Vulnerabilities > Mozilla > Firefox > 21.0

DATE CVE VULNERABILITY TITLE RISK
2020-03-02 CVE-2020-6796 Out-of-bounds Write vulnerability in Mozilla Firefox
A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write.
network
mozilla CWE-787
6.8
2020-03-02 CVE-2019-17026 Type Confusion vulnerability in multiple products
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion.
network
low complexity
mozilla canonical CWE-843
8.8
2020-02-18 CVE-2013-5594 Improper Restriction of Rendered UI Layers or Frames vulnerability in Mozilla Firefox
Mozilla Firefox before 25 allows modification of anonymous content of pluginProblem.xml binding
network
mozilla CWE-1021
4.3
2020-01-08 CVE-2019-9812 Unspecified vulnerability in Mozilla Firefox
Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a malicious Firefox Sync account.
network
low complexity
mozilla
critical
9.3
2020-01-08 CVE-2019-17025 Out-of-bounds Write vulnerability in multiple products
Mozilla developers reported memory safety bugs present in Firefox 71.
6.8
2020-01-08 CVE-2019-17024 Out-of-bounds Write vulnerability in multiple products
Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3.
6.8
2020-01-08 CVE-2019-17023 Improper Authentication vulnerability in multiple products
After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine.
network
low complexity
mozilla canonical debian CWE-287
6.5
2020-01-08 CVE-2019-17022 Cross-site Scripting vulnerability in Mozilla Firefox and Firefox ESR
When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters.
4.3
2020-01-08 CVE-2019-17021 Race Condition vulnerability in multiple products
During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process.
network
high complexity
mozilla opensuse CWE-362
2.6
2020-01-08 CVE-2019-17020 Improper Input Validation vulnerability in multiple products
If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet.
4.3