FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-04-25 21:13:12 UTC

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML ID	Description
99029172-8253-407d-9d8b-2cfeab9abf81	mozilla -- multiple vulnerabilities The Mozilla Project reports: MFSA-2015-11 Miscellaneous memory safety hazards (rv:36.0 / rv:31.5) MFSA-2015-12 Invoking Mozilla updater will load locally stored DLL files MFSA-2015-13 Appended period to hostnames can bypass HPKP and HSTS protections MFSA-2015-14 Malicious WebGL content crash when writing strings MFSA-2015-15 TLS TURN and STUN connections silently fail to simple TCP connections MFSA-2015-16 Use-after-free in IndexedDB MFSA-2015-17 Buffer overflow in libstagefright during MP4 video playback MFSA-2015-18 Double-free when using non-default memory allocators with a zero-length XHR MFSA-2015-19 Out-of-bounds read and write while rendering SVG content MFSA-2015-20 Buffer overflow during CSS restyling MFSA-2015-21 Buffer underflow during MP3 playback MFSA-2015-22 Crash using DrawTarget in Cairo graphics library MFSA-2015-23 Use-after-free in Developer Console date with OpenType Sanitiser MFSA-2015-24 Reading of local files through manipulation of form autocomplete MFSA-2015-25 Local files or privileged URLs in pages can be opened into new tabs MFSA-2015-26 UI Tour whitelisted sites in background tab can spoof foreground tabs MFSA-2015-27 Caja Compiler JavaScript sandbox bypass Discovery 2015-02-24 Entry 2015-02-27 firefox < 36.0,1 firefox-esr < 31.5.0,1 linux-firefox < 36.0,1 linux-seamonkey < 2.33 linux-thunderbird < 31.5.0 seamonkey < 2.33 thunderbird < 31.5.0 libxul < 31.5.0 CVE-2015-0819 CVE-2015-0820 CVE-2015-0821 CVE-2015-0822 CVE-2015-0823 CVE-2015-0824 CVE-2015-0825 CVE-2015-0826 CVE-2015-0827 CVE-2015-0828 CVE-2015-0829 CVE-2015-0830 CVE-2015-0831 CVE-2015-0832 CVE-2015-0833 CVE-2015-0834 CVE-2015-0835 CVE-2015-0836 https://www.mozilla.org/security/advisories/mfsa2015-11/ https://www.mozilla.org/security/advisories/mfsa2015-12/ https://www.mozilla.org/security/advisories/mfsa2015-13/ https://www.mozilla.org/security/advisories/mfsa2015-14/ https://www.mozilla.org/security/advisories/mfsa2015-15/ https://www.mozilla.org/security/advisories/mfsa2015-16/ https://www.mozilla.org/security/advisories/mfsa2015-17/ https://www.mozilla.org/security/advisories/mfsa2015-18/ https://www.mozilla.org/security/advisories/mfsa2015-19/ https://www.mozilla.org/security/advisories/mfsa2015-20/ https://www.mozilla.org/security/advisories/mfsa2015-21/ https://www.mozilla.org/security/advisories/mfsa2015-22/ https://www.mozilla.org/security/advisories/mfsa2015-23/ https://www.mozilla.org/security/advisories/mfsa2015-24/ https://www.mozilla.org/security/advisories/mfsa2015-25/ https://www.mozilla.org/security/advisories/mfsa2015-26/ https://www.mozilla.org/security/advisories/mfsa2015-27/ https://www.mozilla.org/security/advisories/
d0c97697-df2c-4b8b-bff2-cec24dc35af8	mozilla -- multiple vulnerabilities The Mozilla Project reports: MFSA-2015-30 Miscellaneous memory safety hazards (rv:37.0 / rv:31.6) MFSA-2015-31 Use-after-free when using the Fluendo MP3 GStreamer plugin MFSA-2015-32 Add-on lightweight theme installation approval bypassed through MITM attack MFSA-2015-33 resource:// documents can load privileged pages MFSA-2015-34 Out of bounds read in QCMS library MFSA-2015-35 Cursor clickjacking with flash and images MFSA-2015-36 Incorrect memory management for simple-type arrays in WebRTC MFSA-2015-37 CORS requests should not follow 30x redirections after preflight MFSA-2015-38 Memory corruption crashes in Off Main Thread Compositing MFSA-2015-39 Use-after-free due to type confusion flaws MFSA-2015-40 Same-origin bypass through anchor navigation MFSA-2015-41 PRNG weakness allows for DNS poisoning on Android MFSA-2015-42 Windows can retain access to privileged content on navigation to unprivileged pages Discovery 2015-03-31 Entry 2015-03-31 firefox < 37.0,1 firefox-esr < 31.6.0,1 linux-firefox < 37.0,1 linux-seamonkey < 2.34 linux-thunderbird < 31.6.0 seamonkey < 2.34 thunderbird < 31.6.0 libxul < 31.6.0 CVE-2012-2808 CVE-2015-0800 CVE-2015-0801 CVE-2015-0802 CVE-2015-0803 CVE-2015-0804 CVE-2015-0805 CVE-2015-0806 CVE-2015-0807 CVE-2015-0808 CVE-2015-0810 CVE-2015-0811 CVE-2015-0812 CVE-2015-0813 CVE-2015-0814 CVE-2015-0815 CVE-2015-0816 https://www.mozilla.org/security/advisories/mfsa2015-30/ https://www.mozilla.org/security/advisories/mfsa2015-31/ https://www.mozilla.org/security/advisories/mfsa2015-32/ https://www.mozilla.org/security/advisories/mfsa2015-33/ https://www.mozilla.org/security/advisories/mfsa2015-34/ https://www.mozilla.org/security/advisories/mfsa2015-35/ https://www.mozilla.org/security/advisories/mfsa2015-36/ https://www.mozilla.org/security/advisories/mfsa2015-37/ https://www.mozilla.org/security/advisories/mfsa2015-38/ https://www.mozilla.org/security/advisories/mfsa2015-39/ https://www.mozilla.org/security/advisories/mfsa2015-40/ https://www.mozilla.org/security/advisories/mfsa2015-41/ https://www.mozilla.org/security/advisories/mfsa2015-42/ https://www.mozilla.org/security/advisories/
44d9daee-940c-4179-86bb-6e3ffd617869	mozilla -- multiple vulnerabilities The Mozilla Project reports: MFSA 2015-59 Miscellaneous memory safety hazards (rv:39.0 / rv:31.8 / rv:38.1) MFSA 2015-60 Local files or privileged URLs in pages can be opened into new tabs MFSA 2015-61 Type confusion in Indexed Database Manager MFSA 2015-62 Out-of-bound read while computing an oscillator rendering range in Web Audio MFSA 2015-63 Use-after-free in Content Policy due to microtask execution error MFSA 2015-64 ECDSA signature validation fails to handle some signatures correctly MFSA 2015-65 Use-after-free in workers while using XMLHttpRequest MFSA 2015-66 Vulnerabilities found through code inspection MFSA 2015-67 Key pinning is ignored when overridable errors are encountered MFSA 2015-68 OS X crash reports may contain entered key press information MFSA 2015-69 Privilege escalation through internal workers MFSA 2015-70 NSS accepts export-length DHE keys with regular DHE cipher suites MFSA 2015-71 NSS incorrectly permits skipping of ServerKeyExchange Discovery 2015-07-02 Entry 2015-07-16 Modified 2015-09-22 firefox < 39.0,1 linux-firefox < 39.0,1 seamonkey < 2.35 linux-seamonkey < 2.35 firefox-esr < 31.8.0,1 ge 38.0,1 lt 38.1.0,1 libxul < 31.8.0 ge 38.0 lt 38.1.0 thunderbird < 31.8.0 ge 38.0 lt 38.1.0 linux-thunderbird < 31.8.0 ge 38.0 lt 38.1.0 CVE-2015-2721 CVE-2015-2722 CVE-2015-2724 CVE-2015-2725 CVE-2015-2726 CVE-2015-2727 CVE-2015-2728 CVE-2015-2729 CVE-2015-2730 CVE-2015-2731 CVE-2015-2733 CVE-2015-2734 CVE-2015-2735 CVE-2015-2736 CVE-2015-2737 CVE-2015-2738 CVE-2015-2739 CVE-2015-2740 CVE-2015-2741 CVE-2015-2742 CVE-2015-2743 CVE-2015-4000 https://www.mozilla.org/security/advisories/mfsa2015-59/ https://www.mozilla.org/security/advisories/mfsa2015-60/ https://www.mozilla.org/security/advisories/mfsa2015-61/ https://www.mozilla.org/security/advisories/mfsa2015-62/ https://www.mozilla.org/security/advisories/mfsa2015-63/ https://www.mozilla.org/security/advisories/mfsa2015-64/ https://www.mozilla.org/security/advisories/mfsa2015-65/ https://www.mozilla.org/security/advisories/mfsa2015-66/ https://www.mozilla.org/security/advisories/mfsa2015-67/ https://www.mozilla.org/security/advisories/mfsa2015-68/ https://www.mozilla.org/security/advisories/mfsa2015-69/ https://www.mozilla.org/security/advisories/mfsa2015-70/ https://www.mozilla.org/security/advisories/mfsa2015-71/
8eee06d4-c21d-4f07-a669-455151ff426f	mozilla -- multiple vulnerabilities The Mozilla Project reports: MFSA 2015-78 Same origin violation and local file stealing via PDF reader Discovery 2015-08-06 Entry 2015-08-07 firefox < 39.0.3,1 linux-firefox < 39.0.3,1 firefox-esr < 38.1.1,1 CVE-2015-4495 https://www.mozilla.org/security/advisories/mfsa2015-78/
d9b43004-f5fd-4807-b1d7-dbf66455b244	mozilla -- multiple vulnerabilities The Mozilla Project reports: MFSA-2015-46 Miscellaneous memory safety hazards (rv:38.0 / rv:31.7) MFSA-2015-47 Buffer overflow parsing H.264 video with Linux Gstreamer MFSA-2015-48 Buffer overflow with SVG content and CSS MFSA-2015-49 Referrer policy ignored when links opened by middle-click and context menu MFSA-2015-50 Out-of-bounds read and write in asm.js validation MFSA-2015-51 Use-after-free during text processing with vertical text enabled MFSA-2015-52 Sensitive URL encoded information written to Android logcat MFSA-2015-53 Use-after-free due to Media Decoder Thread creation during shutdown MFSA-2015-54 Buffer overflow when parsing compressed XML MFSA-2015-55 Buffer overflow and out-of-bounds read while parsing MP4 video metadata MFSA-2015-56 Untrusted site hosting trusted page can intercept webchannel responses MFSA-2015-57 Privilege escalation through IPC channel messages MFSA-2015-58 Mozilla Windows updater can be run outside of application directory MFSA 2015-93 Integer overflows in libstagefright while processing MP4 video metadata Discovery 2015-05-12 Entry 2015-05-12 Modified 2015-08-28 firefox < 38.0,1 linux-firefox < 38.0,1 seamonkey < 2.35 linux-seamonkey < 2.35 firefox-esr < 31.7.0,1 libxul < 31.7.0 ge 32.0 lt 38.0 thunderbird < 31.7.0 ge 32.0 lt 38.0 linux-thunderbird < 31.7.0 ge 32.0 lt 38.0 CVE-2011-3079 CVE-2015-0797 CVE-2015-0833 CVE-2015-2708 CVE-2015-2709 CVE-2015-2710 CVE-2015-2711 CVE-2015-2712 CVE-2015-2713 CVE-2015-2714 CVE-2015-2715 CVE-2015-2716 CVE-2015-2717 CVE-2015-2718 CVE-2015-2720 CVE-2015-4496 https://www.mozilla.org/security/advisories/mfsa2015-46/ https://www.mozilla.org/security/advisories/mfsa2015-47/ https://www.mozilla.org/security/advisories/mfsa2015-48/ https://www.mozilla.org/security/advisories/mfsa2015-49/ https://www.mozilla.org/security/advisories/mfsa2015-50/ https://www.mozilla.org/security/advisories/mfsa2015-51/ https://www.mozilla.org/security/advisories/mfsa2015-52/ https://www.mozilla.org/security/advisories/mfsa2015-53/ https://www.mozilla.org/security/advisories/mfsa2015-54/ https://www.mozilla.org/security/advisories/mfsa2015-55/ https://www.mozilla.org/security/advisories/mfsa2015-56/ https://www.mozilla.org/security/advisories/mfsa2015-57/ https://www.mozilla.org/security/advisories/mfsa2015-58/ https://www.mozilla.org/security/advisories/mfsa2015-93/
738fc80d-5f13-4ccb-aa9a-7965699e5a10	mozilla -- use-after-free The Mozilla Project reports: MFSA 2015-45 Memory corruption during failed plugin initialization Discovery 2015-04-20 Entry 2015-04-21 firefox < 37.0.2,1 linux-firefox < 37.0.2,1 CVE-2015-2706 https://www.mozilla.org/en-US/security/advisories/mfsa2015-45/
9c1495ac-8d8c-4789-a0f3-8ca6b476619c	mozilla -- multiple vulnerabilities The Mozilla Project reports: MFSA 2014-74 Miscellaneous memory safety hazards (rv:33.0 / rv:31.2) MFSA 2014-75 Buffer overflow during CSS manipulation MFSA 2014-76 Web Audio memory corruption issues with custom waveforms MFSA 2014-78 Further uninitialized memory use during GIF MFSA 2014-79 Use-after-free interacting with text directionality MFSA 2014-80 Key pinning bypasses MFSA 2014-81 Inconsistent video sharing within iframe MFSA 2014-82 Accessing cross-origin objects via the Alarms API Discovery 2014-10-14 Entry 2014-10-14 Modified 2015-08-12 firefox < 33.0,1 firefox-esr < 31.2.0,1 linux-firefox < 33.0,1 linux-seamonkey < 2.30 linux-thunderbird < 31.2.0 seamonkey < 2.30 thunderbird < 31.2.0 libxul < 31.2.0 CVE-2014-1575 CVE-2014-1574 CVE-2014-1576 CVE-2014-1577 CVE-2014-1580 CVE-2014-1581 CVE-2014-1582 CVE-2014-1583 CVE-2014-1584 CVE-2014-1585 CVE-2014-1586 https://www.mozilla.org/security/announce/2014/mfsa2014-74.html https://www.mozilla.org/security/announce/2014/mfsa2014-75.html https://www.mozilla.org/security/announce/2014/mfsa2014-76.html https://www.mozilla.org/security/announce/2014/mfsa2014-78.html https://www.mozilla.org/security/announce/2014/mfsa2014-79.html https://www.mozilla.org/security/announce/2014/mfsa2014-80.html https://www.mozilla.org/security/announce/2014/mfsa2014-81.html https://www.mozilla.org/security/announce/2014/mfsa2014-82.html https://www.mozilla.org/security/announce/
b8321d76-24e7-4b72-a01d-d12c4445d826	mozilla -- multiple vulnerabilities The Mozilla Project reports: MFSA 2015-44 Certificate verification bypass through the HTTP/2 Alt-Svc header MFSA 2015-43 Loading privileged content through Reader mode Discovery 2015-04-03 Entry 2015-04-04 firefox < 37.0.1,1 linux-firefox < 37.0.1,1 CVE-2015-0798 CVE-2015-0799 https://www.mozilla.org/security/advisories/mfsa2015-43/ https://www.mozilla.org/security/advisories/mfsa2015-44/ https://www.mozilla.org/security/advisories/
