Vulnerabilities > Mozilla > Firefox > 21.0

DATE CVE VULNERABILITY TITLE RISK
2020-01-08 CVE-2019-11760 Out-of-bounds Write vulnerability in multiple products
A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling.
network
low complexity
mozilla canonical CWE-787
8.8
2020-01-08 CVE-2019-11759 Classic Buffer Overflow vulnerability in multiple products
An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack.
network
low complexity
mozilla canonical CWE-120
8.8
2020-01-08 CVE-2019-11758 Out-of-bounds Write vulnerability in multiple products
Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed.
6.8
2020-01-08 CVE-2019-11757 Use After Free vulnerability in multiple products
When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it.
network
low complexity
mozilla canonical CWE-416
8.8
2020-01-08 CVE-2019-11756 Use After Free vulnerability in Mozilla Firefox
Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service).
network
mozilla CWE-416
6.8
2020-01-08 CVE-2019-11745 Out-of-bounds Write vulnerability in multiple products
When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur.
6.8
2019-09-27 CVE-2019-11754 Unspecified vulnerability in Mozilla Firefox
When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given.
network
mozilla
4.3
2019-09-27 CVE-2019-11753 Improper Validation of Integrity Check Value vulnerability in Mozilla Firefox
The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malware.
local
low complexity
mozilla CWE-354
4.6
2019-09-27 CVE-2019-11752 Use After Free vulnerability in Mozilla Firefox
It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion.
network
mozilla CWE-416
critical
9.3
2019-09-27 CVE-2019-11751 Argument Injection or Modification vulnerability in Mozilla Firefox and Firefox ESR
Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks on malicious links in a chat application.
6.8