firefox

Free web browser backed by Mozilla

Current: 159.0
Candidate: 159.0.1

License: MPL-2.0
BuildSystem: ❔ custom

Build

Target	Result	Last successful version	Succeeded at
rva23	Succeeded	159.0	2026-11-04 21:37:12 UTC
rva20	Succeeded	159.0	2026-11-05 00:54:23 UTC
x86_64	Succeeded	159.0	2026-11-04 18:00:36 UTC

Advisory · 19

Query product: firefoxNVD
Query vendor: mozillaNVD
Query version: 159.0NVD

Provider matches do not establish RPM applicability. Local patches, bundled dependencies and binary artifacts are not evaluated.

CVE-2003-1492
NVD
Summary
Netscape Navigator 7.0.2 and Mozilla allows remote attackers to access cookie information in a different domain via an HTTP request for a domain with an extra . (dot) at the end.NVD
EPSS model date
2026-11-06FIRST
EPSS probability
1.2%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:N/AC:L/Au:N/C:N/I:P/A:NNVD
References
Web · exchange.xforce.ibmcloud.com
CVE-2007-1970
NVD
Summary
Mozilla Firefox does not warn the user about HTTP elements on an HTTPS page when the HTTP elements are dynamically created by a delayed document.write, which allows remote attackers to supply unauthenticated content and conduct phishing attacks.NVD
EPSS model date
2026-11-06FIRST
EPSS probability
0.934%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:N/AC:L/Au:N/C:P/I:N/A:NNVD
CVE-2007-2176
NVD
Summary
Unspecified vulnerability in Mozilla Firefox allows remote attackers to execute arbitrary code via unspecified vectors involving Javascript errors. NOTE: this might be the same issue as CVE-2007-2175.NVD
EPSS model date
2026-11-06FIRST
EPSS probability
2.97%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:N/AC:L/Au:N/C:C/I:C/A:CNVD
CVE-2007-3670
NVD
Summary
Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI, which are inserted into the command line that is created when invoking firefox.exe. NOTE: it has been debated as to whether the issue is in Internet Explorer or Firefox. As of 20070711, it is CVE's opinion that IE appears to be failing to properly delimit the URL argument when invoking Firef…NVD
EPSS model date
2026-11-06FIRST
EPSS probability
29.4%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:N/AC:M/Au:N/C:N/I:P/A:NNVD
Summary characters omitted
223NVD
References
Web · exchange.xforce.ibmcloud.com
CVE-2007-3827
NVD
Summary
Mozilla Firefox allows for cookies to be set with a null domain (aka "domainless cookies"), which allows remote attackers to pass information between arbitrary domains and track user activity, as demonstrated by the domain attribute in the document.cookie variable in a javascript: window.NVD
EPSS model date
2026-11-06FIRST
EPSS probability
0.934%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:N/AC:L/Au:N/C:P/I:N/A:NNVD
CVE-2007-4013
NVD
Summary
Multiple unspecified vulnerabilities in (1) Net6Helper.DLL (aka Net6Launcher Class) 4.5.2 and earlier, (2) npCtxCAO.dll (aka Citrix Endpoint Analysis Client) in a Firefox plugin directory, and (3) a second npCtxCAO.dll (aka CCAOControl Object) before 4.5.0.0 in Citrix Access Gateway Standard Edition before 4.5.5 and Advanced Edition before 4.5 HF1 have unknown impact and attack vectors, possibly related to buffer overflows. NOTE: vector 3 might overlap CVE-2007-3679.NVD
EPSS model date
2026-11-06FIRST
EPSS probability
4.23%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:N/AC:M/Au:N/C:C/I:C/A:CNVD
CVE-2007-6715
NVD
Summary
Mozilla Firefox allows remote attackers to cause a denial of service (crash) via crafted image, as demonstrated by the zzuf lol-firefox.gif test case.NVD
EPSS model date
2026-11-06FIRST
EPSS probability
1.05%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:N/AC:M/Au:N/C:N/I:N/A:PNVD
CVE-2008-4059
NVD
Summary
The XPConnect component in Mozilla Firefox before 2.0.0.17 allows remote attackers to "pollute XPCNativeWrappers" and execute arbitrary code with chrome privileges via vectors related to a SCRIPT element.NVD
EPSS model date
2026-11-06FIRST
EPSS probability
5%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*; <= 2.0.0.17, cpe:2.3:a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.10:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.8:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.9:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.9:rc:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.9_rc:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0.5:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0.6:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0.6:*:linux:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0.7:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0.8:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.10:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.11:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.12:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.8:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.9:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.1:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.2:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.3:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.4:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.5:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.6:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.7:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.8:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5:beta1:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5:beta2:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.8:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.10:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.11:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.12:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.13:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.14:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.15:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.16:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.9:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0:beta1:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0:rc2:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0:rc3:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:N/AC:L/Au:N/C:P/I:P/A:PNVD
References
Fix · bugzilla.mozilla.org Web · exchange.xforce.ibmcloud.com Web · oval.cisecurity.org Web · www.redhat.com Web · www.redhat.com
CVE-2009-1597
NVD
Summary
Mozilla Firefox executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline PDF file, which might allow remote attackers to bypass intended Adobe Acrobat JavaScript restrictions on accessing the document object, as demonstrated by a web site that permits PDF uploads by untrusted users, and therefore has a shared document.domain between the web site and this javascript: URI. NOTE: the researcher reports that Adobe's position is "a PDF file is active content."NVD
EPSS model date
2026-11-06FIRST
EPSS probability
1.74%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:N/AC:M/Au:N/C:C/I:C/A:CNVD
CVE-2009-2469
NVD
Summary
Mozilla Firefox before 3.0.12 does not properly handle an SVG element that has a property with a watch function and an __defineSetter__ function, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted document, related to a certain pointer misinterpretation.NVD
EPSS model date
2026-11-06FIRST
EPSS probability
