| 376924
|
|
Traversing the accessible tree after changes to CSS display property can crash Firefox
|
Core
|
Disability Access AP
|
aaronlev
|
RESO
|
FIXE
|
2007-08-24
|
| 389106
|
|
Escape URIs (especially quotes) when passing them to external protocol handlers
|
Core
|
Security
|
cbiesinger
|
RESO
|
FIXE
|
2021-03-08
|
| 389580
|
|
some schemes with %00 launch unexpected handlers on windows
|
Core Graveyard
|
File Handling
|
cbiesinger
|
RESO
|
FIXE
|
2016-06-22
|
| 374810
|
|
Crash [@ MOZ_PNG_init_read_transf] with png image
|
Core
|
Graphics: ImageLib
|
glennrp+bmo
|
RESO
|
FIXE
|
2011-06-13
|
| 383424
|
|
Arbitrary code execution using an event handler attached to an element that is not in a document
|
Core
|
DOM: Core & HTML
|
jstenback+bmo
|
RESO
|
FIXE
|
2019-03-13
|
| 321224
|
|
crash with nativescrollbar inside tabpanels [@ nsView::SetTopMost] [@ HandleEvent] [@ nsViewManager::UpdateWidgetArea]
|
Core
|
XUL
|
MatsPalmgren_bugz
|
RESO
|
FIXE
|
2013-01-26
|
| 344300
|
|
Crash [@ nsFrameItems::AddChild ] on 1.8.0.5 and 1.8.1 branch
|
Core
|
Layout
|
MatsPalmgren_bugz
|
RESO
|
FIXE
|
2011-06-13
|
| 380100
|
|
Save() crashes canvas
|
Core
|
Graphics: Canvas2D
|
MatsPalmgren_bugz
|
RESO
|
FIXE
|
2007-08-24
|
| 380975
|
|
Branch null-ptr crashes in nsAccessibleHyperText (Linux only) [@ nsAccessibleHyperText::GetCaretOffset]
|
Core
|
Disability Access AP
|
MatsPalmgren_bugz
|
RESO
|
FIXE
|
2011-06-09
|
| 384344
|
|
free memory read at nsCachedStyleData:GetStyleData within DoDeletingFrameSubtree
|
Core
|
Layout
|
MatsPalmgren_bugz
|
RESO
|
FIXE
|
2009-04-24
|
| 386382
|
|
1.8 branch shutdown crash after using accessibility api (testcase from bug 377470)
|
Core
|
Disability Access AP
|
MatsPalmgren_bugz
|
RESO
|
FIXE
|
2008-02-08
|
| 387403
|
|
Thunderbird eat memory until crash when opening e-mail with broken vcard
|
Thunderbird
|
Mail Window Front En
|
mozilla
|
RESO
|
FIXE
|
2020-06-15
|
| 369211
|
|
content can pollute implicit XPCNativeWrapper
|
Core
|
Security
|
mrbkap
|
RESO
|
FIXE
|
2008-10-10
|
| 389613
|
|
back-port -osint logic from bug 384384 to 1.8.0 branch
|
Thunderbird
|
Security
|
mscott
|
RESO
|
FIXE
|
2007-08-26
|
| 382700
|
|
Unsafe DOM mutation events in object frame.
