Mozilla Firefox vulnerabilities

Mozilla Firefox before version 49.0 allows remote attackers to bypass the Same Origin Policy via a crafted fragment identifier in the SRC attribute of an IFRAME element, leading to insufficient restrictions on link-color information after a document is resized.

Buffer overflow in the mozilla::gfx::FilterSupport::ComputeSourceNeededRegions function in Mozilla Firefox before version 49.0 allows remote attackers to execute arbitrary code by leveraging improper interaction between empty filters and CANVAS element rendering.

The mozilla::a11y::HyperTextAccessible::GetChildOffset function in the accessibility implementation in Mozilla Firefox before version 49.0 allows remote attackers to execute arbitrary code via a crafted web site.

Mozilla Firefox before 48.0 does not properly restrict drag-and-drop (dataTransfer) actions for file: URIs, allowing user-assisted remote attackers to access local files via a crafted web site.

A use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application.

The nsDisplayList::HitTest function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 mishandles rendering display transformation, allowing remote attackers to execute arbitrary code via a crafted web site that leverages 'type confusion.'

A use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via a script that closes its own Service Worker within a nested sync event loop.

A use-after-free vulnerability in the js::PreliminaryObjectArray::sweep function in Mozilla Firefox before version 48.0 allows remote attackers to execute arbitrary code via crafted JavaScript mishandled during incremental garbage collection.

A stack-based buffer underflow in the mozilla::gfx::BasePoint4d function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via crafted two-dimensional graphics data that is mishandled during clipping-region calculations.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 48.0 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Mozilla Firefox versions before 47.0 and Firefox ESR 45.x before 45.2 do not ensure that the user approves the fullscreen and pointerlock settings, allowing remote attackers to cause a UI outage or conduct clickjacking or spoofing attacks via a crafted web site.

Use-after-free vulnerability in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via WebGL content that triggers texture access after destruction of the texture's recycle pool.

The maintenance service in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 on Windows does not prevent MAR extracted-file modification during updater execution, which might allow local users to gain privileges via a Trojan horse file.

Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via foreign-context HTML5 fragments, as demonstrated by fragments within an SVG element.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 46.0 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not verify that memory allocation succeeds. This allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via crafted Unicode data in an HTML, XML, or SVG document.

An integer underflow in the Brotli algorithm, used in Mozilla Firefox before version 45.0, allows remote attackers to execute arbitrary code or cause a denial of service via crafted data with Brotli compression.

The FileReader class in Mozilla Firefox before version 45.0 allows local users to gain privileges or cause a denial of service (memory corruption) by changing a file during a FileReader API read operation.

The ServiceWorkerManager class in Mozilla Firefox before version 45.0 allows remote attackers to execute arbitrary code or cause a denial of service via unspecified use of the Clients API.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 45.0 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.

Mozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers and plugins, allowing remote attackers to bypass the Same Origin Policy via a crafted website.

The nsZipArchive function in Mozilla Firefox before version 44.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect use of a pointer during processing of a ZIP archive.

Mozilla Firefox before 44.0 allows user-assisted remote attackers to spoof a trailing substring in the address bar by leveraging a user's paste of a (1) wyciwyg: URI or (2) resource: URI.

Buffer overflow in the nsDeque::GrowCapacity function in Mozilla Firefox before version 43.0 may allow remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a deque size change.

Buffer overflow in the XDRBuffer::grow function in js/src/vm/Xdr.cpp in Mozilla Firefox before version 43.0 may allow remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code.

Use-after-free vulnerability in Mozilla Firefox before version 43.0 and Firefox ESR 38.x before version 38.5 allows remote attackers to execute arbitrary code by triggering attempted use of a data channel that has been closed by a WebRTC function.

Buffer overflow in the DirectWriteFontInfo::LoadFontFamilyData function in Mozilla Firefox before version 43.0 may allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted font-family name.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 43.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly follow the CORS cross-origin request algorithm for the POST method in situations involving an unspecified Content-Type header manipulation, allowing remote attackers to bypass the Same Origin Policy.

The accessibility-tools feature in Mozilla Firefox before version 42.0 on OS X improperly interacts with the implementation of the TABLE element, which may lead to application crashes or potentially allow remote attackers to execute arbitrary code.

Mozilla Firefox versions before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to bypass the Same Origin Policy for an IP address origin, enabling cross-site scripting (XSS) attacks by appending whitespace characters to an IP address string.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 42.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

The ReadbackResultWriterD3D11::Run function in Mozilla Firefox before version 41.0 and Firefox ESR 38.x before version 38.3 misinterprets the return value of a function call. This may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact.

The InitTextures function in Mozilla Firefox before version 41.0 and Firefox ESR 38.x before version 38.3 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.

The AnimationThread function in Mozilla Firefox before version 41.0 and Firefox ESR 38.x before version 38.3 uses an incorrect argument to the sscanf function, which may lead to application crashes or remote attacks.

The XULContentSinkImpl::AddText function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an 'overflow.'

The nsAttrAndChildArray::GrowBy function in Mozilla Firefox before version 41.0 and Firefox ESR 38.x before version 38.3 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an 'overflow.'

The ConvertDialogOptions function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.

Mozilla Firefox before version 41.0 allows remote attackers to bypass certain ECMAScript 5 API protection mechanisms, enabling modification of immutable properties and execution of arbitrary JavaScript code with chrome privileges via a crafted web page.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 41.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

The add-on installation feature in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to bypass an intended user-confirmation requirement by constructing a crafted data: URL and triggering navigation to an arbitrary http: or https: URL at a certain early point in the installation process.

A use-after-free vulnerability in the MediaStream playback feature in Mozilla Firefox before version 40.0 allows remote attackers to execute arbitrary code via unspecified use of the Web Audio API.

The mozilla::AudioSink function in Mozilla Firefox before version 40.0 and Firefox ESR 38.x before version 38.2 mishandles inconsistent sample formats within MP3 audio data, allowing remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a malformed file.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 40.0 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a dedicated worker.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 39.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

A use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a shared worker.

The asm.js implementation in Mozilla Firefox before version 38.0 does not properly determine heap lengths during identification of cases in which bounds checking may be safely skipped. This allows remote attackers to trigger out-of-bounds write operations and possibly execute arbitrary code, or trigger out-of-bounds read operations and possibly obtain sensitive information from process memory.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before version 38.0 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.