilla.org/security/advisories/mfsa2016-90/
4f00dac0-1e18-4481-95af-7aaad63fd303mozilla -- multiple vulnerabilities

Mozilla Foundation reports:

MFSA 2016-01 Miscellaneous memory safety hazards (rv:44.0 / rv:38.6)

MFSA 2016-02 Out of Memory crash when parsing GIF format images

MFSA 2016-03 Buffer overflow in WebGL after out of memory allocation

MFSA 2016-04 Firefox allows for control characters to be set in cookie names

MFSA 2016-06 Missing delay following user click events in protocol handler dialog

MFSA 2016-09 Addressbar spoofing attacks

MFSA 2016-10 Unsafe memory manipulation found through code inspection

MFSA 2016-11 Application Reputation service disabled in Firefox 43


Discovery 2016-01-26
Entry 2016-02-01
Modified 2016-03-08
firefox
linux-firefox
lt 44.0,1

seamonkey
linux-seamonkey
lt 2.41

firefox-esr
lt 38.6.0,1

libxul
thunderbird
linux-thunderbird
lt 38.6.0

CVE-2015-7208
CVE-2016-1930
CVE-2016-1931
CVE-2016-1933
CVE-2016-1935
CVE-2016-1937
CVE-2016-1939
CVE-2016-1942
CVE-2016-1943
CVE-2016-1944
CVE-2016-1945
CVE-2016-1946
CVE-2016-1947
https://www.mozilla.org/security/advisories/mfsa2016-01/
https://www.mozilla.org/security/advisories/mfsa2016-02/
https://www.mozilla.org/security/advisories/mfsa2016-03/
https://www.mozilla.org/security/advisories/mfsa2016-04/
https://www.mozilla.org/security/advisories/mfsa2016-06/
https://www.mozilla.org/security/advisories/mfsa2016-09/
https://www.mozilla.org/security/advisories/mfsa2016-10/
https://www.mozilla.org/security/advisories/mfsa2016-11/
512c0ffd-cd39-4da4-b2dc-81ff4ba8e238mozilla -- multiple vulnerabilities

Mozilla Foundation reports:

CVE-2016-9894: Buffer overflow in SkiaGL

CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements

CVE-2016-9895: CSP bypass using marquee tag

CVE-2016-9896: Use-after-free with WebVR

CVE-2016-9897: Memory corruption in libGLES

CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees

CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs

CVE-2016-9904: Cross-origin information leak in shared atoms

CVE-2016-9901: Data from Pocket server improperly sanitized before execution

CVE-2016-9902: Pocket extension does not validate the origin of events

CVE-2016-9903: XSS injection vulnerability in add-ons SDK

CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1

CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6


Discovery 2016-12-13
Entry 2016-12-14
firefox
lt 50.1.0_1,1

seamonkey
linux-seamonkey
lt 2.47

firefox-esr
lt 45.6.0,1

linux-firefox
lt 45.6.0,2

libxul
thunderbird
linux-thunderbird
lt 45.6.0

CVE-2016-9894
CVE-2016-9899
CVE-2016-9895
CVE-2016-9896
CVE-2016-9897
CVE-2016-9898
CVE-2016-9900
CVE-2016-9904
CVE-2016-9901
CVE-2016-9902
CVE-2016-9903
CVE-2016-9080
CVE-2016-9893
https://www.mozilla.org/security/advisories/mfsa2016-94/
https://www.mozilla.org/security/advisories/mfsa2016-95/
81f866ad-41a4-11e3-a4af-0025905a4771mozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2013-93 Miscellaneous memory safety hazards (rv:25.0 / rv:24.1 / rv:17.0.10)

MFSA 2013-94 Spoofing addressbar though SELECT element

MFSA 2013-95 Access violation with XSLT and uninitialized data

MFSA 2013-96 Improperly initialized memory and overflows in some JavaScript functions