7ae61870-9dd2-4884-a2f2-f19bb5784d09	mozilla -- multiple vulnerabilities The Mozilla Project reports: ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data MFSA-2014-90 Apple CoreGraphics framework on OS X 10.10 logging input data to /tmp directory MFSA-2014-89 Bad casting from the BasicThebesLayer to BasicContainerLayer MFSA-2014-88 Buffer overflow while parsing media content MFSA-2014-87 Use-after-free during HTML5 parsing MFSA-2014-86 CSP leaks redirect data via violation reports MFSA-2014-85 XMLHttpRequest crashes with some input streams MFSA-2014-84 XBL bindings accessible via improper CSS declarations MFSA-2014-83 Miscellaneous memory safety hazards (rv:34.0 / rv:31.3) Discovery 2014-12-01 Entry 2014-12-02 firefox < 34.0,1 firefox-esr < 31.3.0,1 linux-firefox < 34.0,1 linux-seamonkey < 2.31 linux-thunderbird < 31.3.0 seamonkey < 2.31 thunderbird < 31.3.0 libxul < 31.3.0 nss < 3.17.3 CVE-2014-1587 CVE-2014-1588 CVE-2014-1589 CVE-2014-1590 CVE-2014-1591 CVE-2014-1592 CVE-2014-1593 CVE-2014-1594 CVE-2014-1595 CVE-2014-1569 https://www.mozilla.org/security/advisories/mfsa2014-83 https://www.mozilla.org/security/advisories/mfsa2014-84 https://www.mozilla.org/security/advisories/mfsa2014-85 https://www.mozilla.org/security/advisories/mfsa2014-86 https://www.mozilla.org/security/advisories/mfsa2014-87 https://www.mozilla.org/security/advisories/mfsa2014-88 https://www.mozilla.org/security/advisories/mfsa2014-89 https://www.mozilla.org/security/advisories/mfsa2014-90 https://www.mozilla.org/security/advisories/
42c98cef-62b1-4b8b-9065-f4621e08d526	libvpx -- out-of-bounds write The Mozilla Project reports: Using the Address Sanitizer tool, security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team found an out-of-bounds write when buffering WebM format video containing frames with invalid tile sizes. This can lead to a potentially exploitable crash during WebM video playback. Discovery 2014-10-14 Entry 2015-08-12 libvpx < 1.4.0 firefox < 33.0,1 firefox-esr < 31.1.2,1 linux-firefox < 33.0,1 linux-seamonkey < 2.30 linux-thunderbird < 31.1.2 seamonkey < 2.30 thunderbird < 31.1.2 libxul < 31.1.2 CVE-2014-1578 https://www.mozilla.org/security/advisories/mfsa2014-77/ https://hg.mozilla.org/releases/mozilla-esr31/rev/6023f0b4f8ba
237a201c-888b-487f-84d3-7d92266381d6	mozilla -- multiple vulnerabilities The Mozilla Project reports: MFSA 2015-95 Add-on notification bypass through data URLs MFSA 2015-94 Use-after-free when resizing canvas element during restyling Discovery 2015-08-27 Entry 2015-08-28 firefox < 40.0.3,1 linux-firefox < 40.0.3,1 firefox-esr < 38.2.1,1 CVE-2015-4497 CVE-2015-4498 https://www.mozilla.org/security/advisories/mfsa2015-94/ https://www.mozilla.org/security/advisories/mfsa2015-95/
76ff65f4-17ca-4d3f-864a-a3d6026194fb	mozilla -- multiple vulnerabilities The Mozilla Project reports: MFSA-2015-28 Privilege escalation through SVG navigation MFSA-2015-29 Code execution through incorrect JavaScript bounds checking elimination Discovery 2015-03-20 Entry 2015-03-22 firefox < 36.0.4,1 firefox-esr < 31.5.3,1 linux-firefox < 36.0.4,1 linux-seamonkey < 2.33.1 seamonkey < 2.33.1 libxul < 31.5.3 CVE-2015-0817 CVE-2015-0818 https://www.mozilla.org/security/advisories/mfsa2015-28/ https://www.mozilla.org/security/advisories/mfsa2015-29/ https://www.mozilla.org/security/advisories/
c66a5632-708a-4727-8236-d65b2d5b2739	mozilla -- multiple vulnerabilities The Mozilla Project reports: MFSA 2015-79 Miscellaneous memory safety hazards (rv:40.0 / rv:38.2) MFSA 2015-80 Out-of-bounds read with malformed MP3 file MFSA 2015-81 Use-after-free in MediaStream playback MFSA 2015-82 Redefinition of non-configurable JavaScript object properties MFSA 2015-83 Overflow issues in libstagefright MFSA 2015-84 Arbitrary file overwriting through Mozilla Maintenance Service with hard links MFSA 2015-85 Out-of-bounds write with Updater and malicious MAR file MFSA 2015-86 Feed protocol with POST bypasses mixed content protections MFSA 2015-87 Crash when using shared memory in JavaScript MFSA 2015-88 Heap overflow in gdk-pixbuf when scaling bitmap images MFSA 2015-90 Vulnerabilities found through code inspection MFSA 2015-91 Mozilla Content Security Policy allows for asterisk wildcards in violation of CSP specification MFSA 2015-92 Use-after-free in XMLHttpRequest with shared workers Discovery 2015-08-11 Entry 2015-08-11 Modified 2015-08-22 firefox < 40.0,1 linux-firefox < 40.0,1 seamonkey ge 2.36 lt 2.37 < 2.35 linux-seamonkey ge 2.36 lt 2.37 < 2.35 firefox-esr < 38.2.0,1 libxul < 38.2.0 thunderbird < 38.2.0 linux-thunderbird < 38.2.0 CVE-2015-4473 CVE-2015-4474 CVE-2015-4475 CVE-2015-4477 CVE-2015-4478 CVE-2015-4479 CVE-2015-4480 CVE-2015-4481 CVE-2015-4482 CVE-2015-4483 CVE-2015-4484 CVE-2015-4487 CVE-2015-4488 CVE-2015-4489 CVE-2015-4490 CVE-2015-4491 CVE-2015-4492 CVE-2015-4493 https://www.mozilla.org/security/advisories/mfsa2015-79/ https://www.mozilla.org/security/advisories/mfsa2015-80/ https://www.mozilla.org/security/advisories/mfsa2015-81/ https://www.mozilla.org/security/advisories/mfsa2015-82/ https://www.mozilla.org/security/advisories/mfsa2015-83/ https://www.mozilla.org/security/advisories/mfsa2015-84/ https://www.mozilla.org/security/advisories/mfsa2015-85/ https://www.mozilla.org/security/advisories/mfsa2015-86/ https://www.mozilla.org/security/advisories/mfsa2015-87/ https://www.mozilla.org/security/advisories/mfsa2015-88/ https://www.mozilla.org/security/advisories/mfsa2015-90/ https://www.mozilla.org/security/advisories/mfsa2015-91/ https://www.mozilla.org/security/advisories/mfsa2015-92/
bd62c640-9bb9-11e4-a5ad-000c297fb80f	mozilla -- multiple vulnerabilities The Mozilla Project reports: MFSA-2015-01 Miscellaneous memory safety hazards (rv:35.0 / rv:31.4) MFSA-2015-02 Uninitialized memory use during bitmap rendering MFSA-2015-03 sendBeacon requests lack an Origin header MFSA-2015-04 Cookie injection through Proxy Authenticate responses MFSA-2015-05 Read of uninitialized memory in Web Audio MFSA-2015-06 Read-after-free in WebRTC MFSA-2015-07 Gecko Media Plugin sandbox escape MFSA-2015-08 Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension MFSA-2015-09 XrayWrapper bypass through DOM objects Discovery 2015-01-13 Entry 2015-01-14 firefox < 35.0,1 firefox-esr < 31.4.0,1 linux-firefox < 35.0,1 linux-seamonkey < 2.32 linux-thunderbird < 31.4.0 seamonkey < 2.32 thunderbird < 31.4.0 libxul < 31.4.0 CVE-2014-8634 CVE-2014-8635 CVE-2014-8637 CVE-2014-8638 CVE-2014-8639 CVE-2014-8640 CVE-2014-8641 CVE-2014-8642 CVE-2014-8643 CVE-2014-8636 https://www.mozilla.org/en-US/security/advisories/mfsa2015-01/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-02/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-03/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-04/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-05/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-06/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-07/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-08/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-09/ https://www.mozilla.org/security/advisories/
34e60332-2448-4ed6-93f0-12713749f250	libvpx -- multiple buffer overflows The Mozilla Project reports: Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover two buffer overflow issues in the Libvpx library used for WebM video when decoding a malformed WebM video file. These buffer overflows result in potentially exploitable crashes. Discovery 2015-08-11 Entry 2015-08-11 Modified 2015-08-14 libvpx < 1.4.0.488 firefox < 40.0,1 linux-firefox < 40.0,1 CVE-2015-4485 CVE-2015-4486 https://www.mozilla.org/security/advisories/mfsa2015-89/
2d56c7f4-b354-428f-8f48-38150c607a05	mozilla -- multiple vulnerabilities The Mozilla Project reports: MFSA 2015-96 Miscellaneous memory safety hazards (rv:41.0 / rv:38.3) MFSA 2015-97 Memory leak in mozTCPSocket to servers MFSA 2015-98 Out of bounds read in QCMS library with ICC V4 profile attributes MFSA 2015-99 Site attribute spoofing on Android by pasting URL with unknown scheme MFSA 2015-100 Arbitrary file manipulation by local user through Mozilla updater MFSA 2015-101 Buffer overflow in libvpx while parsing vp9 format video MFSA 2015-102 Crash when using debugger with SavedStacks in JavaScript MFSA 2015-103 URL spoofing in reader mode MFSA 2015-104 Use-after-free with shared workers and IndexedDB MFSA 2015-105 Buffer overflow while decoding WebM video MFSA 2015-106 Use-after-free while manipulating HTML media content MFSA 2015-107 Out-of-bounds read during 2D canvas display on Linux 16-bit color depth systems MFSA 2015-108 Scripted proxies can access inner window MFSA 2015-109 JavaScript immutable property enforcement can be bypassed MFSA 2015-110 Dragging and dropping images exposes final URL after redirects MFSA 2015-111 Errors in the handling of CORS preflight request headers MFSA 2015-112 Vulnerabilities found through code inspection MFSA 2015-113 Memory safety errors in libGLES in the ANGLE graphics library MFSA 2015-114 Information disclosure via the High Resolution Time API Discovery 2015-09-22 Entry 2015-09-22 firefox < 41.0,1 linux-firefox < 41.0,1 seamonkey < 2.38 linux-seamonkey < 2.38 firefox-esr < 38.3.0,1 libxul < 38.3.0 thunderbird < 38.3.0 linux-thunderbird < 38.3.0 CVE-2015-4476 CVE-2015-4500 CVE-2015-4501 CVE-2015-4502 CVE-2015-4503 CVE-2015-4504 CVE-2015-4505 CVE-2015-4506 CVE-2015-4507 CVE-2015-4508 CVE-2015-4509 CVE-2015-4510 CVE-2015-4512 CVE-2015-4516 CVE-2015-4517 CVE-2015-4519 CVE-2015-4520 CVE-2015-4521 CVE-2015-4522 CVE-2015-7174 CVE-2015-7175 CVE-2015-7176 CVE-2015-7177 CVE-2015-7178 CVE-2015-7179 CVE-2015-7180 https://www.mozilla.org/security/advisories/mfsa2015-96/ https://www.mozilla.org/security/advisories/mfsa2015-97/ https://www.mozilla.org/security/advisories/mfsa2015-98/ https://www.mozilla.org/security/advisories/mfsa2015-99/ https://www.mozilla.org/security/advisories/mfsa2015-100/ https://www.mozilla.org/security/advisories/mfsa2015-101/ https://www.mozilla.org/security/advisories/mfsa2015-102/ https://www.mozilla.org/security/advisories/mfsa2015-103/ https://www.mozilla.org/security/advisories/mfsa2015-104/ https://www.mozilla.org/security/advisories/mfsa2015-105/ https://www.mozilla.org/security/advisories/mfsa2015-106/ https://www.mozilla.org/security/advisories/mfsa2015-107/ https://www.mozilla.org/security/advisories/mfsa2015-108/ https://www.mozilla.org/security/advisories/mfsa2015-109/ https://www.mozilla.org/security/advisories/mfsa2015-110/ https://www.mozilla.org/security/advisories/mfsa2015-111/ https://www.mozilla.org/security/advisories/mfsa2015-112/ https://www.mozilla.org/security/advisories/mfsa2015-113/ https://www.mozilla.org/security/advisories/mfsa2015-114/
aaa9f3db-13b5-4a0e-9ed7-e5ab287098fa	mozilla -- multiple vulnerabilities Mozilla Foundation reports: CVE-2016-5287: Crash in nsTArray_base::SwapArrayElements CVE-2016-5288: Web content can read cache entries Discovery 2016-10-20 Entry 2016-10-21 firefox < 49.0.2,1 CVE-2016-5287 CVE-2016-5288 https://www.mozilla.org/security/advisories/mfsa2016-87/
3284d948-140c-4a3e-aa76-3b440e2006a8	firefox -- Crash in TransportSecurityInfo due to cached data The Mozilla Foundation reports: A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally installed malware. This issue also triggers a non-exploitable startup crash for users switching between the Nightly and Release versions of Firefox if the same profile is used. Discovery 2018-09-21 Entry 2018-09-21 firefox < 62.0.2,1 firefox-esr < 60.2.1,1 CVE-2018-12385 https://www.mozilla.org/security/advisories/mfsa2018-22/
4f00dac0-1e18-4481-95af-7aaad63fd303	mozilla -- multiple vulnerabilities Mozilla Foundation reports: MFSA 2016-01 Miscellaneous memory safety hazards (rv:44.0 / rv:38.6) MFSA 2016-02 Out of Memory crash when parsing GIF format images MFSA 2016-03 Buffer overflow in WebGL after out of memory allocation MFSA 2016-04 Firefox allows for control characters to be set in cookie names MFSA 2016-06 Missing delay following user click events in protocol handler dialog MFSA 2016-09 Addressbar spoofing attacks MFSA 2016-10 Unsafe memory manipulation found through code inspection MFSA 2016-11 Application Reputation service disabled in Firefox 43 Discovery 2016-01-26 Entry 2016-02-01 Modified 2016-03-08 firefox linux-firefox < 44.0,1 seamonkey linux-seamonkey < 2.41 firefox-esr < 38.6.0,1 libxul thunderbird linux-thunderbird < 38.6.0 CVE-2015-7208 CVE-2016-1930 CVE-2016-1931 CVE-2016-1933 CVE-2016-1935 CVE-2016-1937 CVE-2016-1939 CVE-2016-1942 CVE-2016-1943 CVE-2016-1944 CVE-2016-1945 CVE-2016-1946 CVE-2016-1947 https://www.mozilla.org/security/advisories/mfsa2016-01/ https://www.mozilla.org/security/advisories/mfsa2016-02/ https://www.mozilla.org/security/advisories/mfsa2016-03/ https://www.mozilla.org/security/advisories/mfsa2016-04/ https://www.mozilla.org/security/advisories/mfsa2016-06/ https://www.mozilla.org/security/advisories/mfsa2016-09/ https://www.mozilla.org/security/advisories/mfsa2016-10/ https://www.mozilla.org/security/advisories/mfsa2016-11/
