= 9)

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2020-26968	787	Mem. Corr.	2020-12-09	2020-12-10	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
2	CVE-2020-26960	416		2020-12-09	2020-12-10	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
3	CVE-2020-26950	416		2020-12-09	2022-04-08	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. This vulnerability affects Firefox < 82.0.3, Firefox ESR < 78.4.1, and Thunderbird < 78.4.2.
4	CVE-2020-15663	427	Exec Code	2020-10-01	2022-07-12	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back to a previous version which would have allowed exploitation of an older bug and arbitrary code execution with System Privileges. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, and Firefox ESR < 78.2.
5	CVE-2020-15659	787	Mem. Corr.	2020-08-10	2020-08-21	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1.
6	CVE-2020-15656	843		2020-08-10	2023-02-02	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the code, resulting in this bug rated at only moderate severity. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
7	CVE-2020-12420	362	Mem. Corr.	2020-07-09	2022-05-03	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.
8	CVE-2020-12419	416	Mem. Corr.	2020-07-09	2023-01-27	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.
9	CVE-2020-12417	787	Mem. Corr.	2020-07-09	2022-05-03	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash. Note: this issue only affects Firefox on ARM64 platforms. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.
10	CVE-2020-12410	787	Mem. Corr.	2020-07-09	2022-05-03	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.
11	CVE-2020-12406	345		2020-07-09	2023-01-27	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.
12	CVE-2020-12395	787	Mem. Corr.	2020-05-26	2022-04-26	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.
13	CVE-2019-11752	416		2019-09-27	2019-10-04	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.
14	CVE-2019-11708	20		2019-07-23	2019-08-15	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.
15	CVE-2017-7826	119	Overflow Mem. Corr.	2018-06-11	2018-08-01	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Memory safety bugs were reported in Firefox 56 and Firefox ESR 52.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5.
16	CVE-2017-7810	119	Overflow Mem. Corr.	2018-06-11	2018-08-01	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Memory safety bugs were reported in Firefox 55 and Firefox ESR 52.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.
17	CVE-2017-7779	119	Overflow Mem. Corr.	2018-06-11	2018-08-01	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Memory safety bugs were reported in Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
18	CVE-2017-5398	119	Overflow Mem. Corr.	2018-06-11	2018-08-01	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Memory safety bugs were reported in Thunderbird 45.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.
19	CVE-2016-2807	119	DoS Exec Code Overflow Mem. Corr.	2016-04-30	2018-10-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
20	CVE-2016-2805	119	DoS Exec Code Overflow Mem. Corr.	2016-04-30	2017-07-01	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Unspecified vulnerability in the browser engine in Mozilla Firefox ESR 38.x before 38.8 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
21	CVE-2016-2804	119	DoS Exec Code Overflow Mem. Corr.	2016-04-30	2017-07-01	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
22	CVE-2016-2799	119	DoS Overflow	2016-03-13	2019-12-27	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font.
23	CVE-2016-2794	119	DoS Overflow	2016-03-13	2019-12-27	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
The graphite2::TtfUtil::CmapSubtable12NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
24	CVE-2016-1962		Exec Code	2016-03-13	2019-12-27	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of WebRTC data-channel connections.
25	CVE-2016-1935	119	Exec Code Overflow	2016-01-31	2019-12-27	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Buffer overflow in the BufferSubData function in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 allows remote attackers to execute arbitrary code via crafted WebGL content.
26	CVE-2016-1930	119	DoS Exec Code Overflow Mem. Corr.	2016-01-31	2019-12-27	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
27	CVE-2016-1522	119	DoS Exec Code Overflow	2016-02-13	2017-07-01	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.
28	CVE-2015-7205	189	DoS +Info	2015-12-16	2018-10-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Integer underflow in the RTPReceiverVideo::ParseRtpPacket function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 might allow remote attackers to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a crafted WebRTC RTP packet.
29	CVE-2015-7201	119	DoS Exec Code Overflow Mem. Corr.	2015-12-16	2018-10-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
30	CVE-2015-4497		Exec Code	2015-08-29	2016-12-22	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute arbitrary code by leveraging improper interaction between resize events and changes to Cascading Style Sheets (CSS) token sequences for a CANVAS element.
31	CVE-2015-4493	119	Exec Code Overflow	2015-08-16	2018-10-30	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Heap-based buffer overflow in the stagefright::ESDS::parseESDescriptor function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via an invalid size field in an esds chunk in MPEG-4 video data, a related issue to CVE-2015-1539.
32	CVE-2015-4486	119	DoS Exec Code Overflow	2015-08-16	2018-10-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The decrease_ref_count function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via malformed WebM video data.
33	CVE-2015-4485	119	Exec Code Overflow	2015-08-16	2018-10-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Heap-based buffer overflow in the resize_context_buffers function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via malformed WebM video data.
34	CVE-2015-4480	189	Exec Code Overflow	2015-08-16	2018-10-30	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Integer overflow in the stagefright::SampleTable::isValid function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via crafted MPEG-4 video data with H.264 encoding.
35	CVE-2015-4479	189	Exec Code Overflow	2015-08-16	2018-10-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Multiple integer overflows in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allow remote attackers to execute arbitrary code via a crafted saio chunk in MPEG-4 video data.
36	CVE-2015-4473	119	DoS Exec Code Overflow Mem. Corr.	2015-08-16	2018-10-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
37	CVE-2015-2740	119	DoS Overflow	2015-07-06	2016-12-28	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 might allow remote attackers to cause a denial of service or have unspecified other impact via unknown vectors.
38	CVE-2015-2739	119	Overflow	2015-07-06	2016-12-28	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The ArrayBufferBuilder::append function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which has unspecified impact and attack vectors.
39	CVE-2015-2738	17		2015-07-06	2018-10-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.
40	CVE-2015-2737	17		2015-07-06	2018-10-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The rx::d3d11::SetBufferData function in the Direct3D 11 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.
41	CVE-2015-2736	17		2015-07-06	2016-12-28	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive.
42	CVE-2015-2735	17		2015-07-06	2016-12-28	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
nsZipArchive.cpp in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive.
43	CVE-2015-2734	17		2015-07-06	2018-10-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The CairoTextureClientD3D9::BorrowDrawTarget function in the Direct3D 9 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.
44	CVE-2015-2733		Exec Code	2015-07-06	2016-12-28	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a dedicated worker.
45	CVE-2015-2731		Exec Code	2015-07-06	2016-12-28	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allows remote attackers to execute arbitrary code by leveraging client-side JavaScript that triggers removal of a DOM object on the basis of a Content Policy.
46	CVE-2015-2725	119	DoS Exec Code Overflow Mem. Corr.	2015-07-06	2016-12-28	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
47	CVE-2015-2724	119	DoS Exec Code Overflow Mem. Corr.	2015-07-06	2016-12-28	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
48	CVE-2015-2722		Exec Code	2015-07-06	2016-12-28	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a shared worker.
49	CVE-2014-1567		Exec Code	2014-09-03	2017-01-07	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout.
50	CVE-2014-1563	416	DoS Exec Code Mem. Corr.	2014-09-03	2018-10-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Use-after-free vulnerability in the mozilla::DOMSVGLength::GetTearOff function in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG animation with DOM interaction that triggers incorrect cycle collection.

Total number of vulnerabilities : 211 Page : 1 (This Page)2 3 4 5