MFSA 2013-97 Writing to cycle collected object during image decoding

MFSA 2013-98 Use-after-free when updating offline cache

MFSA 2013-99 Security bypass of PDF.js checks using iframes

MFSA 2013-100 Miscellaneous use-after-free issues found through ASAN fuzzing

MFSA 2013-101 Memory corruption in workers

MFSA 2013-102 Use-after-free in HTML document templates


Discovery 2013-10-29
Entry 2013-10-30
Modified 2013-10-31
firefox
lt 24.1.0,1

linux-firefox
lt 25.0,1

linux-seamonkey
lt 2.22

linux-thunderbird
lt 24.1.0

seamonkey
lt 2.22

thunderbird
lt 24.1.0

CVE-2013-1739
CVE-2013-5590
CVE-2013-5591
CVE-2013-5592
CVE-2013-5593
CVE-2013-5595
CVE-2013-5596
CVE-2013-5597
CVE-2013-5598
CVE-2013-5599
CVE-2013-5600
CVE-2013-5601
CVE-2013-5602
CVE-2013-5603
CVE-2013-5604
https://www.mozilla.org/security/announce/2013/mfsa2013-93.html
https://www.mozilla.org/security/announce/2013/mfsa2013-94.html
https://www.mozilla.org/security/announce/2013/mfsa2013-95.html
https://www.mozilla.org/security/announce/2013/mfsa2013-96.html
https://www.mozilla.org/security/announce/2013/mfsa2013-97.html
https://www.mozilla.org/security/announce/2013/mfsa2013-98.html
https://www.mozilla.org/security/announce/2013/mfsa2013-99.html
https://www.mozilla.org/security/announce/2013/mfsa2013-100.html
https://www.mozilla.org/security/announce/2013/mfsa2013-101.html
https://www.mozilla.org/security/announce/2013/mfsa2013-102.html
http://www.mozilla.org/security/known-vulnerabilities/
7ae61870-9dd2-4884-a2f2-f19bb5784d09mozilla -- multiple vulnerabilities

The Mozilla Project reports:

ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data

MFSA-2014-90 Apple CoreGraphics framework on OS X 10.10 logging input data to /tmp directory

MFSA-2014-89 Bad casting from the BasicThebesLayer to BasicContainerLayer

MFSA-2014-88 Buffer overflow while parsing media content

MFSA-2014-87 Use-after-free during HTML5 parsing

MFSA-2014-86 CSP leaks redirect data via violation reports

MFSA-2014-85 XMLHttpRequest crashes with some input streams

MFSA-2014-84 XBL bindings accessible via improper CSS declarations

MFSA-2014-83 Miscellaneous memory safety hazards (rv:34.0 / rv:31.3)


Discovery 2014-12-01
Entry 2014-12-02
firefox
lt 34.0,1

firefox-esr
lt 31.3.0,1

linux-firefox
lt 34.0,1

linux-seamonkey
lt 2.31

linux-thunderbird
lt 31.3.0

seamonkey
lt 2.31

thunderbird
lt 31.3.0

libxul
lt 31.3.0

nss
lt 3.17.3

CVE-2014-1587
CVE-2014-1588
CVE-2014-1589
CVE-2014-1590
CVE-2014-1591
CVE-2014-1592
CVE-2014-1593
CVE-2014-1594
CVE-2014-1595
CVE-2014-1569
https://www.mozilla.org/security/advisories/mfsa2014-83
https://www.mozilla.org/security/advisories/mfsa2014-84
https://www.mozilla.org/security/advisories/mfsa2014-85
https://www.mozilla.org/security/advisories/mfsa2014-86
https://www.mozilla.org/security/advisories/mfsa2014-87
https://www.mozilla.org/security/advisories/mfsa2014-88
https://www.mozilla.org/security/advisories/mfsa2014-89
https://www.mozilla.org/security/advisories/mfsa2014-90
https://www.mozilla.org/security/advisories/
630c8c08-880f-11e2-807f-d43d7e0c7c02mozilla -- use-after-free in HTML Editor

The Mozilla Project reports:

MFSA 2013-29 Use-after-free in HTML Editor


Discovery 2013-03-07
Entry 2013-03-08
firefox
gt 18.0,1 lt 19.0.2,1

lt 17.0.3,1

linux-firefox
lt 17.0.4,1

linux-seamonkey
lt 2.16.1

linux-thunderbird
lt 17.0.4

seamonkey
lt 2.16.1

thunderbird
gt 11.0 lt 17.0.4

lt 10.0.12

CVE-2013-0787
http://www.mozilla.org/security/announce/2013/mfsa2013-29.html
http://www.mozilla.org/security/known-vulnerabilities/
985d4d6c-cfbd-11e3-a003-b4b52fce4ce8mozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2014-34 Miscellaneous memory safety hazards (rv:29.0 / rv:24.5)