103bf96a-6211-45ab-b567-1555ebb3a86a	firefox -- Arbitrary code execution through unsanitized browser UI The Mozilla Foundation reports: Mozilla developer Johann Hofmann reported that unsanitized output in the browser UI can lead to arbitrary code execution. Discovery 2018-01-29 Entry 2018-01-29 Modified 2018-01-31 firefox < 58.0.1,1 waterfox < 56.0.3.65 https://bugzilla.mozilla.org/show_bug.cgi?id=1432966
c96d416a-eae7-4d5d-bc84-40deca9329fb	mozilla -- multiple vulnerabilities Mozilla Foundation reports: CVE-2018-12377: Use-after-free in refresh driver timers CVE-2018-12378: Use-after-free in IndexedDB CVE-2018-12379: Out-of-bounds write with malicious MAR file CVE-2017-16541: Proxy bypass using automount and autofs CVE-2018-12381: Dragging and dropping Outlook email message results in page navigation CVE-2018-12382: Addressbar spoofing with javascript URI on Firefox for Android CVE-2018-12383: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords CVE-2018-12375: Memory safety bugs fixed in Firefox 62 CVE-2018-12376: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 Discovery 2018-09-05 Entry 2018-09-05 Modified 2018-09-15 firefox < 62.0_1,1 waterfox < 56.2.3 seamonkey linux-seamonkey < 2.49.5 firefox-esr < 60.2.0_1,1 linux-firefox < 60.2.0,2 libxul thunderbird linux-thunderbird < 60.2 CVE-2017-16541 CVE-2018-12375 CVE-2018-12376 CVE-2018-12377 CVE-2018-12378 CVE-2018-12379 CVE-2018-12381 CVE-2018-12382 CVE-2018-12383 https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/ https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/
b7e23050-2d5d-4e61-9b48-62e89db222ca	mozilla -- multiple vulnerabilities Mozilla Foundation reports: CVE-2017-7843: Web worker in Private Browsing mode can write IndexedDB data CVE-2017-7844: Visited history information leak through SVG image Discovery 2017-11-29 Entry 2017-12-05 firefox ge 57.0,1 lt 57.0.1,1 < 56.0.2_11,1 waterfox < 56.0.s20171130 seamonkey linux-seamonkey < 2.49.2 firefox-esr < 52.5.1,1 linux-firefox < 52.5.1,2 CVE-2017-7843 CVE-2017-7844 https://www.mozilla.org/security/advisories/mfsa2017-27/
0f31b4e9-c827-11e9-9626-589cfc01894a	Mozilla -- Stored passwords in 'Saved Logins' can be copied without master password entry Mozilla Foundation reports: CVE-2019-11733: Stored passwords in 'Saved Logins' can be copied without master password entry When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password if the master password had been previously entered in the same session, allowing for potential theft of stored passwords. Discovery 2019-08-14 Entry 2019-08-28 cliqz < 1.28.2 firefox < 68.0.2,1 https://www.mozilla.org/security/advisories/mfsa2019-24/ CVE-2019-11733
96eca031-1313-4daf-9be2-9d6e1c4f1eb5	mozilla -- multiple vulnerabilities Mozilla Foundation reports: Please reference CVE/URL list for details Discovery 2017-03-07 Entry 2017-03-07 firefox < 52.0_1,1 seamonkey linux-seamonkey < 2.49 firefox-esr ge 46.0,1 lt 52.0,1 < 45.8.0_1,1 linux-firefox ge 46.0,2 lt 52.0,2 < 45.8.0_1,2 libxul ge 46.0 lt 52.0 < 45.8.0_1 thunderbird linux-thunderbird ge 46.0 lt 52.0 < 45.8.0 CVE-2017-5400 CVE-2017-5401 CVE-2017-5402 CVE-2017-5403 CVE-2017-5404 CVE-2017-5406 CVE-2017-5407 CVE-2017-5410 CVE-2017-5411 CVE-2017-5409 CVE-2017-5408 CVE-2017-5412 CVE-2017-5413 CVE-2017-5414 CVE-2017-5415 CVE-2017-5416 CVE-2017-5417 CVE-2017-5425 CVE-2017-5426 CVE-2017-5427 CVE-2017-5418 CVE-2017-5419 CVE-2017-5420 CVE-2017-5405 CVE-2017-5421 CVE-2017-5422 CVE-2017-5399 CVE-2017-5398 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-06/
18f39fb6-7400-4063-acaf-0806e92c094f	Mozilla -- SVG Animation Remote Code Execution The Mozilla Foundation reports: A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. Discovery 2016-11-30 Entry 2016-12-01 Modified 2016-12-16 firefox < 50.0.2,1 firefox-esr < 45.5.1,1 linux-firefox < 45.5.1,2 seamonkey < 2.46 linux-seamonkey < 2.46 libxul < 45.5.1 thunderbird < 45.5.1 linux-thunderbird < 45.5.1 CVE-2016-9079 https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/
92d44f83-a7bf-41cf-91ee-3d1b8ecf579f	mozilla -- multiple vulnerabilities Mozilla Foundation reports: MFSA 2016-39 Miscellaneous memory safety hazards (rv:46.0 / rv:45.1 / rv:38.8) MFSA 2016-42 Use-after-free and buffer overflow in Service Workers MFSA 2016-44 Buffer overflow in libstagefright with CENC offsets MFSA 2016-45 CSP not applied to pages sent with multipart/x-mixed-replace MFSA 2016-46 Elevation of privilege with chrome.tabs.update API in web extensions MFSA 2016-47 Write to invalid HashMap entry through JavaScript.watch() MFSA 2016-48 Firefox Health Reports could accept events from untrusted domains Discovery 2016-04-26 Entry 2016-04-26 firefox linux-firefox < 46.0,1 seamonkey linux-seamonkey < 2.43 firefox-esr ge 39.0,1 lt 45.1.0,1 < 38.8.0,1 libxul thunderbird linux-thunderbird ge 39.0 lt 45.1.0 < 38.8.0 CVE-2016-2804 CVE-2016-2805 CVE-2016-2806 CVE-2016-2807 CVE-2016-2808 CVE-2016-2811 CVE-2016-2812 CVE-2016-2814 CVE-2016-2816 CVE-2016-2817 CVE-2016-2820 https://www.mozilla.org/security/advisories/mfsa2016-39/ https://www.mozilla.org/security/advisories/mfsa2016-42/ https://www.mozilla.org/security/advisories/mfsa2016-44/ https://www.mozilla.org/security/advisories/mfsa2016-45/ https://www.mozilla.org/security/advisories/mfsa2016-46/ https://www.mozilla.org/security/advisories/mfsa2016-47/ https://www.mozilla.org/security/advisories/mfsa2016-48/
2c57c47e-8bb3-4694-83c8-9fc3abad3964	mozilla -- multiple vulnerabilities Mozilla Foundation reports: CVE-2016-2827 - Out-of-bounds read in mozilla::net::IsValidReferrerPolicy [low] CVE-2016-5256 - Memory safety bugs fixed in Firefox 49 [critical] CVE-2016-5257 - Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4 [critical] CVE-2016-5270 - Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString [high] CVE-2016-5271 - Out-of-bounds read in PropertyProvider::GetSpacingInternal [low] CVE-2016-5272 - Bad cast in nsImageGeometryMixin [high] CVE-2016-5273 - crash in mozilla::a11y::HyperTextAccessible::GetChildOffset [high] CVE-2016-5274 - use-after-free in nsFrameManager::CaptureFrameState [high] CVE-2016-5275 - global-buffer-overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions [critical] CVE-2016-5276 - Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList [high] CVE-2016-5277 - Heap-use-after-free in nsRefreshDriver::Tick [high] CVE-2016-5278 - Heap-buffer-overflow in nsBMPEncoder::AddImageFrame [critical] CVE-2016-5279 - Full local path of files is available to web pages after drag and drop [moderate] CVE-2016-5280 - Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap [high] CVE-2016-5281 - use-after-free in DOMSVGLength [high] CVE-2016-5282 - Don't allow content to request favicons from non-whitelisted schemes [moderate] CVE-2016-5283 - fragment timing attack can reveal cross-origin data [high]</p> <p>CVE-2016-5284 - Add-on update site certificate pin expiration [high]</p> </blockquote> <br>Discovery 2016-09-13<br>Entry 2016-09-20<br>Modified 2016-10-21<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 49.0,1 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.46 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 45.4.0,1 </blockquote><br> linux-firefox<br> <blockquote>< 45.4.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 45.4.0 </blockquote><br> CVE-2016-2827<br> CVE-2016-5256<br> CVE-2016-5257<br> CVE-2016-5270<br> CVE-2016-5271<br> CVE-2016-5272<br> CVE-2016-5273<br> CVE-2016-5274<br> CVE-2016-5275<br> CVE-2016-5276<br> CVE-2016-5277<br> CVE-2016-5278<br> CVE-2016-5279<br> CVE-2016-5280<br> CVE-2016-5281<br> CVE-2016-5282<br> CVE-2016-5283<br> CVE-2016-5284<br> https://www.mozilla.org/security/advisories/mfsa2016-85/<br> https://www.mozilla.org/security/advisories/mfsa2016-86/<br> https://www.mozilla.org/security/advisories/mfsa2016-88/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/555b244e-6b20-4546-851f-d8eb7d6c1ffa.html">555b244e-6b20-4546-851f-d8eb7d6c1ffa</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/"> <p>Please reference CVE/URL list for details</p> </blockquote> <br>Discovery 2017-08-08<br>Entry 2017-08-08<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 55.0,1 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.49.1 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 52.3.0,1 </blockquote><br> linux-firefox<br> <blockquote>< 52.3.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 52.3.0 </blockquote><br> CVE-2017-7753<br> CVE-2017-7779<br> CVE-2017-7780<br> CVE-2017-7781<br> CVE-2017-7782<br> CVE-2017-7783<br> CVE-2017-7784<br> CVE-2017-7785<br> CVE-2017-7786<br> CVE-2017-7787<br> CVE-2017-7788<br> CVE-2017-7789<br> CVE-2017-7790<br> CVE-2017-7791<br> CVE-2017-7792<br> CVE-2017-7794<br> CVE-2017-7796<br> CVE-2017-7797<br> CVE-2017-7798<br> CVE-2017-7799<br> CVE-2017-7800<br> CVE-2017-7801<br> CVE-2017-7802<br> CVE-2017-7803<br> CVE-2017-7804<br> CVE-2017-7806<br> CVE-2017-7807<br> CVE-2017-7808<br> https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/7c3a02b9-3273-4426-a0ba-f90fad2ff72e.html">7c3a02b9-3273-4426-a0ba-f90fad2ff72e</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/"> <p>CVE-2018-12391: HTTP Live Stream audio data is accessible cross-origin</p> <p>CVE-2018-12392: Crash with nested event loops</p> <p>CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript</p> <p>CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting</p> <p>CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts</p> <p>CVE-2018-12397:</p> <p>CVE-2018-12398: CSP bypass through stylesheet injection in resource URIs</p> <p>CVE-2018-12399: Spoofing of protocol registration notification bar</p> <p>CVE-2018-12400: Favicons are cached in private browsing mode on Firefox for Android</p> <p>CVE-2018-12401: DOS attack through special resource URI parsing</p> <p>CVE-2018-12402: SameSite cookies leak when pages are explicitly saved</p> <p>CVE-2018-12403: Mixed content warning is not displayed when HTTPS page loads a favicon over HTTP</p> <p>CVE-2018-12388: Memory safety bugs fixed in Firefox 63</p> <p>CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3</p> </blockquote> <br>Discovery 2018-10-23<br>Entry 2018-10-23<br>Modified 2019-07-23<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 63.0_1,1 </blockquote><br> waterfox<br> <blockquote>< 56.2.5 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.53.0 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 60.3.0,1 </blockquote><br> linux-firefox<br> <blockquote>< 60.3.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 60.3.0 </blockquote><br> CVE-2018-12388<br> CVE-2018-12390<br> CVE-2018-12391<br> CVE-2018-12392<br> CVE-2018-12393<br> CVE-2018-12395<br> CVE-2018-12396<br> CVE-2018-12397<br> CVE-2018-12398<br> CVE-2018-12399<br> CVE-2018-12400<br> CVE-2018-12401<br> CVE-2018-12402<br> CVE-2018-12403<br> https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/0cea6e0a-7a39-4dac-b3ec-dbc13d404f76.html">0cea6e0a-7a39-4dac-b3ec-dbc13d404f76</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-18/"> <h1>CVE-2019-11707: Type confusion in Array.pop</h1> <p>A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw.</p> </blockquote> <br>Discovery 2019-06-18<br>Entry 2019-06-19<br>Modified 2019-06-20<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 67.0.3,1 </blockquote><br> waterfox<br> <blockquote>< 56.2.11 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 60.7.1,1 </blockquote><br> CVE-2019-11707<br> https://www.mozilla.org/security/advisories/mfsa2019-18/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/c4f39920-781f-4aeb-b6af-17ed566c4272.html">c4f39920-781f-4aeb-b6af-17ed566c4272</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/"> <h1>CVE-2018-12386: Type confusion in JavaScript</h1> <p>A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution inside the sandboxed content process when triggered.</p> <h1>CVE-2018-12387: </h1> <p>A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout. This leaks a memory address to the calling function which can be used as part of an exploit inside the sandboxed content process.