rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-7745 
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the SIGCOMP dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-sigcomp.c by correcting a memory-size check.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-12T23:00:00.000Z
CVE-2017-7746 
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the SLSK dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-slsk.c by adding checks for the remaining length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-12T23:00:00.000Z
CVE-2017-7747 
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the PacketBB dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-packetbb.c by restricting additions to the protocol tree.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-12T23:00:00.000Z
CVE-2017-7748 
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WSP dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wsp.c by adding a length check.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-12T23:00:00.000Z
CVE-2017-7749 
A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
Problem types: description: Use-after-free during docshell reloading
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7750 
A use-after-free vulnerability during video control operations when a "<track>" element holds a reference to an older window if that window has been replaced in the DOM. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
Problem types: description: Use-after-free with track elements
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7751 
A use-after-free vulnerability with content viewer listeners that results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
Problem types: description: Use-after-free with content viewer listeners
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7752 
A use-after-free vulnerability during specific user interactions with the input method editor (IME) in some languages due to how events are handled. This results in a potentially exploitable crash but would require specific user interaction to trigger. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
Problem types: description: Use-after-free with IME input
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7753 
An out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, using cached style data. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
Problem types: description: Out-of-bounds read with cached style data and pseudo-elements
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7754 
An out-of-bounds read in WebGL with a maliciously crafted "ImageInfo" object during WebGL operations. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
Problem types: description: Out-of-bounds read in WebGL with ImageInfo object
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7755 
The Firefox installer on Windows can be made to load malicious DLL files stored in the same directory as the installer when it is run. This allows privileged execution if the installer is run with elevated privileges. Note: This attack only affects Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
Problem types: description: Privilege escalation through Firefox Installer with same directory DLL files
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7756 
A use-after-free and use-after-scope vulnerability when logging errors from headers for XML HTTP Requests (XHR). This could result in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
Problem types: description: Use-after-free and use-after-scope logging XHR header errors
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7757 
A use-after-free vulnerability in IndexedDB when one of its objects is destroyed in memory while a method on it is still being executed. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
Problem types: description: Use-after-free in IndexedDB
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7758 
An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
Problem types: description: Out-of-bounds read in Opus encoder
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7759 
Android intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs to local "file:" URLs, allowing for the reading of local data through a violation of same-origin policy. Note: This attack only affects Firefox for Android. Other operating systems are not affected. This vulnerability affects Firefox < 54.
Problem types: description: Android intent URLs can cause navigation to local file system
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7760 
The Mozilla Windows updater modifies some files to be updated by reading the original file and applying changes to it. The location of the original file can be altered by a malicious user by passing a special path to the callback parameter through the Mozilla Maintenance Service, allowing the manipulation of files in the installation directory and privilege escalation by manipulating the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.
Problem types: description: File manipulation and privilege escalation via callback parameter in Mozilla Windows Updater and Maintenance Service
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7761 
The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction (a form of symbolic link), protected files in the target directory of the junction can be deleted by the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.
Problem types: description: File deletion and privilege escalation through Mozilla Maintenance Service helper.exe application
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7762 
When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar. This can be used for spoofing the domain of the current page. This vulnerability affects Firefox < 54.
Problem types: description: Addressbar spoofing in Reader mode
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7763 
Default fonts on OS X display some Tibetan characters as whitespace. When used in the addressbar as part of an IDN this can be used for domain name spoofing attacks. Note: This attack only affects OS X operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
Problem types: description: Mac fonts render some unicode characters as spaces
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7764 
Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rendered as their raw "punycode" form, allowing for domain name spoofing attacks through character confusion. The current Unicode standard allows characters from "Aspirational Use Scripts" such as Canadian Syllabics to be mixed with Latin characters in the "moderately restrictive" IDN profile. We have changed Firefox behavior to match the upcoming Unicode version 10.0 which removes this category and treats them as "Limited Use Scripts.". This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
Problem types: description: Domain spoofing with combination of Canadian Syllabics and other unicode blocks
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7765 
The "Mark of the Web" was not correctly saved on Windows when files with very long names were downloaded from the Internet. Without the Mark of the Web data, the security warning that Windows displays before running executables downloaded from the Internet is not shown. Note: This attack only affects Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
Problem types: description: Mark of the Web bypass when saving executable files
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7766 
An attack using manipulation of "updater.ini" contents, used by the Mozilla Windows Updater, and privilege escalation through the Mozilla Maintenance Service to allow for arbitrary file execution and deletion by the Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.
Problem types: description: File execution and privilege escalation through updater.ini, Mozilla Windows Updater, and Mozilla Maintenance Service
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7767 
The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files with junk data using the Mozilla Windows Updater, which runs with the Maintenance Service's privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.
Problem types: description: Privilege escalation and arbitrary file overwrites through Mozilla Windows Updater and Mozilla Maintenance Service
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7768 
The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by convincing the service that it is reading a status file provided by the Mozilla Windows Updater. The Mozilla Maintenance Service executes with privileged access, bypassing system protections against unprivileged users. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.