MFSA 2014-35 Privilege escalation through Mozilla Maintenance Service Installer

MFSA 2014-36 Web Audio memory corruption issues

MFSA 2014-37 Out of bounds read while decoding JPG images

MFSA 2014-38 Buffer overflow when using non-XBL object as XBL

MFSA 2014-39 Use-after-free in the Text Track Manager for HTML video

MFSA 2014-41 Out-of-bounds write in Cairo

MFSA 2014-42 Privilege escalation through Web Notification API

MFSA 2014-43 Cross-site scripting (XSS) using history navigations

MFSA 2014-44 Use-after-free in imgLoader while resizing images

MFSA 2014-45 Incorrect IDNA domain name matching for wildcard certificates

MFSA 2014-46 Use-after-free in nsHostResolve

MFSA 2014-47 Debugger can bypass XrayWrappers with JavaScript


Discovery 2014-04-29
Entry 2014-04-29
firefox
lt 29.0,1

firefox-esr
lt 24.5.0,1

linux-firefox
lt 29.0,1

linux-seamonkey
lt 2.26

linux-thunderbird
lt 24.5.0

seamonkey
lt 2.26

thunderbird
lt 24.5.0

CVE-2014-1492
CVE-2014-1518
CVE-2014-1519
CVE-2014-1520
CVE-2014-1522
CVE-2014-1523
CVE-2014-1524
CVE-2014-1525
CVE-2014-1526
CVE-2014-1527
CVE-2014-1528
CVE-2014-1529
CVE-2014-1530
CVE-2014-1531
CVE-2014-1532
https://www.mozilla.org/security/announce/2014/mfsa2014-34.html
https://www.mozilla.org/security/announce/2014/mfsa2014-35.html
https://www.mozilla.org/security/announce/2014/mfsa2014-36.html
https://www.mozilla.org/security/announce/2014/mfsa2014-37.html
https://www.mozilla.org/security/announce/2014/mfsa2014-38.html
https://www.mozilla.org/security/announce/2014/mfsa2014-39.html
https://www.mozilla.org/security/announce/2014/mfsa2014-41.html
https://www.mozilla.org/security/announce/2014/mfsa2014-42.html
https://www.mozilla.org/security/announce/2014/mfsa2014-43.html
https://www.mozilla.org/security/announce/2014/mfsa2014-44.html
https://www.mozilla.org/security/announce/2014/mfsa2014-45.html
https://www.mozilla.org/security/announce/2014/mfsa2014-46.html
https://www.mozilla.org/security/announce/2014/mfsa2014-47.html
http://www.mozilla.org/security/known-vulnerabilities/
bd62c640-9bb9-11e4-a5ad-000c297fb80fmozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA-2015-01 Miscellaneous memory safety hazards (rv:35.0 / rv:31.4)

MFSA-2015-02 Uninitialized memory use during bitmap rendering

MFSA-2015-03 sendBeacon requests lack an Origin header

MFSA-2015-04 Cookie injection through Proxy Authenticate responses

MFSA-2015-05 Read of uninitialized memory in Web Audio

MFSA-2015-06 Read-after-free in WebRTC

MFSA-2015-07 Gecko Media Plugin sandbox escape

MFSA-2015-08 Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension

MFSA-2015-09 XrayWrapper bypass through DOM objects


Discovery 2015-01-13
Entry 2015-01-14
firefox
lt 35.0,1

firefox-esr
lt 31.4.0,1

linux-firefox
lt 35.0,1

linux-seamonkey
lt 2.32

linux-thunderbird
lt 31.4.0

seamonkey
lt 2.32

thunderbird
lt 31.4.0

libxul
lt 31.4.0

CVE-2014-8634
CVE-2014-8635
CVE-2014-8637
CVE-2014-8638
CVE-2014-8639
CVE-2014-8640
CVE-2014-8641
CVE-2014-8642
CVE-2014-8643
CVE-2014-8636
https://www.mozilla.org/en-US/security/advisories/mfsa2015-01/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-02/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-03/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-04/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-05/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-06/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-07/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-08/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-09/
https://www.mozilla.org/security/advisories/
8065d37b-8e7c-4707-a608-1b0a2b8509c3mozilla -- multiple vulnerabilities

Mozilla Foundation reports:

MFSA 2016-49 Miscellaneous memory safety hazards (rv:47.0 / rv:45.2)

MFSA 2016-50 Buffer overflow parsing HTML5 fragments

MFSA 2016-51 Use-after-free deleting tables from a contenteditable document

MFSA 2016-52 Addressbar spoofing though the SELECT element

MFSA 2016-54 Partial same-origin-policy through setting location.host through data URI

MFSA 2016-56 Use-after-free when textures are used in WebGL operations after recycle pool destruction

MFSA 2016-57 Incorrect icon displayed on permissions notifications

MFSA 2016-58 Entering fullscreen and persistent pointerlock without user permission

MFSA 2016-59 Information disclosure of disabled plugins through CSS pseudo-classes

