Vulnerabilities > Mozilla > Firefox > High

DATE CVE VULNERABILITY TITLE RISK
2018-06-11 CVE-2016-9061 Permission Issues vulnerability in Mozilla Firefox
A previously installed malicious Android application which defines a specific signature-level permissions used by Firefox can access API keys meant for Firefox only.
network
low complexity
mozilla CWE-275
7.5
2018-06-11 CVE-2016-5299 Permission Issues vulnerability in Mozilla Firefox
A previously installed malicious Android application with same signature-level permissions as Firefox can intercept AuthTokens meant for Firefox only.
network
low complexity
mozilla CWE-275
7.5
2018-06-11 CVE-2016-5296 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash.
network
low complexity
mozilla debian CWE-119
7.5
2018-06-11 CVE-2016-5295 Permissions, Privileges, and Access Controls vulnerability in Mozilla Firefox
This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke the Mozilla Updater to run malicious local files.
local
low complexity
mozilla CWE-264
7.8
2017-03-15 CVE-2016-10196 Out-of-bounds Write vulnerability in multiple products
Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument.
network
low complexity
debian libevent-project mozilla CWE-787
7.5
2016-09-22 CVE-2016-5284 Improper Input Validation vulnerability in Mozilla Firefox
Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning, which allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority.
network
low complexity
mozilla CWE-20
7.4
2016-09-22 CVE-2016-5283 Improper Access Control vulnerability in Mozilla Firefox
Mozilla Firefox before 49.0 allows remote attackers to bypass the Same Origin Policy via a crafted fragment identifier in the SRC attribute of an IFRAME element, leading to insufficient restrictions on link-color information after a document is resized.
network
low complexity
mozilla CWE-284
8.8
2016-09-22 CVE-2016-5278 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Mozilla Firefox
Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image.
network
low complexity
mozilla CWE-119
8.8
2016-09-22 CVE-2016-5275 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Mozilla Firefox
Buffer overflow in the mozilla::gfx::FilterSupport::ComputeSourceNeededRegions function in Mozilla Firefox before 49.0 allows remote attackers to execute arbitrary code by leveraging improper interaction between empty filters and CANVAS element rendering.
network
low complexity
mozilla CWE-119
8.8
2016-09-22 CVE-2016-5273 Improper Access Control vulnerability in Mozilla Firefox
The mozilla::a11y::HyperTextAccessible::GetChildOffset function in the accessibility implementation in Mozilla Firefox before 49.0 allows remote attackers to execute arbitrary code via a crafted web site.
network
low complexity
mozilla CWE-284
8.8