Vulnerabilities > Mozilla > Firefox > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-06-11 | CVE-2016-9066 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amounts of incoming data. | 7.5 |
| 2018-06-11 | CVE-2016-9065 | Improper Input Validation vulnerability in Mozilla Firefox The location bar in Firefox for Android can be spoofed by forcing a user into fullscreen mode, blocking its exiting, and creating of a fake location bar without any user notification. | 7.5 |
| 2018-06-11 | CVE-2016-9061 | Permission Issues vulnerability in Mozilla Firefox A previously installed malicious Android application which defines a specific signature-level permissions used by Firefox can access API keys meant for Firefox only. | 7.5 |
| 2018-06-11 | CVE-2016-5299 | Permission Issues vulnerability in Mozilla Firefox A previously installed malicious Android application with same signature-level permissions as Firefox can intercept AuthTokens meant for Firefox only. | 7.5 |
| 2018-06-11 | CVE-2016-5296 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash. | 7.5 |
| 2018-06-11 | CVE-2016-5295 | Permissions, Privileges, and Access Controls vulnerability in Mozilla Firefox This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke the Mozilla Updater to run malicious local files. | 7.8 |
| 2017-03-15 | CVE-2016-10196 | Out-of-bounds Write vulnerability in multiple products Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument. | 7.5 |
| 2016-09-22 | CVE-2016-5284 | Improper Input Validation vulnerability in Mozilla Firefox Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning, which allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority. | 7.4 |
| 2016-09-22 | CVE-2016-5283 | Improper Access Control vulnerability in Mozilla Firefox Mozilla Firefox before 49.0 allows remote attackers to bypass the Same Origin Policy via a crafted fragment identifier in the SRC attribute of an IFRAME element, leading to insufficient restrictions on link-color information after a document is resized. | 8.8 |
| 2016-09-22 | CVE-2016-5278 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Mozilla Firefox Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image. | 8.8 |