MFSA 2016-60 Java applets bypass CSP protections


Discovery 2016-06-07
Entry 2016-06-07
firefox
lt 47.0,1

seamonkey
linux-seamonkey
lt 2.44

firefox-esr
lt 45.2.0,1

linux-firefox
lt 45.2.0,2

libxul
thunderbird
linux-thunderbird
lt 45.2.0

CVE-2016-2818
CVE-2016-2819
CVE-2016-2821
CVE-2016-2822
CVE-2016-2825
CVE-2016-2828
CVE-2016-2829
CVE-2016-2831
CVE-2016-2832
CVE-2016-2833
https://www.mozilla.org/security/advisories/mfsa2016-49/
https://www.mozilla.org/security/advisories/mfsa2016-50/
https://www.mozilla.org/security/advisories/mfsa2016-51/
https://www.mozilla.org/security/advisories/mfsa2016-52/
https://www.mozilla.org/security/advisories/mfsa2016-54/
https://www.mozilla.org/security/advisories/mfsa2016-56/
https://www.mozilla.org/security/advisories/mfsa2016-57/
https://www.mozilla.org/security/advisories/mfsa2016-58/
https://www.mozilla.org/security/advisories/mfsa2016-59/
https://www.mozilla.org/security/advisories/mfsa2016-60/
CVE-2016-2815
d23119df-335d-11e2-b64c-c8600054b392mozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2012-91 Miscellaneous memory safety hazards (rv:17.0/ rv:10.0.11)

MFSA 2012-92 Buffer overflow while rendering GIF images

MFSA 2012-93 evalInSanbox location context incorrectly applied

MFSA 2012-94 Crash when combining SVG text on path with CSS

MFSA 2012-95 Javascript: URLs run in privileged context on New Tab page

MFSA 2012-96 Memory corruption in str_unescape

MFSA 2012-97 XMLHttpRequest inherits incorrect principal within sandbox

MFSA 2012-98 Firefox installer DLL hijacking

MFSA 2012-99 XrayWrappers exposes chrome-only properties when not in chrome compartment

MFSA 2012-100 Improper security filtering for cross-origin wrappers

MFSA 2012-101 Improper character decoding in HZ-GB-2312 charset

MFSA 2012-102 Script entered into Developer Toolbar runs with chrome privileges

MFSA 2012-103 Frames can shadow top.location

MFSA 2012-104 CSS and HTML injection through Style Inspector

MFSA 2012-105 Use-after-free and buffer overflow issues found

MFSA 2012-106 Use-after-free, buffer overflow, and memory corruption issues found using Address Sanitizer


Discovery 2012-11-20
Entry 2012-11-20
firefox
gt 11.0,1 lt 17.0,1

lt 10.0.11,1

linux-firefox
lt 10.0.11,1

linux-seamonkey
lt 2.14

linux-thunderbird
lt 10.0.11

seamonkey
lt 2.14

thunderbird
gt 11.0 lt 17.0

lt 10.0.11

libxul
gt 1.9.2.* lt 10.0.11

CVE-2012-4201
CVE-2012-4202
CVE-2012-4203
CVE-2012-4204
CVE-2012-4205
CVE-2012-4206
CVE-2012-4207
CVE-2012-4208
CVE-2012-4209
CVE-2012-4210
CVE-2012-4212
CVE-2012-4213
CVE-2012-4214
CVE-2012-4215
CVE-2012-4216
CVE-2012-4217
CVE-2012-4218
CVE-2012-5829
CVE-2012-5830
CVE-2012-5833
CVE-2012-5835
CVE-2012-5836
CVE-2012-5837
CVE-2012-5838
CVE-2012-5839
CVE-2012-5840
CVE-2012-5841
CVE-2012-5842
CVE-2012-5843
http://www.mozilla.org/security/announce/2012/mfsa2012-90.html
http://www.mozilla.org/security/announce/2012/mfsa2012-91.html
http://www.mozilla.org/security/announce/2012/mfsa2012-92.html
http://www.mozilla.org/security/announce/2012/mfsa2012-93.html
http://www.mozilla.org/security/announce/2012/mfsa2012-94.html
http://www.mozilla.org/security/announce/2012/mfsa2012-95.html
http://www.mozilla.org/security/announce/2012/mfsa2012-96.html
http://www.mozilla.org/security/announce/2012/mfsa2012-97.html
http://www.mozilla.org/security/announce/2012/mfsa2012-98.html
http://www.mozilla.org/security/announce/2012/mfsa2012-99.html
http://www.mozilla.org/security/announce/2012/mfsa2012-100.html
http://www.mozilla.org/security/announce/2012/mfsa2012-101.html
http://www.mozilla.org/security/announce/2012/mfsa2012-102.html
http://www.mozilla.org/security/announce/2012/mfsa2012-103.html
http://www.mozilla.org/security/announce/2012/mfsa2012-104.html
http://www.mozilla.org/security/announce/2012/mfsa2012-105.html
http://www.mozilla.org/security/announce/2012/mfsa2012-106.html
http://www.mozilla.org/security/known-vulnerabilities/
c66a5632-708a-4727-8236-d65b2d5b2739mozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2015-79 Miscellaneous memory safety hazards (rv:40.0 / rv:38.2)

MFSA 2015-80 Out-of-bounds read with malformed MP3 file

MFSA 2015-81 Use-after-free in MediaStream playback

MFSA 2015-82 Redefinition of non-configurable JavaScript object properties

MFSA 2015-83 Overflow issues in libstagefright

MFSA 2015-84 Arbitrary file overwriting through Mozilla Maintenance Service with hard links

