Vulnerabilities > Mozilla > Firefox > 20.0.1

DATE CVE VULNERABILITY TITLE RISK
2018-06-11 CVE-2018-5148 Use After Free vulnerability in multiple products
A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one.
network
low complexity
debian redhat mozilla canonical CWE-416
7.5
2018-06-11 CVE-2018-5147 Out-of-bounds Write vulnerability in multiple products
The libtremor library has the same flaw as CVE-2018-5146.
network
low complexity
debian mozilla CWE-787
7.5
2018-06-11 CVE-2018-5146 Out-of-bounds Write vulnerability in multiple products
An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest.
6.8
2018-06-11 CVE-2018-5143 Cross-site Scripting vulnerability in multiple products
URLs using "javascript:" have the protocol removed when pasted into the addressbar to protect users from cross-site scripting (XSS) attacks, but if a tab character is embedded in the "javascript:" URL the protocol is not removed and the script will execute.
4.3
2018-06-11 CVE-2018-5142 If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not properly display the originating domain.
network
low complexity
mozilla canonical
5.0
2018-06-11 CVE-2018-5141 Improper Input Validation vulnerability in multiple products
A vulnerability in the notifications Push API where notifications can be sent through service workers by web content without direct user interaction.
network
low complexity
mozilla canonical CWE-20
6.4
2018-06-11 CVE-2018-5140 Information Exposure vulnerability in multiple products
Image for moz-icons can be accessed through the "moz-icon:" protocol through script in web content even when otherwise prohibited.
network
low complexity
mozilla canonical CWE-200
5.0
2018-06-11 CVE-2018-5138 Improper Input Validation vulnerability in Mozilla Firefox
A spoofing vulnerability can occur when a malicious site with an extremely long domain name is opened in an Android Custom Tab (a browser panel inside another app) and the default browser is Firefox for Android.
network
low complexity
mozilla google CWE-20
5.0
2018-06-11 CVE-2018-5137 Information Exposure vulnerability in multiple products
A legacy extension's non-contentaccessible, defined resources can be loaded by an arbitrary web page through script.
network
low complexity
mozilla canonical CWE-200
5.0
2018-06-11 CVE-2018-5136 Improper Input Validation vulnerability in multiple products
A shared worker created from a "data:" URL in one tab can be shared by another tab with a different origin, bypassing the same-origin policy.
network
low complexity
canonical mozilla CWE-20
5.0