|
Core
|
DOM: Events
|
nobody
|
RESO
|
FIXE
|
2012-12-03
|
| 382778
|
|
Crash [@ nsEditor::InsertNode] with execCommand insertorderedlist and selection in text node
|
Core
|
DOM: Editor
|
peterv
|
RESO
|
FIXE
|
2011-06-13
|
| 385715
|
|
ReadAV from formatblock with memory corruption evidence
|
Core
|
DOM: Editor
|
peterv
|
RESO
|
FIXE
|
2007-12-01
|
| 366128
|
|
Crash with float and xul in <select> [@ nsFrameManager::CaptureFrameState] [@ nsFrameManager::CaptureFrameState]
|
Core
|
Layout: Floats
|
roc
|
RESO
|
FIXE
|
2011-06-13
|
| 380856
|
|
Crash when removing <vbox> when mousedown + mouseover on <splitter>
|
Core
|
DOM: UI Events & Foc
|
roc
|
RESO
|
FIXE
|
2019-03-13
|
| 351236
|
|
Crash [@ nsGetInterface::operator()] with designMode iframes, removing styles, removing iframes, reloading, etc
|
Core
|
DOM: Editor
|
smaug
|
RESO
|
FIXE
|
2009-04-24
|
| 375093
|
|
Crash [@ nsTypedSelection::ScrollIntoView] when right-clicking paste in input which then gets destroyed oninput
|
Core
|
DOM: UI Events & Foc
|
smaug
|
RESO
|
FIXE
|
2019-03-13
|
| 382568
|
|
Unsafe DOM mutation events in <textarea>
|
Core
|
DOM: Events
|
smaug
|
RESO
|
FIXE
|
2009-04-24
|
| 382681
|
|
Unsafe DOM mutation events in scrollable frame
|
Core
|
DOM: Events
|
smaug
|
RESO
|
FIXE
|
2012-12-03
|
| 323373
|
|
fails to import all SMTP servers from mozilla suite/netscape 7.2
|
Thunderbird
|
Migration
|
standard8
|
RESO
|
FIXE
|
2007-08-17
|
| 375399
|
|
Crash [@ nsElementSH::PostCreate] when removing window when accessing xul:tree in xul:tabs onselect in svg:foreignObject
|
Core
|
XUL
|
bzbarsky
|
VERI
|
FIXE
|
2011-06-13
|
| 387011
|
|
Crash when importing certificate [@ nsNSSCertificateDB::ImportCertsFromFile]
|
Core
|
Security: PSM
|
kaie
|
VERI
|
FIXE
|
2011-06-09
|
| 140218
|
|
Crash dereferencing box the QI result of a null mTreeBoxObject [@nsTreeBodyFrame::SetView] [@ nsTreeBodyFrame::GetMinSize]
|
Core
|
XUL
|
MatsPalmgren_bugz
|
VERI
|
FIXE
|
2011-06-09
|
| 374102
|
|
Crash [@ HandleEvent] on reload with treechildren with display: -moz-deck inside tabpanels
|
Core
|
XUL
|
MatsPalmgren_bugz
|
VERI
|
FIXE
|
2011-06-13
|
| 378682
|
|
Crash [@ nsPresContext::GetContainerInternal] when removing window on focus and reloading
|
Core
|
Layout
|
MatsPalmgren_bugz
|
VERI
|
FIXE
|
2013-02-23
|
| 370127
|
|
XPCNativeWrapper function wrapper's __proto__ comes from content
|
Core
|
XPConnect
|
mrbkap
|
VERI
|
FIXE
|
2008-10-10
|
| 311659
|
|
Crash [@ nsSplitterFrameInner::SetPreferredSize] with this testcase when resizing using xul:splitter
|
Core
|
Layout
|
roc
|
VERI
|
FIXE
|
2007-08-17
|
| 344228
|
|
Crash [@ nsTreeBodyFrame::VisibilityChanged] [@ nsGfxScrollFrameInner::SetScrollbarVisibility]
|
Core
|
XUL
|
roc
|
VERI
|
FIXE
|
2011-06-13
|
| 368863
|
|
Crash [@ nsBlockReflowState::AddFloat] using generated content, first-line and -moz-column-count
|
Core
|
Layout
|
roc
|
VERI
|
FIXE
|
2011-06-13
|
| 381153
|
|
crash [@ nsSliderFrame::SetCurrentPositionInternal]
|
Core
|
XUL
|
smaug
|
VERI
|
FIXE
|
2014-08-03
|
| 381167
|
|
Crash [@ nsTreeBodyFrame::GetColumns] on closing tab with tree stuff
|
Core
|
XUL
|
smaug
|
VERI
|
FIXE
|
2011-06-13
|
| 382444
|
|
Crash [@ nsINodeInfo::Equals] with underflow event, tree stuff and removing window
|
Core
|
XUL
|
smaug
|
VERI
|
FIXE
|
2011-06-13
|
| 384663
|
|
Crash [@ nsXBLPrototypeBinding::LocateInstance] with splitter, tree stuff and DOMAttrModified
|
Core
|
XBL
|
smaug
|
VERI
|
FIXE
|
2011-06-13
|
| 386254
|
|
Crash [@ nsTextControlFrame::SetValue] on branch with testcase2 from bug 373586
|
Core
|
Layout
|
smaug
|
VERI
|
FIXE
|
2011-06-13
|
| 386561
|
|
Page not painting properly
|
Core
|
DOM: Editor
|
smaug
|
VERI
|
FIXE
|
2008-01-11
|