MFSA 2015-85 Out-of-bounds write with Updater and malicious MAR file

MFSA 2015-86 Feed protocol with POST bypasses mixed content protections

MFSA 2015-87 Crash when using shared memory in JavaScript

MFSA 2015-88 Heap overflow in gdk-pixbuf when scaling bitmap images

MFSA 2015-90 Vulnerabilities found through code inspection

MFSA 2015-91 Mozilla Content Security Policy allows for asterisk wildcards in violation of CSP specification

MFSA 2015-92 Use-after-free in XMLHttpRequest with shared workers


Discovery 2015-08-11
Entry 2015-08-11
Modified 2015-08-22
firefox
lt 40.0,1

linux-firefox
lt 40.0,1

seamonkey
ge 2.36 lt 2.37

lt 2.35

linux-seamonkey
ge 2.36 lt 2.37

lt 2.35

firefox-esr
lt 38.2.0,1

libxul
lt 38.2.0

thunderbird
lt 38.2.0

linux-thunderbird
lt 38.2.0

CVE-2015-4473
CVE-2015-4474
CVE-2015-4475
CVE-2015-4477
CVE-2015-4478
CVE-2015-4479
CVE-2015-4480
CVE-2015-4481
CVE-2015-4482
CVE-2015-4483
CVE-2015-4484
CVE-2015-4487
CVE-2015-4488
CVE-2015-4489
CVE-2015-4490
CVE-2015-4491
CVE-2015-4492
CVE-2015-4493
https://www.mozilla.org/security/advisories/mfsa2015-79/
https://www.mozilla.org/security/advisories/mfsa2015-80/
https://www.mozilla.org/security/advisories/mfsa2015-81/
https://www.mozilla.org/security/advisories/mfsa2015-82/
https://www.mozilla.org/security/advisories/mfsa2015-83/
https://www.mozilla.org/security/advisories/mfsa2015-84/
https://www.mozilla.org/security/advisories/mfsa2015-85/
https://www.mozilla.org/security/advisories/mfsa2015-86/
https://www.mozilla.org/security/advisories/mfsa2015-87/
https://www.mozilla.org/security/advisories/mfsa2015-88/
https://www.mozilla.org/security/advisories/mfsa2015-90/
https://www.mozilla.org/security/advisories/mfsa2015-91/
https://www.mozilla.org/security/advisories/mfsa2015-92/
18211552-f650-4d86-ba4f-e6d5cbfcdbebmozilla -- multiple vulnerabilities

Mozilla Foundation reports:

CVE-2018-18356: Use-after-free in Skia

CVE-2019-5785: Integer overflow in Skia

CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext


Discovery 2019-02-13
Entry 2019-02-13
firefox
lt 65.0.1,1

firefox-esr
lt 60.5.1,1

thunderbird
lt 60.5.1

CVE-2018-18511
CVE-2018-18356
CVE-2019-5785
https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/
https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/
0592f49f-b3b8-4260-b648-d1718762656cmozilla -- multiple vulnerabilities

Mozilla Foundation reports:

CVE-2019-9811: Sandbox escape via installation of malicious language pack

CVE-2019-11711: Script injection within domain through inner window reuse

CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects

CVE-2019-11713: Use-after-free with HTTP/2 cached stream

CVE-2019-11714: NeckoChild can trigger crash when accessed off of main thread

CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault

CVE-2019-11715: HTML parsing error can contribute to content XSS

CVE-2019-11716: globalThis not enumerable until accessed

CVE-2019-11717: Caret character improperly escaped in origins

CVE-2019-11718: Activity Stream writes unsanitized content to innerHTML

CVE-2019-11719: Out-of-bounds read when importing curve25519 private key

CVE-2019-11720: Character encoding XSS vulnerability

CVE-2019-11721: Domain spoofing through unicode latin 'kra' character

CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin

CVE-2019-11723: Cookie leakage during add-on fetching across private browsing boundaries

CVE-2019-11724: Retired site input.mozilla.org has remote troubleshooting permissions

