Mozilla Firefox — свободный браузер на движке Gecko
Релизный цикл, информация об уязвимостях
График релизов
Релизные элементы
| KB | Версия | Билд | Дата доступности |
|---|---|---|---|
| 138.0.4 | 138.0.4 | ||
| 138.0.3 | 138.0.3 | ||
| 138.0.1 | 138.0.1 | ||
| 138.0 | 138.0 |
Показывать по
Количество 17 337
CVE-2016-5265
Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow use ...
CVE-2016-5265
Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same local directory.
CVE-2016-5264
Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildL ...
CVE-2016-5264
Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application.
CVE-2016-5263
The nsDisplayList::HitTest function in Mozilla Firefox before 48.0 and ...
CVE-2016-5263
The nsDisplayList::HitTest function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 mishandles rendering display transformation, which allows remote attackers to execute arbitrary code via a crafted web site that leverages "type confusion."
CVE-2016-5262
Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 process J ...
CVE-2016-5262
Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 process JavaScript event-handler attributes of a MARQUEE element within a sandboxed IFRAME element that lacks the sandbox="allow-scripts" attribute value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site.
CVE-2016-5261
Integer overflow in the WebSocketChannel class in the WebSockets subsy ...
CVE-2016-5261
Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted packets that trigger incorrect buffer-resize operations during buffering.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
| CVE-2016-5265 Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow use ... | CVSS3: 5.5 | 1% Низкий | около 10 лет назад |
 | CVE-2016-5265 Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same local directory. | CVSS3: 5.5 | 1% Низкий | около 10 лет назад |
| CVE-2016-5264 Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildL ... | CVSS3: 8.8 | 3% Низкий | около 10 лет назад |
| CVE-2016-5264 Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application. | CVSS3: 8.8 | 3% Низкий | около 10 лет назад |
| CVE-2016-5263 The nsDisplayList::HitTest function in Mozilla Firefox before 48.0 and ... | CVSS3: 8.8 | 2% Низкий | около 10 лет назад |
| CVE-2016-5263 The nsDisplayList::HitTest function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 mishandles rendering display transformation, which allows remote attackers to execute arbitrary code via a crafted web site that leverages "type confusion." | CVSS3: 8.8 | 2% Низкий | около 10 лет назад |
| CVE-2016-5262 Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 process J ... | CVSS3: 6.1 | 1% Низкий | около 10 лет назад |
| CVE-2016-5262 Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 process JavaScript event-handler attributes of a MARQUEE element within a sandboxed IFRAME element that lacks the sandbox="allow-scripts" attribute value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site. | CVSS3: 6.1 | 1% Низкий | около 10 лет назад |
| CVE-2016-5261 Integer overflow in the WebSocketChannel class in the WebSockets subsy ... | CVSS3: 8.8 | 4% Низкий | около 10 лет назад |
| CVE-2016-5261 Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted packets that trigger incorrect buffer-resize operations during buffering. | CVSS3: 8.8 | 4% Низкий | около 10 лет назад |
Уязвимостей на страницу