5.56%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*; <= 3.0.11, cpe:2.3:a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.10:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.1:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.2:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.3:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.4:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.5:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.6.1:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.6:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.7.1:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.7:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.8:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.9:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.9:rc:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:0.9_rc:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0.5:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0.6:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0.6:*:linux:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0.7:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0.8:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.0:preview_release:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.4.1:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.10:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.11:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.12:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.8:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.0.9:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.1:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.2:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.3:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.4:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.5:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.6:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.7:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5.8:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5:beta1:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.5:beta2:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:1.8:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.10:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.11:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.12:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.13:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.14:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.15:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.16:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.17:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.18:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.19:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.20:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.21:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0.0.9:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0:beta1:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0:beta_1:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0:rc2:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:2.0:rc3:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:3.0.10:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:3.0.1:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:3.0.2:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:3.0.3:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:3.0.4:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:3.0.5:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:3.0.6:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:3.0.7:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:3.0.8:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:3.0.9:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:3.0:*:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:3.0:alpha:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:3.0:beta2:*:*:*:*:*:*, cpe:2.3:a:mozilla:firefox:3.0:beta5:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:N/AC:L/Au:N/C:C/I:C/A:CNVD
References
Web · bugzilla.mozilla.org Web · oval.cisecurity.org Web · www.redhat.com
CVE-2009-4102
NVD
Summary
Sage 1.4.3 and earlier extension for Firefox performs certain operations with chrome privileges, which allows remote attackers to execute arbitrary commands and perform cross-domain scripting attacks via the description tag of an RSS feed.NVD
EPSS model date
2026-11-06FIRST
EPSS probability
3.39%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:N/AC:M/Au:N/C:C/I:C/A:CNVD
References
Web · exchange.xforce.ibmcloud.com
CVE-2009-4129
NVD
Summary
Race condition in Mozilla Firefox allows remote attackers to produce a JavaScript message with a spoofed domain association by writing the message in between the document request and document load for a web page in a different domain.NVD
EPSS model date
2026-11-06FIRST
EPSS probability
0.753%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:N/AC:M/Au:N/C:N/I:P/A:PNVD
References
Web · exchange.xforce.ibmcloud.com
CVE-2009-4130
NVD
Summary
Visual truncation vulnerability in the MakeScriptDialogTitle function in nsGlobalWindow.cpp in Mozilla Firefox allows remote attackers to spoof the origin domain name of a script via a long name.NVD
EPSS model date
2026-11-06FIRST
EPSS probability
0.993%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:N/AC:M/Au:N/C:N/I:P/A:PNVD
References
Web · exchange.xforce.ibmcloud.com
CVE-2009-4630
NVD
Summary
Mozilla Necko, as used in Firefox, SeaMonkey, and other applications, performs DNS prefetching of domain names contained in links within local HTML documents, which makes it easier for remote attackers to determine the network location of the application's user by logging DNS requests. NOTE: the vendor disputes the significance of this issue, stating "I don't think we necessarily need to worry about that case."NVD
EPSS model date
2026-11-06FIRST
EPSS probability
1.03%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:N/AC:L/Au:N/C:P/I:N/A:NNVD
References
Web · bugzilla.mozilla.org Web · bugzilla.mozilla.org
CVE-2011-0064
NVD
Summary
The hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via crafted OpenType font data that triggers use of an incorrect index.NVD
EPSS model date
2026-11-06FIRST
EPSS probability
3.33%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:N/AC:M/Au:N/C:P/I:P/A:PNVD
References
Fix · bugzilla.redhat.com Fix · build.opensuse.org Web · bugzilla.mozilla.org Web · bugzilla.novell.com Web · exchange.xforce.ibmcloud.com
CVE-2012-4929
NVD
Summary
The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.NVD
EPSS model date
2026-11-06FIRST
EPSS probability
4.35%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:N/AC:H/Au:N/C:P/I:N/A:NNVD
References
Web · bugzilla.redhat.com Web · chromiumcodereview.appspot.com Web · community.qualys.com Web · gist.github.com Web · github.com Web · oval.cisecurity.org Web · threatpost.com
CVE-2012-4930
NVD
Summary
The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.NVD
EPSS model date
2026-11-06FIRST
EPSS probability
2.08%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:N/AC:H/Au:N/C:P/I:N/A:NNVD
References
Web · bugzilla.redhat.com Web · community.qualys.com
CVE-2016-7152
NVD
Summary
The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.NVD
EPSS model date
2026-11-06FIRST
EPSS probability
12.8%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:N/AC:L/Au:N/C:P/I:N/A:NNVD
CVSS_V3
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NNVD
References
Web · tom.vg
CVE-2016-7153
NVD
Summary
The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.NVD
EPSS model date
2026-11-06FIRST
EPSS probability
12.8%FIRST
Vulnerable CPE criteria
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:N/AC:L/Au:N/C:P/I:N/A:NNVD
CVSS_V3
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NNVD
References
Web · tom.vg