CVE-2019-11725: Websocket resources bypass safebrowsing protections

CVE-2019-11727: PKCS#1 v1.5 signatures can be used for TLS 1.3

CVE-2019-11728: Port scanning through Alt-Svc header

CVE-2019-11710: Memory safety bugs fixed in Firefox 68

CVE-2019-11709: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8


Discovery 2019-07-09
Entry 2019-07-09
Modified 2019-07-23
firefox
lt 68.0_4,1

waterfox
lt 56.2.12

seamonkey
linux-seamonkey
lt 2.53.0

firefox-esr
lt 60.8.0,1

linux-firefox
lt 60.8.0,2

libxul
thunderbird
linux-thunderbird
lt 60.8.0

CVE-2019-11709
CVE-2019-11710
CVE-2019-11711
CVE-2019-11712
CVE-2019-11713
CVE-2019-11714
CVE-2019-11715
CVE-2019-11716
CVE-2019-11717
CVE-2019-11718
CVE-2019-11719
CVE-2019-11720
CVE-2019-11721
CVE-2019-11723
CVE-2019-11724
CVE-2019-11725
CVE-2019-11727
CVE-2019-11728
CVE-2019-11729
CVE-2019-11730
CVE-2019-9811
https://www.mozilla.org/security/advisories/mfsa2019-21/
https://www.mozilla.org/security/advisories/mfsa2019-22/
1753f0ff-8dd5-11e3-9b45-b4b52fce4ce8mozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2014-01 Miscellaneous memory safety hazards (rv:27.0 / rv:24.3)

MFSA 2014-02 Clone protected content with XBL scopes

MFSA 2014-03 UI selection timeout missing on download prompts

MFSA 2014-04 Incorrect use of discarded images by RasterImage

MFSA 2014-05 Information disclosure with *FromPoint on iframes

MFSA 2014-06 Profile path leaks to Android system log

MFSA 2014-07 XSLT stylesheets treated as styles in Content Security Policy

MFSA 2014-08 Use-after-free with imgRequestProxy and image proccessing

MFSA 2014-09 Cross-origin information leak through web workers

MFSA 2014-10 Firefox default start page UI content invokable by script

MFSA 2014-11 Crash when using web workers with asm.js

MFSA 2014-12 NSS ticket handling issues

MFSA 2014-13 Inconsistent JavaScript handling of access to Window objects


Discovery 2014-02-04
Entry 2014-02-04
firefox
gt 25.0,1 lt 27.0,1

lt 24.3.0,1

linux-firefox
lt 27.0,1

linux-seamonkey
lt 2.24

linux-thunderbird
lt 24.3.0

seamonkey
lt 2.24

thunderbird
lt 24.3.0

CVE-2014-1477
CVE-2014-1478
CVE-2014-1479
CVE-2014-1480
CVE-2014-1481
CVE-2014-1482
CVE-2014-1483
CVE-2014-1484
CVE-2014-1485
CVE-2014-1486
CVE-2014-1487
CVE-2014-1488
CVE-2014-1489
CVE-2014-1490
CVE-2014-1491
https://www.mozilla.org/security/announce/2014/mfsa2014-01.html
https://www.mozilla.org/security/announce/2014/mfsa2014-02.html
https://www.mozilla.org/security/announce/2014/mfsa2014-03.html
https://www.mozilla.org/security/announce/2014/mfsa2014-04.html
https://www.mozilla.org/security/announce/2014/mfsa2014-05.html
https://www.mozilla.org/security/announce/2014/mfsa2014-06.html
https://www.mozilla.org/security/announce/2014/mfsa2014-07.html
https://www.mozilla.org/security/announce/2014/mfsa2014-08.html
https://www.mozilla.org/security/announce/2014/mfsa2014-09.html
https://www.mozilla.org/security/announce/2014/mfsa2014-10.html
https://www.mozilla.org/security/announce/2014/mfsa2014-11.html
https://www.mozilla.org/security/announce/2014/mfsa2014-12.html
http://www.mozilla.org/security/known-vulnerabilities/
5e0a038a-ca30-416d-a2f5-38cbf5e7df33mozilla -- multiple vulnerabilities

Mozilla Foundation reports:

Please reference CVE/URL list for details


Discovery 2017-04-19
Entry 2017-04-19
Modified 2017-09-19
firefox
lt 53.0_2,1

seamonkey
linux-seamonkey
lt 2.49.1

firefox-esr
ge 46.0,1 lt 52.1.0_2,1

lt 45.9.0,1

linux-firefox
ge 46.0,2 lt 52.1.0,2

lt 45.9.0,2

libxul
ge 46.0 lt 52.1.0

lt 45.9.0

thunderbird
linux-thunderbird
ge 46.0 lt 52.1.0

lt 45.9.0

CVE-2017-5433
CVE-2017-5435
CVE-2017-5436
CVE-2017-5461
CVE-2017-5459
CVE-2017-5466
CVE-2017-5434
CVE-2017-5432
CVE-2017-5460
CVE-2017-5438
CVE-2017-5439
CVE-2017-5440
CVE-2017-5441
CVE-2017-5442
CVE-2017-5464
CVE-2017-5443
CVE-2017-5444
CVE-2017-5446
CVE-2017-5447
CVE-2017-5465
CVE-2017-5448
CVE-2017-5437
CVE-2017-5454
CVE-2017-5455
CVE-2017-5456
CVE-2017-5469
CVE-2017-5445
CVE-2017-5449
CVE-2017-5450
CVE-2017-5451
CVE-2017-5462
CVE-2017-5463
CVE-2017-5467
CVE-2017-5452
CVE-2017-5453
CVE-2017-5458
CVE-2017-5468
CVE-2017-5430
CVE-2017-5429
https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/
https://www.mozilla.org/en-US/security/advisories/mfsa2017-11/
https://www.mozilla.org/en-US/security/advisories/mfsa2017-12/
d0c97697-df2c-4b8b-bff2-cec24dc35af8mozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA-2015-30 Miscellaneous memory safety hazards (rv:37.0 / rv:31.6)

