Vulnerabilities > Mozilla > Firefox > 2.0.0.17

DATE CVE VULNERABILITY TITLE RISK
2018-06-11 CVE-2018-5153 Out-of-bounds Read vulnerability in multiple products
If websocket data is sent with mixed text and binary in a single message, the binary data can be corrupted.
network
low complexity
mozilla canonical CWE-125
5.0
2018-06-11 CVE-2018-5152 Use of a Broken or Risky Cryptographic Algorithm vulnerability in multiple products
WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the "webRequest" API.
4.3
2018-06-11 CVE-2018-5151 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
Memory safety bugs were reported in Firefox 59.
network
low complexity
mozilla canonical CWE-119
critical
10.0
2018-06-11 CVE-2018-5150 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7.
network
low complexity
debian redhat mozilla canonical CWE-119
7.5
2018-06-11 CVE-2018-5148 Use After Free vulnerability in multiple products
A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one.
network
low complexity
debian redhat mozilla canonical CWE-416
7.5
2018-06-11 CVE-2018-5147 Out-of-bounds Write vulnerability in multiple products
The libtremor library has the same flaw as CVE-2018-5146.
network
low complexity
debian mozilla CWE-787
7.5
2018-06-11 CVE-2018-5146 Out-of-bounds Write vulnerability in multiple products
An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest.
6.8
2018-06-11 CVE-2018-5143 Cross-site Scripting vulnerability in multiple products
URLs using "javascript:" have the protocol removed when pasted into the addressbar to protect users from cross-site scripting (XSS) attacks, but if a tab character is embedded in the "javascript:" URL the protocol is not removed and the script will execute.
4.3
2018-06-11 CVE-2018-5142 If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not properly display the originating domain.
network
low complexity
mozilla canonical
5.0
2018-06-11 CVE-2018-5141 Improper Input Validation vulnerability in multiple products
A vulnerability in the notifications Push API where notifications can be sent through service workers by web content without direct user interaction.
network
low complexity
mozilla canonical CWE-20
6.4