Problem types: description: 32 byte arbitrary file read through Mozilla Maintenance Service
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7770 
A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar will not be rendered. This would allow a malicious site to displayed a spoofed addressbar, showing the location of an arbitrary website instead of the one loaded. Note: this issue only affects Firefox for Android. Desktop Firefox is unaffected. This vulnerability affects Firefox < 54.
Problem types: description: Addressbar spoofing with JavaScript events and fullscreen mode
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7771 
Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function.
Problem types: description: Out-of-bounds Read
Affected products: vendor: Mozilla
product: Firefox
Published: 2019-04-12T19:30:13.000Z
CVE-2017-7772 
Heap-based Buffer Overflow in Graphite2 library in Firefox before 54 in lz4::decompress function.
Problem types: description: Heap-based Buffer Overflow
Affected products: vendor: Mozilla
product: Firefox
Published: 2019-04-12T18:00:34.000Z
CVE-2017-7773 
Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/Decompressor.
Problem types: description: Heap-based Buffer Overflow
Affected products: vendor: Mozilla
product: Firefox
Published: 2019-04-12T19:31:23.000Z
CVE-2017-7774 
Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Silf::readGraphite function.
Problem types: description: Out-of-bounds Read
Affected products: vendor: Mozilla
product: Firefox
Published: 2019-04-12T19:32:43.000Z
CVE-2017-7776 
Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getClassGlyph.
Problem types: description: Heap-based Buffer Overflow
Affected products: vendor: Mozilla
product: Firefox
Published: 2019-04-12T19:33:58.000Z
CVE-2017-7777 
Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function.
Problem types: description: Use of Uninitialized Resource
Affected products: vendor: Mozilla
product: Firefox
Published: 2019-04-12T19:35:01.000Z
CVE-2017-7778 
A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2 version 1.3.10. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
Problem types: description: Vulnerabilities in the Graphite 2 library
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7779 
Memory safety bugs were reported in Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
Problem types: description: Memory safety bugs fixed in Firefox 55, Firefox ESR 52.3, and Thunderbird 52.3
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7780 
Memory safety bugs were reported in Firefox 54. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 55.
Problem types: description: Memory safety bugs fixed in Firefox 55
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7781 
An error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can yield a result "POINT_AT_INFINITY" when it should not. A man-in-the-middle attacker could use this to interfere with a connection, resulting in an attacked party computing an incorrect shared secret. This vulnerability affects Firefox < 55.
Problem types: description: Elliptic curve point addition error when using mixed Jacobian-affine coordinates
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7782 
An error in the "WindowsDllDetourPatcher" where a RWX ("Read/Write/Execute") 4k block is allocated but never protected, violating DEP protections. Note: This attack only affects Windows operating systems. Other operating systems are not affected. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
Problem types: description: WindowsDllDetourPatcher allocates memory without DEP protections
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7783 
If a long user name is used in a username/password combination in a site URL (such as " http://UserName:Password@example.com"), the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service. This vulnerability affects Firefox < 55.
Problem types: description: DOS attack through long username in URL
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7784 
A use-after-free vulnerability can occur when reading an image observer during frame reconstruction after the observer has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7785 
A buffer overflow can occur when manipulating Accessible Rich Internet Applications (ARIA) attributes within the DOM. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
Problem types: description: Buffer overflow manipulating ARIA attributes in DOM
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7786 
A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
Problem types: description: Buffer overflow while painting non-displayable SVG
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7787 
Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to information disclosure. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
Problem types: description: Same-origin policy bypass with iframes through page reloads
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7788 
When an "iframe" has a "sandbox" attribute and its content is specified using "srcdoc", that content does not inherit the containing page's Content Security Policy (CSP) as it should unless the sandbox attribute included "allow-same-origin". This vulnerability affects Firefox < 55.
Problem types: description: Sandboxed about:srcdoc iframes do not inherit CSP directives
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7789 
If a server sends two Strict-Transport-Security (STS) headers for a single connection, they will be rejected as invalid and HTTP Strict Transport Security (HSTS) will not be enabled for the connection. This vulnerability affects Firefox < 55.
Problem types: description: Failure to enable HSTS when two STS headers are sent for a connection
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7790 
On Windows systems, if non-null-terminated strings are copied into the crash reporter for some specific registry keys, stack memory data can be copied until a null is found. This can potentially contain private data from the local system. Note: This attack only affects Windows operating systems. Other operating systems are not affected. This vulnerability affects Firefox < 55.
Problem types: description: Windows crash reporter reads extra memory for some non-null-terminated registry values
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7791 
On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary domains following page navigation, spoofing of the origin of the modal alert from the iframe content. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
Problem types: description: Spoofing following page navigation with data: protocol and modal alerts
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7792 
A buffer overflow will occur when viewing a certificate in the certificate manager if the certificate has an extremely long object identifier (OID). This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
Problem types: description: Buffer overflow viewing certificates with an extremely long OID
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2017-7793 
A use-after-free vulnerability can occur in the Fetch API when the worker or the associated window are freed when still in use, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.
Problem types: description: Use-after-free with Fetch API
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z