MFSA-2015-31 Use-after-free when using the Fluendo MP3 GStreamer plugin

MFSA-2015-32 Add-on lightweight theme installation approval bypassed through MITM attack

MFSA-2015-33 resource:// documents can load privileged pages

MFSA-2015-34 Out of bounds read in QCMS library

MFSA-2015-35 Cursor clickjacking with flash and images

MFSA-2015-36 Incorrect memory management for simple-type arrays in WebRTC

MFSA-2015-37 CORS requests should not follow 30x redirections after preflight

MFSA-2015-38 Memory corruption crashes in Off Main Thread Compositing

MFSA-2015-39 Use-after-free due to type confusion flaws

MFSA-2015-40 Same-origin bypass through anchor navigation

MFSA-2015-41 PRNG weakness allows for DNS poisoning on Android

MFSA-2015-42 Windows can retain access to privileged content on navigation to unprivileged pages


Discovery 2015-03-31
Entry 2015-03-31
firefox
lt 37.0,1

firefox-esr
lt 31.6.0,1

linux-firefox
lt 37.0,1

linux-seamonkey
lt 2.34

linux-thunderbird
lt 31.6.0

seamonkey
lt 2.34

thunderbird
lt 31.6.0

libxul
lt 31.6.0

CVE-2012-2808
CVE-2015-0800
CVE-2015-0801
CVE-2015-0802
CVE-2015-0803
CVE-2015-0804
CVE-2015-0805
CVE-2015-0806
CVE-2015-0807
CVE-2015-0808
CVE-2015-0810
CVE-2015-0811
CVE-2015-0812
CVE-2015-0813
CVE-2015-0814
CVE-2015-0815
CVE-2015-0816
https://www.mozilla.org/security/advisories/mfsa2015-30/
https://www.mozilla.org/security/advisories/mfsa2015-31/
https://www.mozilla.org/security/advisories/mfsa2015-32/
https://www.mozilla.org/security/advisories/mfsa2015-33/
https://www.mozilla.org/security/advisories/mfsa2015-34/
https://www.mozilla.org/security/advisories/mfsa2015-35/
https://www.mozilla.org/security/advisories/mfsa2015-36/
https://www.mozilla.org/security/advisories/mfsa2015-37/
https://www.mozilla.org/security/advisories/mfsa2015-38/
https://www.mozilla.org/security/advisories/mfsa2015-39/
https://www.mozilla.org/security/advisories/mfsa2015-40/
https://www.mozilla.org/security/advisories/mfsa2015-41/
https://www.mozilla.org/security/advisories/mfsa2015-42/
https://www.mozilla.org/security/advisories/
a4ed6632-5aa9-11e2-8fcb-c8600054b392mozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2013-01 Miscellaneous memory safety hazards (rv:18.0/ rv:10.0.12 / rv:17.0.2)

MFSA 2013-02 Use-after-free and buffer overflow issues found using Address Sanitizer

MFSA 2013-03 Buffer Overflow in Canvas

MFSA 2013-04 URL spoofing in addressbar during page loads

MFSA 2013-05 Use-after-free when displaying table with many columns and column groups

MFSA 2013-06 Touch events are shared across iframes

MFSA 2013-07 Crash due to handling of SSL on threads

MFSA 2013-08 AutoWrapperChanger fails to keep objects alive during garbage collection