</p> </blockquote> <br>Discovery 2018-10-02<br>Entry 2018-10-02<br>Modified 2019-07-23<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 62.0.3,1 </blockquote><br> waterfox<br> <blockquote>< 56.2.4 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.53.0 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 60.2.2,1 </blockquote><br> linux-firefox<br> <blockquote>< 60.2.2,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 60.2.2 </blockquote><br> CVE-2018-12386<br> CVE-2018-12387<br> https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/0592f49f-b3b8-4260-b648-d1718762656c.html">0592f49f-b3b8-4260-b648-d1718762656c</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/"> <p>CVE-2019-9811: Sandbox escape via installation of malicious language pack</p> <p>CVE-2019-11711: Script injection within domain through inner window reuse</p> <p>CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects</p> <p>CVE-2019-11713: Use-after-free with HTTP/2 cached stream</p> <p>CVE-2019-11714: NeckoChild can trigger crash when accessed off of main thread</p> <p>CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault</p> <p>CVE-2019-11715: HTML parsing error can contribute to content XSS</p> <p>CVE-2019-11716: globalThis not enumerable until accessed</p> <p>CVE-2019-11717: Caret character improperly escaped in origins</p> <p>CVE-2019-11718: Activity Stream writes unsanitized content to innerHTML</p> <p>CVE-2019-11719: Out-of-bounds read when importing curve25519 private key</p> <p>CVE-2019-11720: Character encoding XSS vulnerability</p> <p>CVE-2019-11721: Domain spoofing through unicode latin 'kra' character</p> <p>CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin</p> <p>CVE-2019-11723: Cookie leakage during add-on fetching across private browsing boundaries</p> <p>CVE-2019-11724: Retired site input.mozilla.org has remote troubleshooting permissions</p> <p>CVE-2019-11725: Websocket resources bypass safebrowsing protections</p> <p>CVE-2019-11727: PKCS#1 v1.5 signatures can be used for TLS 1.3</p> <p>CVE-2019-11728: Port scanning through Alt-Svc header</p> <p>CVE-2019-11710: Memory safety bugs fixed in Firefox 68</p> <p>CVE-2019-11709: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8</p> </blockquote> <br>Discovery 2019-07-09<br>Entry 2019-07-09<br>Modified 2019-07-23<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 68.0_4,1 </blockquote><br> waterfox<br> <blockquote>< 56.2.12 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.53.0 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 60.8.0,1 </blockquote><br> linux-firefox<br> <blockquote>< 60.8.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 60.8.0 </blockquote><br> CVE-2019-11709<br> CVE-2019-11710<br> CVE-2019-11711<br> CVE-2019-11712<br> CVE-2019-11713<br> CVE-2019-11714<br> CVE-2019-11715<br> CVE-2019-11716<br> CVE-2019-11717<br> CVE-2019-11718<br> CVE-2019-11719<br> CVE-2019-11720<br> CVE-2019-11721<br> CVE-2019-11723<br> CVE-2019-11724<br> CVE-2019-11725<br> CVE-2019-11727<br> CVE-2019-11728<br> CVE-2019-11729<br> CVE-2019-11730<br> CVE-2019-9811<br> https://www.mozilla.org/security/advisories/mfsa2019-21/<br> https://www.mozilla.org/security/advisories/mfsa2019-22/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/18211552-f650-4d86-ba4f-e6d5cbfcdbeb.html">18211552-f650-4d86-ba4f-e6d5cbfcdbeb</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/"> <p>CVE-2018-18356: Use-after-free in Skia</p> <p>CVE-2019-5785: Integer overflow in Skia</p> <p>CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext</p> </blockquote> <br>Discovery 2019-02-13<br>Entry 2019-02-13<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 65.0.1,1 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 60.5.1,1 </blockquote><br> <a href="/mail/thunderbird/">thunderbird<br> </a><blockquote>< 60.5.1 </blockquote><br> CVE-2018-18511<br> CVE-2018-18356<br> CVE-2019-5785<br> https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/2225c5b4-1e5a-44fc-9920-b3201c384a15.html">2225c5b4-1e5a-44fc-9920-b3201c384a15</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox45"> <p>MFSA 2016-16 Miscellaneous memory safety hazards (rv:45.0 / rv:38.7)</p> <p>MFSA 2016-17 Local file overwriting and potential privilege escalation through CSP reports</p> <p>MFSA 2016-18 CSP reports fail to strip location information for embedded iframe pages</p> <p>MFSA 2016-19 Linux video memory DOS with Intel drivers</p> <p>MFSA 2016-20 Memory leak in libstagefright when deleting an array during MP4 processing</p> <p>MFSA 2016-21 Displayed page address can be overridden</p> <p>MFSA 2016-22 Service Worker Manager out-of-bounds read in Service Worker Manager</p> <p>MFSA 2016-23 Use-after-free in HTML5 string parser</p> <p>MFSA 2016-24 Use-after-free in SetBody</p> <p>MFSA 2016-25 Use-after-free when using multiple WebRTC data channels</p> <p>MFSA 2016-26 Memory corruption when modifying a file being read by FileReader</p> <p>MFSA 2016-27 Use-after-free during XML transformations</p> <p>MFSA 2016-28 Addressbar spoofing though history navigation and Location protocol property</p> <p>MFSA 2016-29 Same-origin policy violation using perfomance.getEntries and history navigation with session restore</p> <p>MFSA 2016-31 Memory corruption with malicious NPAPI plugin</p> <p>MFSA 2016-32 WebRTC and LibVPX vulnerabilities found through code inspection</p> <p>MFSA 2016-33 Use-after-free in GetStaticInstance in WebRTC</p> <p>MFSA 2016-34 Out-of-bounds read in HTML parser following a failed allocation</p> </blockquote> <br>Discovery 2016-03-08<br>Entry 2016-03-08<br>Modified 2016-03-08<br><a href="/www/firefox/">firefox<br> </a>linux-firefox<br> <blockquote>< 45.0,1 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.42 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 38.7.0,1 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 38.7.0 </blockquote><br> CVE-2016-1952<br> CVE-2016-1953<br> CVE-2016-1954<br> CVE-2016-1955<br> CVE-2016-1956<br> CVE-2016-1957<br> CVE-2016-1958<br> CVE-2016-1959<br> CVE-2016-1960<br> CVE-2016-1961<br> CVE-2016-1962<br> CVE-2016-1963<br> CVE-2016-1964<br> CVE-2016-1965<br> CVE-2016-1966<br> CVE-2016-1967<br> CVE-2016-1970<br> CVE-2016-1971<br> CVE-2016-1972<br> CVE-2016-1973<br> CVE-2016-1974<br> CVE-2016-1975<br> CVE-2016-1976<br> https://www.mozilla.org/security/advisories/mfsa2016-16/<br> https://www.mozilla.org/security/advisories/mfsa2016-17/<br> https://www.mozilla.org/security/advisories/mfsa2016-18/<br> https://www.mozilla.org/security/advisories/mfsa2016-19/<br> https://www.mozilla.org/security/advisories/mfsa2016-20/<br> https://www.mozilla.org/security/advisories/mfsa2016-21/<br> https://www.mozilla.org/security/advisories/mfsa2016-22/<br> https://www.mozilla.org/security/advisories/mfsa2016-23/<br> https://www.mozilla.org/security/advisories/mfsa2016-24/<br> https://www.mozilla.org/security/advisories/mfsa2016-25/<br> https://www.mozilla.org/security/advisories/mfsa2016-26/<br> https://www.mozilla.org/security/advisories/mfsa2016-27/<br> https://www.mozilla.org/security/advisories/mfsa2016-28/<br> https://www.mozilla.org/security/advisories/mfsa2016-29/<br> https://www.mozilla.org/security/advisories/mfsa2016-31/<br> https://www.mozilla.org/security/advisories/mfsa2016-32/<br> https://www.mozilla.org/security/advisories/mfsa2016-33/<br> https://www.mozilla.org/security/advisories/mfsa2016-34/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/172b22cb-d3f6-11e5-ac9e-485d605f4717.html">172b22cb-d3f6-11e5-ac9e-485d605f4717</a></td><td>firefox -- Same-origin-policy violation using Service Workers with plugins<br> <p>The Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox44.0.2"> <p>MFSA 2016-13 Jason Pang of OneSignal reported that service workers intercept responses to plugin network requests made through the browser. Plugins which make security decisions based on the content of network requests can have these decisions subverted if a service worker forges responses to those requests. For example, a forged crossdomain.xml could allow a malicious site to violate the same-origin policy using the Flash plugin.</p> </blockquote> <br>Discovery 2016-02-11<br>Entry 2016-02-15<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 44.0.2,1 </blockquote><br> linux-firefox<br> <blockquote>< 44.0.2,1 </blockquote><br> CVE-2016-1949<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-13/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/44b6dfbf-4ef7-4d52-ad52-2b1b05d81272.html">44b6dfbf-4ef7-4d52-ad52-2b1b05d81272</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/"> <p>CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS</p> <p>CVE-2019-9816: Type confusion with object groups and UnboxedObjects</p> <p>CVE-2019-9817: Stealing of cross-domain images using canvas</p> <p>CVE-2019-9818: Use-after-free in crash generation server</p> <p>CVE-2019-9819: Compartment mismatch with fetch API</p> <p>CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell</p> <p>CVE-2019-9821: Use-after-free in AssertWorkerThread</p> <p>CVE-2019-11691: Use-after-free in XMLHttpRequest</p> <p>CVE-2019-11692: Use-after-free removing listeners in the event listener manager</p> <p>CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux</p> <p>CVE-2019-7317: Use-after-free in png_image_free of libpng library</p> <p>CVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox</p> <p>CVE-2019-11695: Custom cursor can render over user interface outside of web content</p> <p>CVE-2019-11696: Java web start .JNLP files are not recognized as executable files for download prompts</p> <p>CVE-2019-11697: Pressing key combinations can bypass installation prompt delays and install extensions</p> <p>CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks</p> <p>CVE-2019-11700: res: protocol can be used to open known local files</p> <p>CVE-2019-11699: Incorrect domain name highlighting during page navigation</p> <p>CVE-2019-11701: webcal: protocol default handler loads vulnerable web page</p> <p>CVE-2019-9814: Memory safety bugs fixed in Firefox 67</p> <p>CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7</p> </blockquote> <br>Discovery 2019-05-21<br>Entry 2019-05-22<br>Modified 2019-07-23<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 67.0,1 </blockquote><br> waterfox<br> <blockquote>< 56.2.10 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.53.0 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 60.7.0,1 </blockquote><br> linux-firefox<br> <blockquote>< 60.7.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 60.7.0 </blockquote><br> CVE-2019-9815<br> CVE-2019-9816<br> CVE-2019-9817<br> CVE-2019-9818<br> CVE-2019-9819<br> CVE-2019-9820<br> CVE-2019-9821<br> CVE-2019-11691<br> CVE-2019-11692<br> CVE-2019-11693<br> CVE-2019-7317<br> CVE-2019-11694<br> CVE-2019-11695<br> CVE-2019-11696<br> CVE-2019-11697<br> CVE-2019-11698<br> CVE-2019-11700<br> CVE-2019-11699<br> CVE-2019-11701<br> CVE-2019-9814<br> CVE-2019-9800<br> https://www.mozilla.org/security/advisories/mfsa2019-13/<br> https://www.mozilla.org/security/advisories/mfsa2019-14/<br> https://www.mozilla.org/security/advisories/mfsa2019-15/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/1098a15b-b0f6-42b7-b5c7-8a8646e8be07.html">1098a15b-b0f6-42b7-b5c7-8a8646e8be07</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/"> <p>CVE-2017-7793: Use-after-free with Fetch API</p> <p>CVE-2017-7817: Firefox for Android address bar spoofing through fullscreen mode</p> <p>CVE-2017-7818: Use-after-free during ARIA array manipulation</p> <p>CVE-2017-7819: Use-after-free while resizing images in design mode</p> <p>CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE</p> <p>CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes</p> <p>CVE-2017-7812: Drag and drop of malicious page content to the tab bar can open locally stored files</p> <p>CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings</p> <p>CVE-2017-7813: Integer truncation in the JavaScript parser</p> <p>CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces</p> <p>CVE-2017-7815: Spoofing attack with modal dialogs on non-e10s installations</p> <p>CVE-2017-7816: WebExtensions can load about: URLs in extension UI</p> <p>CVE-2017-7821: WebExtensions can download and open non-executable files without user interaction</p> <p>CVE-2017-7823: CSP sandbox directive did not create a unique origin</p> <p>CVE-2017-7822: WebCrypto allows AES-GCM with 0-length IV</p> <p>CVE-2017-7820: Xray wrapper bypass with new tab and web console</p> <p>CVE-2017-7811: Memory safety bugs fixed in Firefox 56</p> <p>CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4</p> </blockquote> <br>Discovery 2017-09-28<br>Entry 2017-09-29<br>Modified 2017-10-03<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 56.0,1 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.49.1 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 52.4.0,1 </blockquote><br> linux-firefox<br> <blockquote>< 52.4.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 52.4.0 </blockquote><br> CVE-2017-7793<br> CVE-2017-7805<br> CVE-2017-7810<br> CVE-2017-7811<br> CVE-2017-7812<br> CVE-2017-7813<br> CVE-2017-7814<br> CVE-2017-7815<br> CVE-2017-7816<br> CVE-2017-7817<br> CVE-2017-7818<br> CVE-2017-7819<br> CVE-2017-7820<br> CVE-2017-7821<br> CVE-2017-7822<br> CVE-2017-7823<br> CVE-2017-7824<br> CVE-2017-7825<br> https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2017-22/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/6cec1b0a-da15-467d-8691-1dea392d4c8d.html">6cec1b0a-da15-467d-8691-1dea392d4c8d</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/"> <p>Please reference CVE/URL list for details</p> </blockquote> <br>Discovery 2017-06-13<br>Entry 2017-06-13<br>Modified 2017-09-19<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 54.0,1 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.49.1 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 52.2.0,1 </blockquote><br> linux-firefox<br> <blockquote>< 52.2.