Description

Mozilla Firefox is a free, open-source web browser developed by the Mozilla Foundation, focused on user privacy, speed, and customization.

Changelog

SPECS: firefox: Update to 159.0.
misaka00251ff2613e568f22026-10-21 18:35:32 UTC
SPECS: firefox: Update firefox to 155.0.
misaka00251d1e274f7b4902026-09-03 06:52:08 UTC
SPECS: firefox: Update to 154.0.
misaka002510e8e9eef04d02026-08-19 02:44:52 UTC
SPECS: firefox: Enable crashreporter for RISC-V
purofle81f16344b3e62026-07-17 11:31:56 UTC
SPECS: firefox: Remove homepage setting.
misaka0025163cc5949872c2026-07-10 09:15:37 UTC
SPECS: firefox: Update firefox to 152.0.5 & Fix logo issue.
misaka0025145be78d5c9622026-07-10 09:10:37 UTC
SPECS: firefox: Update to 152.0.
misaka00251cb06520ccf8d2026-06-12 06:35:23 UTC
SPECS: firefox: Enable crashreporter for RISC-V
purofle28a19e869ded2026-06-23 07:50:49 UTC
SPECS: firefox: Blindly set rust rva23 target when needed.
Kai Zhang2abac0b632cf2026-06-04 08:11:59 UTC
SPECS: firefox: Add firefox.
misaka00251ba7852693eb32026-05-07 09:37:02 UTC

