Product:

Firefox

(Mozilla)
Repositories • https://github.com/libevent/libevent
• https://github.com/khaledhosny/ots
#Vulnerabilities 2708
Date Id Summary Products Score Patch Annotated
2019-04-15 CVE-2017-7776 Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getClassGlyph. Firefox, Graphite2 8.1
2019-04-15 CVE-2017-7774 Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Silf::readGraphite function. Firefox, Graphite2 9.1
2019-04-15 CVE-2017-7773 Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/Decompressor. Firefox, Graphite2 8.8
2019-04-12 CVE-2017-7772 Heap-based Buffer Overflow in Graphite2 library in Firefox before 54 in lz4::decompress function. Firefox, Graphite2 8.8
2019-04-15 CVE-2017-7771 Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function. Firefox, Graphite2 8.1
2018-06-11 CVE-2017-7770 A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar will not be rendered. This would allow a malicious site to displayed a spoofed addressbar, showing the location of an arbitrary website instead of the one loaded. Note: this issue only affects Firefox for Android. Desktop Firefox is unaffected. This vulnerability affects Firefox < 54. Firefox 5.9
2018-06-11 CVE-2017-7768 The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by convincing the service that it is reading a status file provided by the Mozilla Windows Updater. The Mozilla Maintenance Service executes with privileged access, bypassing system protections against unprivileged users. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects... Firefox, Firefox_esr 5.5
2018-06-11 CVE-2017-7764 Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rendered as their raw "punycode" form, allowing for domain name spoofing attacks through character confusion. The current Unicode standard allows characters from "Aspirational Use Scripts" such as Canadian Syllabics to be mixed with Latin characters in the "moderately restrictive" IDN profile. We have changed Firefox behavior to match the upcoming... Debian_linux, Firefox, Firefox_esr, Thunderbird 5.3
2018-06-11 CVE-2017-7763 Default fonts on OS X display some Tibetan characters as whitespace. When used in the addressbar as part of an IDN this can be used for domain name spoofing attacks. Note: This attack only affects OS X operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. Debian_linux, Firefox, Firefox_esr, Thunderbird 5.3
2018-06-11 CVE-2017-7762 When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar. This can be used for spoofing the domain of the current page. This vulnerability affects Firefox < 54. Firefox, Enterprise_linux_desktop, Enterprise_linux_server, Enterprise_linux_workstation 7.5