Product:

Firefox

(Mozilla)
Repositories • https://github.com/libevent/libevent
• https://github.com/khaledhosny/ots
#Vulnerabilities 2726
Date Id Summary Products Score Patch Annotated
2015-08-15 CVE-2015-4496 Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file, a related issue to CVE-2015-1538. Firefox, Solaris N/A
2015-08-15 CVE-2015-4490 The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not implement the Content Security Policy Level 2 exceptions for the blob, data, and filesystem URL schemes during wildcard source-expression matching, which might make it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging unexpected policy-enforcement behavior. Ubuntu_linux, Firefox, Opensuse, Solaris N/A
2015-08-15 CVE-2015-4483 Mozilla Firefox before 40.0 allows man-in-the-middle attackers to bypass a mixed-content protection mechanism via a feed: URL in a POST request. Firefox, Opensuse, Solaris N/A
2015-08-15 CVE-2015-4477 Use-after-free vulnerability in the MediaStream playback feature in Mozilla Firefox before 40.0 allows remote attackers to execute arbitrary code via unspecified use of the Web Audio API. Ubuntu_linux, Firefox, Opensuse N/A
2015-09-24 CVE-2015-4476 Mozilla Firefox before 41.0 on Android allows user-assisted remote attackers to spoof address-bar attributes by leveraging lack of navigation after a paste of a URL with a nonstandard scheme, as demonstrated by spoofing an SSL attribute. Firefox N/A
2015-08-15 CVE-2015-4474 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 40.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Ubuntu_linux, Firefox, Opensuse N/A
2015-05-14 CVE-2015-2720 The update implementation in Mozilla Firefox before 38.0 on Windows does not ensure that the pathname for updater.exe corresponds to the application directory, which might allow local users to gain privileges via a Trojan horse file. Firefox N/A
2015-05-14 CVE-2015-2718 The WebChannel.jsm module in Mozilla Firefox before 38.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive webchannel-response data via a crafted web site containing an IFRAME element referencing a different web site that is intended to read this data. Firefox, Opensuse N/A
2015-05-14 CVE-2015-2717 Integer overflow in libstagefright in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and out-of-bounds read) via an MP4 video file containing invalid metadata. Firefox, Opensuse N/A
2015-05-14 CVE-2015-2715 Race condition in the nsThreadManager::RegisterCurrentThread function in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) by leveraging improper Media Decoder Thread creation at the time of a shutdown. Firefox, Opensuse N/A