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 52.2.0 </blockquote><br> CVE-2017-5470<br> CVE-2017-5471<br> CVE-2017-5472<br> CVE-2017-7749<br> CVE-2017-7750<br> CVE-2017-7751<br> CVE-2017-7752<br> CVE-2017-7754<br> CVE-2017-7755<br> CVE-2017-7756<br> CVE-2017-7757<br> CVE-2017-7758<br> CVE-2017-7759<br> CVE-2017-7760<br> CVE-2017-7761<br> CVE-2017-7762<br> CVE-2017-7763<br> CVE-2017-7764<br> CVE-2017-7765<br> CVE-2017-7766<br> CVE-2017-7767<br> CVE-2017-7768<br> CVE-2017-7778<br> https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/aa1aefe3-6e37-47db-bfda-343ef4acb1b5.html">aa1aefe3-6e37-47db-bfda-343ef4acb1b5</a></td><td>Mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox48"> <p>Please reference CVE/URL list for details</p> </blockquote> <br>Discovery 2016-08-02<br>Entry 2016-09-07<br>Modified 2016-09-20<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 48.0,1 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.45 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 45.3.0,1 </blockquote><br> linux-firefox<br> <blockquote>< 45.3.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 45.3.0 </blockquote><br> CVE-2016-0718<br> CVE-2016-2830<br> CVE-2016-2835<br> CVE-2016-2836<br> CVE-2016-2837<br> CVE-2016-2838<br> CVE-2016-2839<br> CVE-2016-5250<br> CVE-2016-5251<br> CVE-2016-5252<br> CVE-2016-5253<br> CVE-2016-5254<br> CVE-2016-5255<br> CVE-2016-5258<br> CVE-2016-5259<br> CVE-2016-5260<br> CVE-2016-5261<br> CVE-2016-5262<br> CVE-2016-5263<br> CVE-2016-5264<br> CVE-2016-5265<br> CVE-2016-5266<br> CVE-2016-5267<br> CVE-2016-5268<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-62/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-63/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-64/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-65/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-66/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-67/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-68/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-69/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-70/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-71/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-72/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-73/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-74/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-75/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-76/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-77/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-78/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-79/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-80/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-81/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-82/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-83/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2016-84/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/79c68ef7-c8ae-4ade-91b4-4b8221b7c72a.html">79c68ef7-c8ae-4ade-91b4-4b8221b7c72a</a></td><td>firefox -- Cross-origin restriction bypass using Fetch<br> <p>Firefox Developers report:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/"> <p>Security researcher Abdulrahman Alqabandi reported that the fetch() API did not correctly implement the Cross-Origin Resource Sharing (CORS) specification, allowing a malicious page to access private data from other origins. Mozilla developer Ben Kelly independently reported the same issue. </p> </blockquote> <br>Discovery 2015-10-15<br>Entry 2015-10-16<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 41.0.2,1 </blockquote><br> linux-firefox<br> <blockquote>< 41.0.2,1 </blockquote><br> https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/<br> CVE-2015-7184<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/5f453b69-abab-4e76-b6e5-2ed0bafcaee3.html">5f453b69-abab-4e76-b6e5-2ed0bafcaee3</a></td><td>firefox -- integer overflow in createImageBitmap()<br> <p>The Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-08/"> <p>An integer overflow in createImageBitmap() was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the createImageBitmap API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer.</p> </blockquote> <br>Discovery 2017-03-17<br>Entry 2017-03-18<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 52.0.1,1 </blockquote><br> CVE-2017-5428<br> https://www.mozilla.org/security/advisories/mfsa2017-08/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/5e0a038a-ca30-416d-a2f5-38cbf5e7df33.html">5e0a038a-ca30-416d-a2f5-38cbf5e7df33</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/"> <p>Please reference CVE/URL list for details</p> </blockquote> <br>Discovery 2017-04-19<br>Entry 2017-04-19<br>Modified 2017-09-19<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 53.0_2,1 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.49.1 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>ge 46.0,1 lt 52.1.0_2,1</blockquote><br> <blockquote>< 45.9.0,1 </blockquote><br> linux-firefox<br> <blockquote>ge 46.0,2 lt 52.1.0,2</blockquote><br> <blockquote>< 45.9.0,2 </blockquote><br> libxul<br> <blockquote>ge 46.0 lt 52.1.0</blockquote><br> <blockquote>< 45.9.0 </blockquote><br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>ge 46.0 lt 52.1.0</blockquote><br> <blockquote>< 45.9.0 </blockquote><br> CVE-2017-5433<br> CVE-2017-5435<br> CVE-2017-5436<br> CVE-2017-5461<br> CVE-2017-5459<br> CVE-2017-5466<br> CVE-2017-5434<br> CVE-2017-5432<br> CVE-2017-5460<br> CVE-2017-5438<br> CVE-2017-5439<br> CVE-2017-5440<br> CVE-2017-5441<br> CVE-2017-5442<br> CVE-2017-5464<br> CVE-2017-5443<br> CVE-2017-5444<br> CVE-2017-5446<br> CVE-2017-5447<br> CVE-2017-5465<br> CVE-2017-5448<br> CVE-2017-5437<br> CVE-2017-5454<br> CVE-2017-5455<br> CVE-2017-5456<br> CVE-2017-5469<br> CVE-2017-5445<br> CVE-2017-5449<br> CVE-2017-5450<br> CVE-2017-5451<br> CVE-2017-5462<br> CVE-2017-5463<br> CVE-2017-5467<br> CVE-2017-5452<br> CVE-2017-5453<br> CVE-2017-5458<br> CVE-2017-5468<br> CVE-2017-5430<br> CVE-2017-5429<br> https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2017-11/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2017-12/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/23f59689-0152-42d3-9ade-1658d6380567.html">23f59689-0152-42d3-9ade-1658d6380567</a></td><td>mozilla -- use-after-free in compositor<br> <p>The Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-10/"> <h1>CVE-2018-5148: Use-after-free in compositor</h1> <p>A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one. This results in a potentially exploitable crash.</p> </blockquote> <br>Discovery 2018-03-26<br>Entry 2018-03-27<br>Modified 2018-03-31<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 59.0.2,1 </blockquote><br> waterfox<br> <blockquote>< 56.0.4.36_3 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.49.3 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 52.7.3,1 </blockquote><br> linux-firefox<br> <blockquote>< 52.7.3,2 </blockquote><br> libxul<br> <blockquote>< 52.7.3 </blockquote><br> linux-thunderbird<br> <blockquote>< 52.7.1 </blockquote><br> <a href="/mail/thunderbird/">thunderbird<br> </a><blockquote>< 52.7.0_1 </blockquote><br> CVE-2018-5148<br> https://www.mozilla.org/security/advisories/mfsa2018-10/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/2c2d1c39-1396-459a-91f5-ca03ee7c64c6.html">2c2d1c39-1396-459a-91f5-ca03ee7c64c6</a></td><td>mozilla -- multiple vulnerabilities<br> <p>The Mozilla Project reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/"> <p>MFSA 2015-134 Miscellaneous memory safety hazards (rv:43.0 / rv:38.5)</p> <p>MFSA 2015-135 Crash with JavaScript variable assignment with unboxed objects</p> <p>MFSA 2015-136 Same-origin policy violation using perfomance.getEntries and history navigation</p> <p>MFSA 2015-137 Firefox allows for control characters to be set in cookies</p> <p>MFSA 2015-138 Use-after-free in WebRTC when datachannel is used after being destroyed</p> <p>MFSA 2015-139 Integer overflow allocating extremely large textures</p> <p>MFSA 2015-140 Cross-origin information leak through web workers error events</p> <p>MFSA 2015-141 Hash in data URI is incorrectly parsed</p> <p>MFSA 2015-142 DOS due to malformed frames in HTTP/2</p> <p>MFSA 2015-143 Linux file chooser crashes on malformed images due to flaws in Jasper library</p> <p>MFSA 2015-144 Buffer overflows found through code inspection</p> <p>MFSA 2015-145 Underflow through code inspection</p> <p>MFSA 2015-146 Integer overflow in MP4 playback in 64-bit versions</p> <p>MFSA 2015-147 Integer underflow and buffer overflow processing MP4 metadata in libstagefright</p> <p>MFSA 2015-148 Privilege escalation vulnerabilities in WebExtension APIs</p> <p>MFSA 2015-149 Cross-site reading attack through data and view-source URIs</p> </blockquote> <br>Discovery 2015-12-15<br>Entry 2015-12-15<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 43.0,1 </blockquote><br> linux-firefox<br> <blockquote>< 43.0,1 </blockquote><br> seamonkey<br> <blockquote>< 2.40 </blockquote><br> linux-seamonkey<br> <blockquote>< 2.40 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 38.5.0,1 </blockquote><br> libxul<br> <blockquote>< 38.5.0 </blockquote><br> <a href="/mail/thunderbird/">thunderbird<br> </a><blockquote>< 38.5.0 </blockquote><br> linux-thunderbird<br> <blockquote>< 38.5.0 </blockquote><br> CVE-2015-7201<br> CVE-2015-7202<br> CVE-2015-7203<br> CVE-2015-7204<br> CVE-2015-7205<br> CVE-2015-7207<br> CVE-2015-7208<br> CVE-2015-7210<br> CVE-2015-7211<br> CVE-2015-7212<br> CVE-2015-7213<br> CVE-2015-7214<br> CVE-2015-7215<br> CVE-2015-7216<br> CVE-2015-7217<br> CVE-2015-7218<br> CVE-2015-7219<br> CVE-2015-7220<br> CVE-2015-7221<br> CVE-2015-7222<br> CVE-2015-7223<br> https://www.mozilla.org/security/advisories/mfsa2015-134/<br> https://www.mozilla.org/security/advisories/mfsa2015-135/<br> https://www.mozilla.org/security/advisories/mfsa2015-136/<br> https://www.mozilla.org/security/advisories/mfsa2015-137/<br> https://www.mozilla.org/security/advisories/mfsa2015-138/<br> https://www.mozilla.org/security/advisories/mfsa2015-139/<br> https://www.mozilla.org/security/advisories/mfsa2015-140/<br> https://www.mozilla.org/security/advisories/mfsa2015-141/<br> https://www.mozilla.org/security/advisories/mfsa2015-142/<br> https://www.mozilla.org/security/advisories/mfsa2015-143/<br> https://www.mozilla.org/security/advisories/mfsa2015-144/<br> https://www.mozilla.org/security/advisories/mfsa2015-145/<br> https://www.mozilla.org/security/advisories/mfsa2015-146/<br> https://www.mozilla.org/security/advisories/mfsa2015-147/<br> https://www.mozilla.org/security/advisories/mfsa2015-148/<br> https://www.mozilla.org/security/advisories/mfsa2015-149/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/c71cdc95-3c18-45b7-866a-af28b59aabb5.html">c71cdc95-3c18-45b7-866a-af28b59aabb5</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-06/"> <p>CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList</p> <p>CVE-2018-5128: Use-after-free manipulating editor selection ranges</p> <p>CVE-2018-5129: Out-of-bounds write with malformed IPC messages</p> <p>CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption</p> <p>CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources</p> <p>CVE-2018-5132: WebExtension Find API can search privileged pages</p> <p>CVE-2018-5133: Value of the app.support.baseURL preference is not properly sanitized</p> <p>CVE-2018-5134: WebExtensions may use view-source: URLs to bypass content restrictions</p> <p>CVE-2018-5135: WebExtension browserAction can inject scripts into unintended contexts</p> <p>CVE-2018-5136: Same-origin policy violation with data: URL shared workers</p> <p>CVE-2018-5137: Script content can access legacy extension non-contentaccessible resources</p> <p>CVE-2018-5138: Android Custom Tab address spoofing through long domain names</p> <p>CVE-2018-5140: Moz-icon images accessible to web content through moz-icon: protocol</p> <p>CVE-2018-5141: DOS attack through notifications Push API</p> <p>CVE-2018-5142: Media Capture and Streams API permissions display incorrect origin with data: and blob: URLs</p> <p>CVE-2018-5143: Self-XSS pasting javascript: URL with embedded tab into addressbar</p> <p>CVE-2018-5126: Memory safety bugs fixed in Firefox 59</p> <p>CVE-2018-5125: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7</p> </blockquote> <br>Discovery 2018-03-13<br>Entry 2018-03-13<br>Modified 2018-03-16<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 59.0_1,1 </blockquote><br> waterfox<br> <blockquote>< 56.0.4.36_3 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.49.3 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 52.7.0,1 </blockquote><br> linux-firefox<br> <blockquote>< 52.7.