Vulnerabilities > Mozilla > Firefox > 21.0

DATE CVE VULNERABILITY TITLE RISK
2020-07-09 CVE-2020-12402 Information Exposure Through Discrepancy vulnerability in multiple products
During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow.
local
high complexity
mozilla opensuse fedoraproject debian CWE-203
4.4
2020-07-09 CVE-2020-12399 Information Exposure Through Discrepancy vulnerability in multiple products
NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys.
local
high complexity
mozilla debian CWE-203
1.2
2020-07-09 CVE-2020-12424 Incorrect Default Permissions vulnerability in multiple products
When constructing a permission prompt for WebRTC, a URI was supplied from the content process.
network
low complexity
mozilla opensuse CWE-276
6.5
2020-07-09 CVE-2018-12371 Integer Overflow or Wraparound vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird
An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM.
6.8
2020-05-26 CVE-2020-6831 Classic Buffer Overflow vulnerability in multiple products
A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC.
network
low complexity
mozilla canonical debian opensuse CWE-120
7.5
2020-05-26 CVE-2020-6830 Information Exposure vulnerability in Mozilla Firefox
For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions.
network
low complexity
mozilla CWE-200
5.0
2020-05-26 CVE-2020-12392 Path Traversal vulnerability in multiple products
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website.
local
low complexity
mozilla canonical CWE-22
2.1
2020-05-26 CVE-2020-12391 Incorrect Authorization vulnerability in Mozilla Firefox
Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context.
network
low complexity
mozilla CWE-863
5.0
2020-05-26 CVE-2020-12390 Deserialization of Untrusted Data vulnerability in Mozilla Firefox
Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks.
network
low complexity
mozilla CWE-502
7.5
2020-05-26 CVE-2020-12389 Improper Input Validation vulnerability in Mozilla Firefox
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape.
network
low complexity
mozilla CWE-20
7.5