MFSA 2013-09 Compartment mismatch with quickstubs returned values

MFSA 2013-10 Event manipulation in plugin handler to bypass same-origin policy

MFSA 2013-11 Address space layout leaked in XBL objects

MFSA 2013-12 Buffer overflow in Javascript string concatenation

MFSA 2013-13 Memory corruption in XBL with XML bindings containing SVG

MFSA 2013-14 Chrome Object Wrapper (COW) bypass through changing prototype

MFSA 2013-15 Privilege escalation through plugin objects

MFSA 2013-16 Use-after-free in serializeToStream

MFSA 2013-17 Use-after-free in ListenerManager

MFSA 2013-18 Use-after-free in Vibrate

MFSA 2013-19 Use-after-free in Javascript Proxy objects

MFSA 2013-20 Mis-issued TURKTRUST certificates


Discovery 2013-01-08
Entry 2013-01-09
firefox
gt 11.0,1 lt 17.0.2,1

lt 10.0.12,1

linux-firefox
lt 17.0.2,1

linux-seamonkey
lt 2.15

linux-thunderbird
lt 17.0.2

seamonkey
lt 2.15

thunderbird
gt 11.0 lt 17.0.2

lt 10.0.12

libxul
gt 1.9.2.* lt 10.0.12

ca_root_nss
lt 3.14.1

CVE-2012-5829
CVE-2013-0743
CVE-2013-0744
CVE-2013-0745
CVE-2013-0746
CVE-2013-0747
CVE-2013-0748
CVE-2013-0749
CVE-2013-0750
CVE-2013-0751
CVE-2013-0752
CVE-2013-0753
CVE-2013-0754
CVE-2013-0755
CVE-2013-0756
CVE-2013-0757
CVE-2013-0758
CVE-2013-0759
CVE-2013-0760
CVE-2013-0761
CVE-2013-0762
CVE-2013-0763
CVE-2013-0764
CVE-2013-0766
CVE-2013-0767
CVE-2013-0768
CVE-2013-0769
CVE-2013-0770
CVE-2013-0771
http://www.mozilla.org/security/announce/2013/mfsa2013-01.html
http://www.mozilla.org/security/announce/2013/mfsa2013-02.html
http://www.mozilla.org/security/announce/2013/mfsa2013-03.html
http://www.mozilla.org/security/announce/2013/mfsa2013-04.html
http://www.mozilla.org/security/announce/2013/mfsa2013-05.html
http://www.mozilla.org/security/announce/2013/mfsa2013-06.html
http://www.mozilla.org/security/announce/2013/mfsa2013-07.html
http://www.mozilla.org/security/announce/2013/mfsa2013-08.html
http://www.mozilla.org/security/announce/2013/mfsa2013-09.html
http://www.mozilla.org/security/announce/2013/mfsa2013-10.html
http://www.mozilla.org/security/announce/2013/mfsa2013-11.html
http://www.mozilla.org/security/announce/2013/mfsa2013-12.html
http://www.mozilla.org/security/announce/2013/mfsa2013-13.html
http://www.mozilla.org/security/announce/2013/mfsa2013-14.html
http://www.mozilla.org/security/announce/2013/mfsa2013-15.html
http://www.mozilla.org/security/announce/2013/mfsa2013-16.html
http://www.mozilla.org/security/announce/2013/mfsa2013-17.html
http://www.mozilla.org/security/announce/2013/mfsa2013-18.html
http://www.mozilla.org/security/announce/2013/mfsa2013-19.html
http://www.mozilla.org/security/announce/2013/mfsa2013-20.html
http://www.mozilla.org/security/known-vulnerabilities/
18f39fb6-7400-4063-acaf-0806e92c094fMozilla -- SVG Animation Remote Code Execution

The Mozilla Foundation reports:

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows.


Discovery 2016-11-30
Entry 2016-12-01
Modified 2016-12-16
firefox
lt 50.0.2,1

firefox-esr
lt 45.5.1,1

linux-firefox
lt 45.5.1,2

seamonkey
lt 2.46

linux-seamonkey
lt 2.46

libxul
lt 45.5.1

thunderbird
lt 45.5.1

linux-thunderbird
lt 45.5.1

CVE-2016-9079
https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/
2c57c47e-8bb3-4694-83c8-9fc3abad3964mozilla -- multiple vulnerabilities

Mozilla Foundation reports:

CVE-2016-2827 - Out-of-bounds read in mozilla::net::IsValidReferrerPolicy [low]

CVE-2016-5256 - Memory safety bugs fixed in Firefox 49 [critical]

CVE-2016-5257 - Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4 [critical]

CVE-2016-5270 - Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString [high]

CVE-2016-5271 - Out-of-bounds read in PropertyProvider::GetSpacingInternal [low]

CVE-2016-5272 - Bad cast in nsImageGeometryMixin [high]

CVE-2016-5273 - crash in mozilla::a11y::HyperTextAccessible::GetChildOffset [high]

CVE-2016-5274 - use-after-free in nsFrameManager::CaptureFrameState [high]

CVE-2016-5275 - global-buffer-overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions [critical]

CVE-2016-5276 - Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList [high]

CVE-2016-5277 - Heap-use-after-free in nsRefreshDriver::Tick [high]

CVE-2016-5278 - Heap-buffer-overflow in nsBMPEncoder::AddImageFrame [critical]

CVE-2016-5279 - Full local path of files is available to web pages after drag and drop [moderate]

CVE-2016-5280 - Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap [high]

CVE-2016-5281 - use-after-free in DOMSVGLength [high]

CVE-2016-5282 - Don't allow content to request favicons from non-whitelisted schemes [moderate]

CVE-2016-5283 -