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 52.7.0 </blockquote><br> CVE-2018-5125<br> CVE-2018-5126<br> CVE-2018-5127<br> CVE-2018-5128<br> CVE-2018-5129<br> CVE-2018-5130<br> CVE-2018-5131<br> CVE-2018-5132<br> CVE-2018-5133<br> CVE-2018-5134<br> CVE-2018-5135<br> CVE-2018-5136<br> CVE-2018-5137<br> CVE-2018-5138<br> CVE-2018-5140<br> CVE-2018-5141<br> CVE-2018-5142<br> CVE-2018-5143<br> https://www.mozilla.org/security/advisories/mfsa2018-06/<br> https://www.mozilla.org/security/advisories/mfsa2018-07/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/9d04936c-75f1-4a2c-9ade-4c1708be5df9.html">9d04936c-75f1-4a2c-9ade-4c1708be5df9</a></td><td>mozilla -- multiple vulnerabilities<br> <p>The Mozilla Project reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/"> <p>MFSA 2015-133 NSS and NSPR memory corruption issues</p> <p>MFSA 2015-132 Mixed content WebSocket policy bypass through workers</p> <p>MFSA 2015-131 Vulnerabilities found through code inspection</p> <p>MFSA 2015-130 JavaScript garbage collection crash with Java applet</p> <p>MFSA 2015-129 Certain escaped characters in host of Location-header are being treated as non-escaped</p> <p>MFSA 2015-128 Memory corruption in libjar through zip files</p> <p>MFSA 2015-127 CORS preflight is bypassed when non-standard Content-Type headers are received</p> <p>MFSA 2015-126 Crash when accessing HTML tables with accessibility tools on OS X</p> <p>MFSA 2015-125 XSS attack through intents on Firefox for Android</p> <p>MFSA 2015-124 Android intents can be used on Firefox for Android to open privileged files</p> <p>MFSA 2015-123 Buffer overflow during image interactions in canvas</p> <p>MFSA 2015-122 Trailing whitespace in IP address hostnames can bypass same-origin policy</p> <p>MFSA 2015-121 Disabling scripts in Add-on SDK panels has no effect</p> <p>MFSA 2015-120 Reading sensitive profile files through local HTML file on Android</p> <p>MFSA 2015-119 Firefox for Android addressbar can be removed after fullscreen mode</p> <p>MFSA 2015-118 CSP bypass due to permissive Reader mode whitelist</p> <p>MFSA 2015-117 Information disclosure through NTLM authentication</p> <p>MFSA 2015-116 Miscellaneous memory safety hazards (rv:42.0 / rv:38.4)</p> </blockquote> <br>Discovery 2015-11-03<br>Entry 2015-11-19<br>Modified 2016-04-13<br><a href="/devel/nspr/">nspr<br> </a><blockquote>< 4.10.10 </blockquote><br> linux-c6-nspr<br> <blockquote>< 4.10.10 </blockquote><br> <a href="/security/nss/">nss<br> </a><blockquote>ge 3.20 lt 3.20.1</blockquote><br> <blockquote>ge 3.19.3 lt 3.19.4</blockquote><br> <blockquote>< 3.19.2.1 </blockquote><br> <a href="/www/firefox/">firefox<br> </a><blockquote>< 42.0,1 </blockquote><br> linux-firefox<br> <blockquote>< 42.0,1 </blockquote><br> seamonkey<br> <blockquote>< 2.39 </blockquote><br> linux-seamonkey<br> <blockquote>< 2.39 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 38.4.0,1 </blockquote><br> libxul<br> <blockquote>< 38.4.0 </blockquote><br> <a href="/mail/thunderbird/">thunderbird<br> </a><blockquote>< 38.4.0 </blockquote><br> linux-thunderbird<br> <blockquote>< 38.4.0 </blockquote><br> CVE-2015-4513<br> CVE-2015-4514<br> CVE-2015-4515<br> CVE-2015-4518<br> CVE-2015-7181<br> CVE-2015-7182<br> CVE-2015-7183<br> CVE-2015-7185<br> CVE-2015-7186<br> CVE-2015-7187<br> CVE-2015-7188<br> CVE-2015-7189<br> CVE-2015-7190<br> CVE-2015-7191<br> CVE-2015-7192<br> CVE-2015-7193<br> CVE-2015-7194<br> CVE-2015-7195<br> CVE-2015-7196<br> CVE-2015-7197<br> CVE-2015-7198<br> CVE-2015-7199<br> CVE-2015-7200<br> https://www.mozilla.org/security/advisories/mfsa2015-116/<br> https://www.mozilla.org/security/advisories/mfsa2015-117/<br> https://www.mozilla.org/security/advisories/mfsa2015-118/<br> https://www.mozilla.org/security/advisories/mfsa2015-119/<br> https://www.mozilla.org/security/advisories/mfsa2015-120/<br> https://www.mozilla.org/security/advisories/mfsa2015-121/<br> https://www.mozilla.org/security/advisories/mfsa2015-122/<br> https://www.mozilla.org/security/advisories/mfsa2015-123/<br> https://www.mozilla.org/security/advisories/mfsa2015-124/<br> https://www.mozilla.org/security/advisories/mfsa2015-125/<br> https://www.mozilla.org/security/advisories/mfsa2015-126/<br> https://www.mozilla.org/security/advisories/mfsa2015-127/<br> https://www.mozilla.org/security/advisories/mfsa2015-128/<br> https://www.mozilla.org/security/advisories/mfsa2015-129/<br> https://www.mozilla.org/security/advisories/mfsa2015-130/<br> https://www.mozilla.org/security/advisories/mfsa2015-131/<br> https://www.mozilla.org/security/advisories/mfsa2015-132/<br> https://www.mozilla.org/security/advisories/mfsa2015-133/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/b1f7d52f-fc42-48e8-8403-87d4c9d26229.html">b1f7d52f-fc42-48e8-8403-87d4c9d26229</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/"> <p>CVE-2018-18500: Use-after-free parsing HTML5 stream</p> <p>CVE-2018-18503: Memory corruption with Audio Buffer</p> <p>CVE-2018-18504: Memory corruption and out-of-bounds read of texture client buffer</p> <p>CVE-2018-18505: Privilege escalation through IPC channel messages</p> <p>CVE-2018-18506: Proxy Auto-Configuration file can define localhost access to be proxied</p> <p>CVE-2018-18502: Memory safety bugs fixed in Firefox 65</p> <p>CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5</p> </blockquote> <br>Discovery 2019-01-29<br>Entry 2019-01-29<br>Modified 2019-07-23<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 65.0_1,1 </blockquote><br> waterfox<br> <blockquote>< 56.2.7 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.53.0 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 60.5.0_1,1 </blockquote><br> linux-firefox<br> <blockquote>< 60.5.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 60.5.0 </blockquote><br> CVE-2018-18500<br> CVE-2018-18501<br> CVE-2018-18502<br> CVE-2018-18503<br> CVE-2018-18504<br> CVE-2018-18505<br> CVE-2018-18506<br> https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2019-02/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/05da6b56-3e66-4306-9ea3-89fafe939726.html">05da6b56-3e66-4306-9ea3-89fafe939726</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/"> <p>CVE-2019-9790: Use-after-free when removing in-use DOM elements</p> <p>CVE-2019-9791: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey</p> <p>CVE-2019-9792: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script</p> <p>CVE-2019-9793: Improper bounds checks when Spectre mitigations are disabled</p> <p>CVE-2019-9794: Command line arguments not discarded during execution</p> <p>CVE-2019-9795: Type-confusion in IonMonkey JIT compiler</p> <p>CVE-2019-9796: Use-after-free with SMIL animation controller</p> <p>CVE-2019-9797: Cross-origin theft of images with createImageBitmap</p> <p>CVE-2019-9798: Library is loaded from world writable APITRACE_LIB location</p> <p>CVE-2019-9799: Information disclosure via IPC channel messages</p> <p>CVE-2019-9801: Windows programs that are not 'URL Handlers' are exposed to web content</p> <p>CVE-2019-9802: Chrome process information leak</p> <p>CVE-2019-9803: Upgrade-Insecure-Requests incorrectly enforced for same-origin navigation</p> <p>CVE-2019-9804: Code execution through 'Copy as cURL' in Firefox Developer Tools on macOS</p> <p>CVE-2019-9805: Potential use of uninitialized memory in Prio</p> <p>CVE-2019-9806: Denial of service through successive FTP authorization prompts</p> <p>CVE-2019-9807: Text sent through FTP connection can be incorporated into alert messages</p> <p>CVE-2019-9809: Denial of service through FTP modal alert error messages</p> <p>CVE-2019-9808: WebRTC permissions can display incorrect origin with data: and blob: URLs</p> <p>CVE-2019-9789: Memory safety bugs fixed in Firefox 66</p> <p>CVE-2019-9788: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6</p> </blockquote> <br>Discovery 2019-03-19<br>Entry 2019-03-19<br>Modified 2019-07-23<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 66.0_3,1 </blockquote><br> waterfox<br> <blockquote>< 56.2.9 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.53.0 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 60.6.0,1 </blockquote><br> linux-firefox<br> <blockquote>< 60.6.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 60.6.0 </blockquote><br> CVE-2019-9788<br> CVE-2019-9789<br> CVE-2019-9790<br> CVE-2019-9791<br> CVE-2019-9792<br> CVE-2019-9793<br> CVE-2019-9794<br> CVE-2019-9795<br> CVE-2019-9796<br> CVE-2019-9797<br> CVE-2019-9798<br> CVE-2019-9799<br> CVE-2019-9801<br> CVE-2019-9802<br> CVE-2019-9803<br> CVE-2019-9804<br> CVE-2019-9805<br> CVE-2019-9806<br> CVE-2019-9807<br> CVE-2019-9808<br> CVE-2019-9809<br> https://www.mozilla.org/security/advisories/mfsa2019-07/<br> https://www.mozilla.org/security/advisories/mfsa2019-08/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/a891c5b4-3d7a-4de9-9c71-eef3fd698c77.html">a891c5b4-3d7a-4de9-9c71-eef3fd698c77</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-02/"> <p>CVE-2018-5091: Use-after-free with DTMF timers</p> <p>CVE-2018-5092: Use-after-free in Web Workers</p> <p>CVE-2018-5093: Buffer overflow in WebAssembly during Memory/Table resizing</p> <p>CVE-2018-5094: Buffer overflow in WebAssembly with garbage collection on uninitialized memory</p> <p>CVE-2018-5095: Integer overflow in Skia library during edge builder allocation</p> <p>CVE-2018-5097: Use-after-free when source document is manipulated during XSLT</p> <p>CVE-2018-5098: Use-after-free while manipulating form input elements</p> <p>CVE-2018-5099: Use-after-free with widget listener</p> <p>CVE-2018-5100: Use-after-free when IsPotentiallyScrollable arguments are freed from memory</p> <p>CVE-2018-5101: Use-after-free with floating first-letter style elements</p> <p>CVE-2018-5102: Use-after-free in HTML media elements</p> <p>CVE-2018-5103: Use-after-free during mouse event handling</p> <p>CVE-2018-5104: Use-after-free during font face manipulation</p> <p>CVE-2018-5105: WebExtensions can save and execute files on local file system without user prompts</p> <p>CVE-2018-5106: Developer Tools can expose style editor information cross-origin through service worker</p> <p>CVE-2018-5107: Printing process will follow symlinks for local file access</p> <p>CVE-2018-5108: Manually entered blob URL can be accessed by subsequent private browsing tabs</p> <p>CVE-2018-5109: Audio capture prompts and starts with incorrect origin attribution</p> <p>CVE-2018-5110: Cursor can be made invisible on OS X</p> <p>CVE-2018-5111: URL spoofing in addressbar through drag and drop</p> <p>CVE-2018-5112: Extension development tools panel can open a non-relative URL in the panel</p> <p>CVE-2018-5113: WebExtensions can load non-HTTPS pages with browser.identity.launchWebAuthFlow</p> <p>CVE-2018-5114: The old value of a cookie changed to HttpOnly remains accessible to scripts</p> <p>CVE-2018-5115: Background network requests can open HTTP authentication in unrelated foreground tabs</p> <p>CVE-2018-5116: WebExtension ActiveTab permission allows cross-origin frame content access</p> <p>CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right</p> <p>CVE-2018-5118: Activity Stream images can attempt to load local content through file:</p> <p>CVE-2018-5119: Reader view will load cross-origin content in violation of CORS headers</p> <p>CVE-2018-5121: OS X Tibetan characters render incompletely in the addressbar</p> <p>CVE-2018-5122: Potential integer overflow in DoCrypt</p> <p>CVE-2018-5090: Memory safety bugs fixed in Firefox 58</p> <p>CVE-2018-5089: Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6</p> </blockquote> <br>Discovery 2018-01-23<br>Entry 2018-01-23<br>Modified 2018-01-29<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 58.0_1,1 </blockquote><br> waterfox<br> <blockquote>< 56.0.3.63 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.49.2 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 52.6.0_1,1 </blockquote><br> linux-firefox<br> <blockquote>< 52.6.