PR · 13

#1544 Update firefox to 159.
misaka002512026-11-04 15:42:56 UTC
#1234 SPECS: firefox: Update firefox to 155.0.
misaka002512026-09-06 05:43:55 UTC
#1171 Update firefox to 154.0.1
misaka002512026-08-31 06:57:49 UTC
#955 SPECS: firefox: Enable crashreporter for RISC-V
purofle2026-08-20 05:11:34 UTC
#978 Let llvm-static be a MUST explicit dependency.
laokz2026-08-11 03:47:30 UTC
#897 Update firefox to 152.0.5 & Fix multiple issues.
misaka002512026-07-14 02:45:23 UTC
#695 SPECS: firefox: Update firefox to 152.0.
misaka002512026-06-25 03:09:23 UTC
#784 SPECS: firefox: Enable crashreporter for RISC-V
purofle2026-06-23 15:21:29 UTC
#582 SPECS: rust: Set to rva23 target for rva23 project.
laokz2026-06-15 17:07:44 UTC
#448 SPECS: firefox: Add firefox.
misaka002512026-05-23 06:34:07 UTC
#455 SPECS: libproxy: Update to 0.5.12.
misaka002512026-05-20 15:31:17 UTC
#380 [WIP] SPECS: firefox: Add firefox.
misaka002512026-05-12 14:56:10 UTC
#346 SPECS: nss: Update to 3.123.1.
misaka002512026-05-12 02:28:08 UTC

Issue · 7

#1543 Firefox: 155.0 → 159.0
misaka002512026-11-04 15:42:52 UTC
#709 firefox: PGO build failure on riscv64 rva20/rva23
misaka002512026-06-22 08:15:45 UTC
#53 firefox: Package request
misaka002512026-05-23 15:27:22 UTC
#375 clang: fails to find system libstdc++ headers, causing `<new>` to be missing
misaka002512026-05-13 15:14:20 UTC
#378 perl: Both the main and devel package provide files
misaka002512026-05-12 13:56:38 UTC
#372 gtk3: Both the main and devel packages provide `im-xim.so`
misaka002512026-05-12 07:49:39 UTC
#322 aom: Package request
misaka002512026-05-08 09:03:27 UTC

Checks

Monitor	Observation	Last checked
Source	Checked	2026-11-06 20:01:57 UTC
Version	Checked	2026-11-06 17:26:48 UTC
Build	Checked	2026-11-06 20:02:41 UTC
GitHub	Checked	2026-11-06 19:54:46 UTC
EOL	Checked Current source cycle 159; upstream lifecycle only.	2026-11-06 15:47:37 UTC
LicenseDiff	Not configured No reliable monitor identity/configuration.	—
Dependencies	Not configured No reliable monitor identity/configuration.	—
Advisory	Checked Current source component only; local patches, build options, bundled dependencies and binary artifacts are not evaluated.	2026-11-06 12:53:11 UTC Last attempted2026-11-06 15:47:37 UTC
Yanked	Not configured No reliable monitor identity/configuration.	—

Monitor	Checks
Source	6365 Checked 17 CheckFailed
Version	5539 Checked 127 CheckFailed 705 Not configured 3 Partial evidence 8 Input unavailable
Build	6380 Checked 2 Not yet checked
GitHub	6382 Checked
EOL	6258 Not configured 118 Checked 3 Metadata unavailable 3 Input unavailable
LicenseDiff	1664 Not configured 187 Input changed 3177 Not applicable 1132 Checked 11 Input unavailable 207 Metadata unavailable 4 CheckFailed
Dependencies	1851 Not configured 3212 Checked 59 Partial evidence 1248 Metadata unavailable 7 Input unavailable 5 CheckFailed
Advisory	4994 Checked 1375 Not configured 7 Input unavailable 6 Metadata unavailable
Yanked	2247 Not configured 4115 Checked 5 CheckFailed 7 Input unavailable 8 Metadata unavailable