Mozilla Firefox — свободный браузер на движке Gecko
Релизный цикл, информация об уязвимостях
График релизов
Релизные элементы
| KB | Версия | Билд | Дата доступности |
|---|---|---|---|
| 138.0.4 | 138.0.4 | ||
| 138.0.3 | 138.0.3 | ||
| 138.0.1 | 138.0.1 | ||
| 138.0 | 138.0 |
Показывать по
Количество 17 296
CVE-2009-0356
Mozilla Firefox before 3.0.6 and SeaMonkey do not block links to the (1) about:plugins and (2) about:config URIs from .desktop files, which allows user-assisted remote attackers to bypass the Same Origin Policy and execute arbitrary code with chrome privileges via vectors involving the URL field in a Desktop Entry section of a .desktop file, related to representation of about: URIs as jar:file:// URIs. NOTE: this issue exists because of an incomplete fix for CVE-2008-4582.
CVE-2009-0356
Mozilla Firefox before 3.0.6 and SeaMonkey do not block links to the ( ...
CVE-2009-0355
components/sessionstore/src/nsSessionStore.js in Mozilla Firefox before 3.0.6 does not block changes of INPUT elements to type="file" during tab restoration, which allows user-assisted remote attackers to read arbitrary files on a client machine via a crafted INPUT element.
CVE-2009-0355
components/sessionstore/src/nsSessionStore.js in Mozilla Firefox befor ...
CVE-2009-0354
Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting (XSS) attacks, via vectors involving a chrome XBL method and the window.eval function.
CVE-2009-0354
Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x ...
CVE-2009-0353
Unspecified vulnerability in Mozilla Firefox 3.x before 3.0.6, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the JavaScript engine.
CVE-2009-0353
Unspecified vulnerability in Mozilla Firefox 3.x before 3.0.6, Thunder ...
CVE-2009-0352
Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.6, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the layout engine and destruction of arbitrary layout objects by the nsViewManager::Composite function.
CVE-2009-0352
Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0 ...
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2009-0356 Mozilla Firefox before 3.0.6 and SeaMonkey do not block links to the (1) about:plugins and (2) about:config URIs from .desktop files, which allows user-assisted remote attackers to bypass the Same Origin Policy and execute arbitrary code with chrome privileges via vectors involving the URL field in a Desktop Entry section of a .desktop file, related to representation of about: URIs as jar:file:// URIs. NOTE: this issue exists because of an incomplete fix for CVE-2008-4582. | CVSS2: 5.1 | 3% Низкий | больше 17 лет назад |
| CVE-2009-0356 Mozilla Firefox before 3.0.6 and SeaMonkey do not block links to the ( ... | CVSS2: 5.1 | 3% Низкий | больше 17 лет назад |
| CVE-2009-0355 components/sessionstore/src/nsSessionStore.js in Mozilla Firefox before 3.0.6 does not block changes of INPUT elements to type="file" during tab restoration, which allows user-assisted remote attackers to read arbitrary files on a client machine via a crafted INPUT element. | CVSS2: 5.4 | 2% Низкий | больше 17 лет назад |
| CVE-2009-0355 components/sessionstore/src/nsSessionStore.js in Mozilla Firefox befor ... | CVSS2: 5.4 | 2% Низкий | больше 17 лет назад |
| CVE-2009-0354 Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting (XSS) attacks, via vectors involving a chrome XBL method and the window.eval function. | CVSS2: 2.6 | 2% Низкий | больше 17 лет назад |
| CVE-2009-0354 Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x ... | CVSS2: 2.6 | 2% Низкий | больше 17 лет назад |
| CVE-2009-0353 Unspecified vulnerability in Mozilla Firefox 3.x before 3.0.6, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the JavaScript engine. | CVSS2: 10 | 4% Низкий | больше 17 лет назад |
| CVE-2009-0353 Unspecified vulnerability in Mozilla Firefox 3.x before 3.0.6, Thunder ... | CVSS2: 10 | 4% Низкий | больше 17 лет назад |
| CVE-2009-0352 Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.6, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the layout engine and destruction of arbitrary layout objects by the nsViewManager::Composite function. | CVSS2: 10 | 4% Низкий | больше 17 лет назад |
| CVE-2009-0352 Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0 ... | CVSS2: 10 | 4% Низкий | больше 17 лет назад |
Уязвимостей на страницу