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 52.6.0 </blockquote><br> CVE-2018-5089<br> CVE-2018-5090<br> CVE-2018-5091<br> CVE-2018-5092<br> CVE-2018-5093<br> CVE-2018-5094<br> CVE-2018-5095<br> CVE-2018-5097<br> CVE-2018-5098<br> CVE-2018-5099<br> CVE-2018-5100<br> CVE-2018-5101<br> CVE-2018-5102<br> CVE-2018-5103<br> CVE-2018-5104<br> CVE-2018-5105<br> CVE-2018-5106<br> CVE-2018-5107<br> CVE-2018-5108<br> CVE-2018-5109<br> CVE-2018-5110<br> CVE-2018-5111<br> CVE-2018-5112<br> CVE-2018-5113<br> CVE-2018-5114<br> CVE-2018-5115<br> CVE-2018-5116<br> CVE-2018-5117<br> CVE-2018-5118<br> CVE-2018-5119<br> CVE-2018-5121<br> CVE-2018-5122<br> https://www.mozilla.org/security/advisories/mfsa2018-02/<br> https://www.mozilla.org/security/advisories/mfsa2018-03/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/cd81806c-26e7-4d4a-8425-02724a2f48af.html">cd81806c-26e7-4d4a-8425-02724a2f48af</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/"> <p>CVE-2018-12359: Buffer overflow using computed size of canvas element</p> <p>CVE-2018-12360: Use-after-free when using focus()</p> <p>CVE-2018-12361: Integer overflow in SwizzleData</p> <p>CVE-2018-12358: Same-origin bypass using service worker and redirection</p> <p>CVE-2018-12362: Integer overflow in SSSE3 scaler</p> <p>CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture</p> <p>CVE-2018-12363: Use-after-free when appending DOM nodes</p> <p>CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins</p> <p>CVE-2018-12365: Compromised IPC child process can list local filenames</p> <p>CVE-2018-12371: Integer overflow in Skia library during edge builder allocation</p> <p>CVE-2018-12366: Invalid data handling during QCMS transformations</p> <p>CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming</p> <p>CVE-2018-12368: No warning when opening executable SettingContent-ms files</p> <p>CVE-2018-12369: WebExtension security permission checks bypassed by embedded experiments</p> <p>CVE-2018-12370: SameSite cookie protections bypassed when exiting Reader View</p> <p>CVE-2018-5186: Memory safety bugs fixed in Firefox 61</p> <p>CVE-2018-5187: Memory safety bugs fixed in Firefox 60 and Firefox ESR 60.1</p> <p>CVE-2018-5188: Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9</p> </blockquote> <br>Discovery 2018-06-26<br>Entry 2018-06-26<br>Modified 2018-07-07<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 61.0_1,1 </blockquote><br> waterfox<br> <blockquote>< 56.2.1.19_2 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.49.4 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>ge 60.0,1 lt 60.1.0_1,1</blockquote><br> <blockquote>< 52.9.0_1,1 </blockquote><br> linux-firefox<br> <blockquote>< 52.9.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 52.9.0 </blockquote><br> CVE-2018-12362<br> CVE-2018-5156<br> CVE-2018-5186<br> CVE-2018-5187<br> CVE-2018-5188<br> CVE-2018-12358<br> CVE-2018-12359<br> CVE-2018-12360<br> CVE-2018-12361<br> CVE-2018-12363<br> CVE-2018-12364<br> CVE-2018-12365<br> CVE-2018-12366<br> CVE-2018-12367<br> CVE-2018-12368<br> CVE-2018-12369<br> CVE-2018-12370<br> CVE-2018-12371<br> https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2018-16/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2018-17/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/5aefc41e-d304-4ec8-8c82-824f84f08244.html">5aefc41e-d304-4ec8-8c82-824f84f08244</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/"> <p>CVE-2018-5183: Backport critical security fixes in Skia</p> <p>CVE-2018-5154: Use-after-free with SVG animations and clip paths</p> <p>CVE-2018-5155: Use-after-free with SVG animations and text paths</p> <p>CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files</p> <p>CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer</p> <p>CVE-2018-5159: Integer overflow and out-of-bounds write in Skia</p> <p>CVE-2018-5160: Uninitialized memory use by WebRTC encoder</p> <p>CVE-2018-5152: WebExtensions information leak through webRequest API</p> <p>CVE-2018-5153: Out-of-bounds read in mixed content websocket messages</p> <p>CVE-2018-5163: Replacing cached data in JavaScript Start-up Bytecode Cache</p> <p>CVE-2018-5164: CSP not applied to all multipart content sent with multipart/x-mixed-replace</p> <p>CVE-2018-5166: WebExtension host permission bypass through filterReponseData</p> <p>CVE-2018-5167: Improper linkification of chrome: and javascript: content in web console and JavaScript debugger</p> <p>CVE-2018-5168: Lightweight themes can be installed without user interaction</p> <p>CVE-2018-5169: Dragging and dropping link text onto home button can set home page to include chrome pages</p> <p>CVE-2018-5172: Pasted script from clipboard can run in the Live Bookmarks page or PDF viewer</p> <p>CVE-2018-5173: File name spoofing of Downloads panel with Unicode characters</p> <p>CVE-2018-5174: Windows Defender SmartScreen UI runs with less secure behavior for downloaded files in Windows 10 April 2018 Update</p> <p>CVE-2018-5175: Universal CSP bypass on sites using strict-dynamic in their policies</p> <p>CVE-2018-5176: JSON Viewer script injection</p> <p>CVE-2018-5177: Buffer overflow in XSLT during number formatting</p> <p>CVE-2018-5165: Checkbox for enabling Flash protected mode is inverted in 32-bit Firefox</p> <p>CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension</p> <p>CVE-2018-5180: heap-use-after-free in mozilla::WebGLContext::DrawElementsInstanced</p> <p>CVE-2018-5181: Local file can be displayed in noopener tab through drag and drop of hyperlink</p> <p>CVE-2018-5182: Local file can be displayed from hyperlink dragged and dropped on addressbar</p> <p>CVE-2018-5151: Memory safety bugs fixed in Firefox 60</p> <p>CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8</p> </blockquote> <br>Discovery 2018-05-09<br>Entry 2018-05-09<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 60.0,1 </blockquote><br> waterfox<br> <blockquote>< 56.1.0_18 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.49.4 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 52.8.0,1 </blockquote><br> linux-firefox<br> <blockquote>< 52.8.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 52.8.0 </blockquote><br> CVE-2018-5150<br> CVE-2018-5151<br> CVE-2018-5152<br> CVE-2018-5153<br> CVE-2018-5154<br> CVE-2018-5155<br> CVE-2018-5157<br> CVE-2018-5158<br> CVE-2018-5159<br> CVE-2018-5160<br> CVE-2018-5163<br> CVE-2018-5164<br> CVE-2018-5165<br> CVE-2018-5166<br> CVE-2018-5167<br> CVE-2018-5168<br> CVE-2018-5169<br> CVE-2018-5172<br> CVE-2018-5173<br> CVE-2018-5174<br> CVE-2018-5175<br> CVE-2018-5176<br> CVE-2018-5177<br> CVE-2018-5178<br> CVE-2018-5180<br> CVE-2018-5181<br> CVE-2018-5182<br> CVE-2018-5183<br> https://www.mozilla.org/security/advisories/mfsa2018-11/<br> https://www.mozilla.org/security/advisories/mfsa2018-12/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/1bcfd963-e483-41b8-ab8e-bad5c3ce49c9.html">1bcfd963-e483-41b8-ab8e-bad5c3ce49c9</a></td><td>brotli -- buffer overflow<br> <p>Google Chrome Releases reports:</p> <blockquote cite="http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html"> <p>[583607] High CVE-2016-1624: Buffer overflow in Brotli. Credit to lukezli.</p> </blockquote> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-30/"> <p>Security researcher Luke Li reported a pointer underflow bug in the Brotli library's decompression that leads to a buffer overflow. This results in a potentially exploitable crash when triggered.</p> </blockquote> <br>Discovery 2016-02-08<br>Entry 2016-03-08<br>Modified 2016-03-08<br><a href="/archivers/brotli/">brotli<br> </a><blockquote>ge 0.3.0 lt 0.3.0_1</blockquote><br> <blockquote>< 0.2.0_2 </blockquote><br> libbrotli<br> <blockquote>< 0.3.0_3 </blockquote><br> <a href="/www/chromium/">chromium<br> </a>chromium-npapi<br> chromium-pulse<br> <blockquote>< 48.0.2564.109 </blockquote><br> <a href="/www/firefox/">firefox<br> </a>linux-firefox<br> <blockquote>< 45.0,1 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.42 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 38.7.0,1 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 38.7.0 </blockquote><br> CVE-2016-1624<br> CVE-2016-1968<br> https://github.com/google/brotli/commit/37a320dd81db8d546cd24a45b4c61d87b45dcade<br> https://chromium.googlesource.com/chromium/src/+/7716418a27d561ee295a99f11fd3865580748de2%5E!/<br> https://www.mozilla.org/security/advisories/mfsa2016-30/<br> https://hg.mozilla.org/releases/mozilla-release/rev/4a5d8ade4e3e<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/7943794f-707f-4e31-9fea-3bbf1ddcedc1.html">7943794f-707f-4e31-9fea-3bbf1ddcedc1</a></td><td>mozilla -- multiple vulnerabilities<br> <p>The Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-08/"> <h1>CVE-2018-5146: Out of bounds memory write in libvorbis</h1> <p>An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest.</p> <h1>CVE-2018-5147: Out of bounds memory write in libtremor</h1> <p>The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms.</p> </blockquote> <br>Discovery 2018-03-16<br>Entry 2018-03-16<br>Modified 2018-03-31<br><a href="/audio/libvorbis/">libvorbis<br> </a><blockquote>< 1.3.6,3 </blockquote><br> libtremor<br> <blockquote>< 1.2.1.s20180316 </blockquote><br> <a href="/www/firefox/">firefox<br> </a><blockquote>< 59.0.1,1 </blockquote><br> waterfox<br> <blockquote>< 56.0.4.36_3 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.49.3 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 52.7.2,1 </blockquote><br> linux-firefox<br> <blockquote>< 52.7.2,2 </blockquote><br> libxul<br> <blockquote>< 52.7.3 </blockquote><br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 52.7.0 </blockquote><br> CVE-2018-5146<br> CVE-2018-5147<br> https://www.mozilla.org/security/advisories/mfsa2018-08/<br> https://www.mozilla.org/security/advisories/mfsa2018-09/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/f78eac48-c3d1-4666-8de5-63ceea25a578.html">f78eac48-c3d1-4666-8de5-63ceea25a578</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/"> <p>CVE-2017-7828: Use-after-free of PressShell while restyling layout</p> <p>CVE-2017-7830: Cross-origin URL information leak through Resource Timing API</p> <p>CVE-2017-7831: Information disclosure of exposed properties on JavaScript proxy objects</p> <p>CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers</p> <p>CVE-2017-7833: Domain spoofing with Arabic and Indic vowel marker characters</p> <p>CVE-2017-7834: data: URLs opened in new tabs bypass CSP protections</p> <p>CVE-2017-7835: Mixed content blocking incorrectly applies with redirects</p> <p>CVE-2017-7836: Pingsender dynamically loads libcurl on Linux and OS X</p> <p>CVE-2017-7837: SVG loaded as <img> can use meta tags to set cookies</p> <p>CVE-2017-7838: Failure of individual decoding of labels in international domain names triggers punycode display of entire IDN</p> <p>CVE-2017-7839: Control characters before javascript: URLs defeats self-XSS prevention mechanism</p> <p>CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags</p> <p>CVE-2017-7842: Referrer Policy is not always respected for <link> elements</p> <p>CVE-2017-7827: Memory safety bugs fixed in Firefox 57</p> <p>CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5</p> </blockquote> <br>Discovery 2017-11-14<br>Entry 2017-11-14<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 56.0.2_10,1 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.49.2 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 52.5.0,1 </blockquote><br> linux-firefox<br> <blockquote>< 52.5.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 52.5.0 </blockquote><br> CVE-2017-7826<br> CVE-2017-7827<br> CVE-2017-7828<br> CVE-2017-7830<br> CVE-2017-7831<br> CVE-2017-7832<br> CVE-2017-7833<br> CVE-2017-7834<br> CVE-2017-7835<br> CVE-2017-7836<br> CVE-2017-7837<br> CVE-2017-7838<br> CVE-2017-7839<br> CVE-2017-7840<br> CVE-2017-7842<br> https://www.mozilla.org/security/advisories/mfsa2017-24/<br> https://www.mozilla.org/security/advisories/mfsa2017-25/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/512c0ffd-cd39-4da4-b2dc-81ff4ba8e238.html">512c0ffd-cd39-4da4-b2dc-81ff4ba8e238</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/"> <p>CVE-2016-9894: Buffer overflow in SkiaGL</p> <p>CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements</p> <p>CVE-2016-9895: CSP bypass using marquee tag</p> <p>CVE-2016-9896: Use-after-free with WebVR</p> <p>CVE-2016-9897: Memory corruption in libGLES</p> <p>CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees</p> <p>CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs</p> <p>CVE-2016-9904: Cross-origin information leak in shared atoms</p> <p>CVE-2016-9901: Data from Pocket server improperly sanitized before execution</p> <p>CVE-2016-9902: Pocket extension does not validate the origin of events</p> <p>CVE-2016-9903: XSS injection vulnerability in add-ons SDK</p> <p>CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1</p> <p>CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6</p> </blockquote> <br>Discovery 2016-12-13<br>Entry 2016-12-14<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 50.1.0_1,1 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.47 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 45.6.0,1 </blockquote><br> linux-firefox<br> <blockquote>< 45.6.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 45.6.0 </blockquote><br> CVE-2016-9894<br> CVE-2016-9899<br> CVE-2016-9895<br> CVE-2016-9896<br> CVE-2016-9897<br> CVE-2016-9898<br> CVE-2016-9900<br> CVE-2016-9904<br> CVE-2016-9901<br> CVE-2016-9902<br> CVE-2016-9903<br> CVE-2016-9080<br> CVE-2016-9893<br> https://www.mozilla.org/security/advisories/mfsa2016-94/<br> https://www.mozilla.org/security/advisories/mfsa2016-95/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/e60169c4-aa86-46b0-8ae2-0d81f683df09.html">e60169c4-aa86-46b0-8ae2-0d81f683df09</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-01/"> <p>Please reference CVE/URL list for details</p> </blockquote> <br>Discovery 2017-01-24<br>Entry 2017-01-24<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 51.0_1,1 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.48 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 45.7.0,1 </blockquote><br> linux-firefox<br> <blockquote>< 45.7.