Mozilla Firefox vulnerabilities

CVE-2015-7203 [CRITICAL] CWE-119 CVE-2015-7203: Buffer overflow in the DirectWriteFontInfo::LoadFontFamilyData function in gfx/thebes/gfxDWriteFontL Buffer overflow in the DirectWriteFontInfo::LoadFontFamilyData function in gfx/thebes/gfxDWriteFontList.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted font-family name.

CVE-2012-4190 [CRITICAL] CWE-119 CVE-2012-4190: The FT2FontEntry::CreateFontEntry function in FreeType, as used in the Android build of Mozilla Fire The FT2FontEntry::CreateFontEntry function in FreeType, as used in the Android build of Mozilla Firefox before 16.0.1 on CyanogenMod 10, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.

CVE-2021-23988 [HIGH] CWE-787 CVE-2021-23988: Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evid Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 87.

CVE-2020-35114 [HIGH] CWE-787 CVE-2020-35114: Mozilla developers reported memory safety bugs present in Firefox 83. Some of these bugs showed evid Mozilla developers reported memory safety bugs present in Firefox 83. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 84.

CVE-2012-5843 [CRITICAL] CVE-2012-5843: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 17.0, Thunderbi Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2021-29966 [HIGH] CWE-787 CVE-2021-29966: Mozilla developers reported memory safety bugs present in Firefox 88. Some of these bugs showed evid Mozilla developers reported memory safety bugs present in Firefox 88. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 89.

CVE-2017-7776 [HIGH] CWE-125 CVE-2017-7776: Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getCla Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getClassGlyph.

CVE-2021-23972 [HIGH] CVE-2021-23972: One phishing tactic on the web is to provide a link with HTTP Auth. For example 'https://www.phishin One phishing tactic on the web is to provide a link with HTTP Auth. For example 'https://[email protected]'. To mitigate this type of attack, Firefox will display a warning dialog; however, this warning dialog would not have been displayed if evil.com used a redirect that was cached by the browser. This vulnerability affects Firefox < 86.

CVE-2021-29990 [HIGH] CWE-787 CVE-2021-29990: Mozilla developers and community members reported memory safety bugs present in Firefox 90. Some of Mozilla developers and community members reported memory safety bugs present in Firefox 90. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 91.

CVE-2021-29977 [HIGH] CWE-787 CVE-2021-29977: Mozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed evid Mozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 90.

CVE-2015-2728 [HIGH] CVE-2015-2728: The IndexedDatabaseManager class in the IndexedDB implementation in Mozilla Firefox before 39.0 and The IndexedDatabaseManager class in the IndexedDB implementation in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 misinterprets an unspecified IDBDatabase field as a pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors, r

CVE-2021-23965 [HIGH] CWE-787 CVE-2021-23965: Mozilla developers reported memory safety bugs present in Firefox 84. Some of these bugs showed evid Mozilla developers reported memory safety bugs present in Firefox 84. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 85.

CVE-2023-4052 [MEDIUM] CWE-59 CVE-2023-4052: The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted with the permissions of the uninstalling user account. This could be combined with creation of a junction (a form of symbolic link) to allow arbitrary file deletion controlled by the non-privilege

CVE-2013-1722 [CRITICAL] CWE-399 CVE-2013-1722: Use-after-free vulnerability in the nsAnimationManager::BuildAnimations function in the Animation Ma Use-after-free vulnerability in the nsAnimationManager::BuildAnimations function in the Animation Manager in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory co

CVE-2021-23979 [HIGH] CWE-787 CVE-2021-23979: Mozilla developers reported memory safety bugs present in Firefox 85. Some of these bugs showed evid Mozilla developers reported memory safety bugs present in Firefox 85. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 86.

CVE-2021-29947 [HIGH] CWE-787 CVE-2021-29947: Mozilla developers and community members reported memory safety bugs present in Firefox 87. Some of Mozilla developers and community members reported memory safety bugs present in Firefox 87. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 88.

CVE-2021-38499 [HIGH] CWE-787 CVE-2021-38499: Mozilla developers reported memory safety bugs present in Firefox 92. Some of these bugs showed evid Mozilla developers reported memory safety bugs present in Firefox 92. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 93.

CVE-2021-38494 [HIGH] CWE-787 CVE-2021-38494: Mozilla developers reported memory safety bugs present in Firefox 91. Some of these bugs showed evid Mozilla developers reported memory safety bugs present in Firefox 91. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 92.

CVE-2009-3986 [HIGH] CWE-94 CVE-2009-3986: Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote atta Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to execute arbitrary JavaScript with chrome privileges by leveraging a reference to a chrome window from a content window, related to the window.opener property.

CVE-2018-5177 [HIGH] CWE-119 CVE-2018-5177: A vulnerability exists in XSLT during number formatting where a negative buffer size may be allocate A vulnerability exists in XSLT during number formatting where a negative buffer size may be allocated in some instances, leading to a buffer overflow and crash if it occurs. This vulnerability affects Firefox < 60.