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 45.7.0 </blockquote><br> CVE-2017-5373<br> CVE-2017-5374<br> CVE-2017-5375<br> CVE-2017-5376<br> CVE-2017-5377<br> CVE-2017-5378<br> CVE-2017-5379<br> CVE-2017-5380<br> CVE-2017-5381<br> CVE-2017-5382<br> CVE-2017-5383<br> CVE-2017-5384<br> CVE-2017-5385<br> CVE-2017-5386<br> CVE-2017-5387<br> CVE-2017-5388<br> CVE-2017-5389<br> CVE-2017-5390<br> CVE-2017-5391<br> CVE-2017-5392<br> CVE-2017-5393<br> CVE-2017-5394<br> CVE-2017-5395<br> CVE-2017-5396<br> https://www.mozilla.org/security/advisories/mfsa2017-01/<br> https://www.mozilla.org/security/advisories/mfsa2017-02/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/39bc2294-ff32-4972-9ecb-b9f40b4ccb74.html">39bc2294-ff32-4972-9ecb-b9f40b4ccb74</a></td><td>Mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/"> <h1>CVE-2019-11708: sandbox escape using Prompt:Open</h1> <p>Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer.</p> </blockquote> <br>Discovery 2019-06-20<br>Entry 2019-06-21<br>Modified 2019-07-09<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 67.0.4,1 </blockquote><br> waterfox<br> <blockquote>< 56.2.12 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 60.7.2,1 </blockquote><br> https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/<br> CVE-2019-11708<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/05463e0a-abd3-4fa4-bd5f-cd5ed132d4c6.html">05463e0a-abd3-4fa4-bd5f-cd5ed132d4c6</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-25/"> <p>CVE-2019-11751: Malicious code execution through command line parameters</p> <p>CVE-2019-11746: Use-after-free while manipulating video</p> <p>CVE-2019-11744: XSS by breaking out of title and textarea elements using innerHTML</p> <p>CVE-2019-11742: Same-origin policy violation with SVG filters and canvas to steal cross-origin images</p> <p>CVE-2019-11736: File manipulation and privilege escalation in Mozilla Maintenance Service</p> <p>CVE-2019-11753: Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location</p> <p>CVE-2019-11752: Use-after-free while extracting a key value in IndexedDB</p> <p>CVE-2019-9812: Sandbox escape through Firefox Sync</p> <p>CVE-2019-11741: Isolate addons.mozilla.org and accounts.firefox.com</p> <p>CVE-2019-11743: Cross-origin access to unload event attributes</p> <p>CVE-2019-11748: Persistence of WebRTC permissions in a third party context</p> <p>CVE-2019-11749: Camera information available without prompting using getUserMedia</p> <p>CVE-2019-5849: Out-of-bounds read in Skia</p> <p>CVE-2019-11750: Type confusion in Spidermonkey</p> <p>CVE-2019-11737: Content security policy directives ignore port and path if host is a wildcard</p> <p>CVE-2019-11738: Content security policy bypass through hash-based sources in directives</p> <p>CVE-2019-11747: 'Forget about this site' removes sites from pre-loaded HSTS list</p> <p>CVE-2019-11734: Memory safety bugs fixed in Firefox 69</p> <p>CVE-2019-11735: Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1</p> <p>CVE-2019-11740: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9</p> </blockquote> <br>Discovery 2019-09-03<br>Entry 2019-09-03<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 69.0,1 </blockquote><br> waterfox<br> <blockquote>< 56.2.14 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.53.0 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>ge 61.0,1 lt 68.1.0,1</blockquote><br> <blockquote>< 60.9.0,1 </blockquote><br> linux-firefox<br> <blockquote>ge 61.0,2 lt 68.1.0,2</blockquote><br> <blockquote>< 60.9.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>ge 61.0 lt 68.1.0</blockquote><br> <blockquote>< 60.9.0 </blockquote><br> CVE-2019-11734<br> CVE-2019-11735<br> CVE-2019-11736<br> CVE-2019-11737<br> CVE-2019-11738<br> CVE-2019-11740<br> CVE-2019-11741<br> CVE-2019-11742<br> CVE-2019-11743<br> CVE-2019-11744<br> CVE-2019-11746<br> CVE-2019-11747<br> CVE-2019-11748<br> CVE-2019-11749<br> CVE-2019-11750<br> CVE-2019-11751<br> CVE-2019-11752<br> CVE-2019-11753<br> CVE-2019-5849<br> CVE-2019-9812<br> https://www.mozilla.org/security/advisories/mfsa2019-25/<br> https://www.mozilla.org/security/advisories/mfsa2019-26/<br> https://www.mozilla.org/security/advisories/mfsa2019-27/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/8065d37b-8e7c-4707-a608-1b0a2b8509c3.html">8065d37b-8e7c-4707-a608-1b0a2b8509c3</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox47"> <p>MFSA 2016-49 Miscellaneous memory safety hazards (rv:47.0 / rv:45.2)</p> <p>MFSA 2016-50 Buffer overflow parsing HTML5 fragments</p> <p>MFSA 2016-51 Use-after-free deleting tables from a contenteditable document</p> <p>MFSA 2016-52 Addressbar spoofing though the SELECT element</p> <p>MFSA 2016-54 Partial same-origin-policy through setting location.host through data URI</p> <p>MFSA 2016-56 Use-after-free when textures are used in WebGL operations after recycle pool destruction</p> <p>MFSA 2016-57 Incorrect icon displayed on permissions notifications</p> <p>MFSA 2016-58 Entering fullscreen and persistent pointerlock without user permission</p> <p>MFSA 2016-59 Information disclosure of disabled plugins through CSS pseudo-classes</p> <p>MFSA 2016-60 Java applets bypass CSP protections</p> </blockquote> <br>Discovery 2016-06-07<br>Entry 2016-06-07<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 47.0,1 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.44 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 45.2.0,1 </blockquote><br> linux-firefox<br> <blockquote>< 45.2.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 45.2.0 </blockquote><br> CVE-2016-2815<br> CVE-2016-2818<br> CVE-2016-2819<br> CVE-2016-2821<br> CVE-2016-2822<br> CVE-2016-2825<br> CVE-2016-2828<br> CVE-2016-2829<br> CVE-2016-2831<br> CVE-2016-2832<br> CVE-2016-2833<br> https://www.mozilla.org/security/advisories/mfsa2016-49/<br> https://www.mozilla.org/security/advisories/mfsa2016-50/<br> https://www.mozilla.org/security/advisories/mfsa2016-51/<br> https://www.mozilla.org/security/advisories/mfsa2016-52/<br> https://www.mozilla.org/security/advisories/mfsa2016-54/<br> https://www.mozilla.org/security/advisories/mfsa2016-56/<br> https://www.mozilla.org/security/advisories/mfsa2016-57/<br> https://www.mozilla.org/security/advisories/mfsa2016-58/<br> https://www.mozilla.org/security/advisories/mfsa2016-59/<br> https://www.mozilla.org/security/advisories/mfsa2016-60/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/d1853110-07f4-4645-895b-6fd462ad0589.html">d1853110-07f4-4645-895b-6fd462ad0589</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-89/"> <p>Please reference CVE/URL list for details</p> </blockquote> <br>Discovery 2016-11-15<br>Entry 2016-11-16<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 50.0_1,1 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.47 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 45.5.0,1 </blockquote><br> linux-firefox<br> <blockquote>< 45.5.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 45.5.0 </blockquote><br> CVE-2016-5289<br> CVE-2016-5290<br> CVE-2016-5291<br> CVE-2016-5292<br> CVE-2016-5293<br> CVE-2016-5294<br> CVE-2016-5295<br> CVE-2016-5296<br> CVE-2016-5297<br> CVE-2016-5298<br> CVE-2016-5299<br> CVE-2016-9061<br> CVE-2016-9062<br> CVE-2016-9063<br> CVE-2016-9064<br> CVE-2016-9065<br> CVE-2016-9066<br> CVE-2016-9067<br> CVE-2016-9068<br> CVE-2016-9070<br> CVE-2016-9071<br> CVE-2016-9072<br> CVE-2016-9073<br> CVE-2016-9074<br> CVE-2016-9075<br> CVE-2016-9076<br> CVE-2016-9077<br> https://www.mozilla.org/security/advisories/mfsa2016-89/<br> https://www.mozilla.org/security/advisories/mfsa2016-90/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/8429711b-76ca-474e-94a0-6b980f1e2d47.html">8429711b-76ca-474e-94a0-6b980f1e2d47</a></td><td>mozilla -- Speculative execution side-channel attack<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-01/"> <p><strong>Jann Horn</strong> of Google Project Zero Security reported that speculative execution performed by modern CPUs could leak information through a timing side-channel attack. Microsoft Vulnerability Research extended this attack to browser JavaScript engines and demonstrated that code on a malicious web page could read data from other web sites (violating the same-origin policy) or private data from the browser itself.</p> <p>Since this new class of attacks involves measuring precise time intervals, as a parti al, short-term, mitigation we are disabling or reducing the precision of several time sources in Firefox. The precision of <code>performance.now()</code> has been reduced from 5Î¼s to 20Î¼s, and the <code>SharedArrayBuffer</code> feature has been disabled because it can be used to construct a high-resolution timer.</p> </blockquote> <br>Discovery 2018-01-04<br>Entry 2018-01-05<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 57.0.4,1 </blockquote><br> waterfox<br> <blockquote>< 56.0.2 </blockquote><br> https://www.mozilla.org/security/advisories/mfsa2018-01/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/e3e68fe8-d9cb-4ba8-b09c-9e3a28588eb7.html">e3e68fe8-d9cb-4ba8-b09c-9e3a28588eb7</a></td><td>firefox -- Heap buffer overflow rasterizing paths in SVG with Skia<br> <p>The Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-14/"> <p>A heap buffer overflow can occur in the Skia library when rasterizing paths using a maliciously crafted SVG file with anti-aliasing turned off. This results in a potentially exploitable crash.</p> </blockquote> <br>Discovery 2018-06-06<br>Entry 2018-06-08<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 60.0.2,1 </blockquote><br> waterfox<br> <blockquote>< 56.2.0.13_5 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 52.8.1,1 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.49.4 </blockquote><br> https://www.mozilla.org/security/advisories/mfsa2018-14/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/f90fce70-ecfa-4f4d-9ee8-c476dbf4bf0e.html">f90fce70-ecfa-4f4d-9ee8-c476dbf4bf0e</a></td><td>mozilla -- data: URL can inherit wrong origin after an HTTP redirect<br> <p>The Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-91/"> <p>Redirection from an HTTP connection to a data: URL assigns the referring site's origin to the data: URL in some circumstances. This can result in same-origin violations against a domain if it loads resources from malicious sites. Cross-origin setting of cookies has been demonstrated without the ability to read them.</p> </blockquote> <br>Discovery 2016-11-28<br>Entry 2016-11-29<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 50.0.1,1 </blockquote><br> CVE-2016-9078<br> https://www.mozilla.org/security/advisories/mfsa2016-91/<br> </td></tr> <tr><td class="vtop" nowrap><a href="https://www.vuxml.org/freebsd/d10b49b2-8d02-49e8-afde-0844626317af.html">d10b49b2-8d02-49e8-afde-0844626317af</a></td><td>mozilla -- multiple vulnerabilities<br> <p>Mozilla Foundation reports:</p> <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/"> <p>CVE-2018-12407: Buffer overflow with ANGLE library when using VertexBuffer11 module</p> <p>CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11</p> <p>CVE-2018-18492: Use-after-free with select element</p> <p>CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia</p> <p>CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs</p> <p>CVE-2018-18495: WebExtension content scripts can be loaded in about: pages</p> <p>CVE-2018-18496: Embedded feed preview page can be abused for clickjacking</p> <p>CVE-2018-18497: WebExtensions can load arbitrary URLs through pipe separators</p> <p>CVE-2018-18498: Integer overflow when calculating buffer sizes for images</p> <p>CVE-2018-12406: Memory safety bugs fixed in Firefox 64</p> <p>CVE-2018-12405: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4</p> </blockquote> <br>Discovery 2018-12-11<br>Entry 2018-12-11<br>Modified 2019-07-23<br><a href="/www/firefox/">firefox<br> </a><blockquote>< 64.0_3,1 </blockquote><br> waterfox<br> <blockquote>< 56.2.6 </blockquote><br> seamonkey<br> linux-seamonkey<br> <blockquote>< 2.53.0 </blockquote><br> <a href="/www/firefox-esr/">firefox-esr<br> </a><blockquote>< 60.4.0,1 </blockquote><br> linux-firefox<br> <blockquote>< 60.4.0,2 </blockquote><br> libxul<br> <a href="/mail/thunderbird/">thunderbird<br> </a>linux-thunderbird<br> <blockquote>< 60.4.0 </blockquote><br> CVE-2018-12405<br> CVE-2018-12406<br> CVE-2018-12407<br> CVE-2018-17466<br> CVE-2018-18492<br> CVE-2018-18493<br> CVE-2018-18494<br> CVE-2018-18495<br> CVE-2018-18496<br> CVE-2018-18497<br> CVE-2018-18498<br> https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/<br> https://www.mozilla.org/en-US/security/advisories/mfsa2018-30/<br> </td></tr> </table> </body> </html>

FreshPorts - VuXML

CVE-2019-11733: Stored passwords in 'Saved Logins' can be copied without master password entry