340882
|
|
Invalid pointer in RemoveWindowListeners
|
Toolkit
|
Form Manager
|
brettw
|
RESO
|
FIXE
|
2018-07-06
|
322636
|
|
[FIX]ctrl-y/redo shortcut crashes firefox in find bar/fayt [@ nsContentUtils::ContentIsDescendantOf]
|
Core
|
DOM: Core & HTML
|
bzbarsky
|
RESO
|
FIXE
|
2019-03-13
|
337462
|
|
nsCryptoRunnable::Run() may operate on dead JSContext
|
Core Graveyard
|
Security: UI
|
mrbkap
|
RESO
|
FIXE
|
2016-09-27
|
338288
|
|
Firefox crashes [@ nsQueryInterfaceWithError::operator()] or allows loading custom code into chrome windows on replacing a frameset containing a frame that had delayed server response
|
Core
|
DOM: Core & HTML
|
mrbkap
|
RESO
|
FIXE
|
2019-03-13
|
338523
|
|
XSS with XPCNativeWrapper(window).Function(...)
|
Core
|
Security
|
mrbkap
|
RESO
|
FIXE
|
2009-07-25
|
342267
|
|
Mozilla Firefox Javascript navigator Object Vulnerability (ZDI-CAN-055, CVE-2006-3677)
|
Core
|
Security
|
mrbkap
|
RESO
|
FIXE
|
2007-08-17
|
344759
|
|
EIP hijack in FF 1.5.0.5 -- crash [@ 0x20202113] called by JS_SetPrivate
|
Core
|
Security
|
mrbkap
|
RESO
|
FIXE
|
2011-06-13
|
340727
|
|
Arbitrary code execution by setting fun.__parent__ to a privileged object
|
Core
|
Security
|
mrbkap
|
RESO
|
FIXE
|
2008-10-17
|
337841
|
|
rv checked uninitialized in XULSortServiceImpl::InsertContainerNode
|
Core
|
XUL
|
ajschult784
|
RESO
|
FIXE
|
2008-07-31
|
338037
|
|
chrome://global/content/jar: can load remote chrome
|
Toolkit
|
Startup and Profile
|
benjamin
|
RESO
|
FIXE
|
2008-07-31
|
331679
|
|
Crash involving ::-moz-table-row-group, overflow, position, and opacity [@ nsIView::GetOffsetTo]
|
Core
|
Layout: Tables
|
bernd_mozilla
|
RESO
|
FIXE
|
2011-06-13
|
338062
|
|
canvas' drawwindow is broken on Intel Mac
|
Core
|
Graphics: Canvas2D
|
brade
|
RESO
|
FIXE
|
2006-07-07
|
242207
|
|
History of Firefox is lost frequently without crash.
|
Firefox
|
Bookmarks & History
|
bryner
|
RESO
|
FIXE
|
2008-08-04
|
340733
|
|
[FIX]Crash [@ nsCSSFrameConstructor::GetFrameFor] involving image map, due to observer being called after it is removed
|
Core
|
Layout
|
bzbarsky
|
RESO
|
FIXE
|
2011-06-13
|
340107
|
|
UniversalBrowserRead should not permit access to chrome documents
|
Core
|
XPConnect
|
dveditz
|
RESO
|
FIXE
|
2007-02-02
|
342074
|
|
JSD crashes on exit (in debug, somewhere else in opt) when there's two clients [@ JSD_ASSERT_VALID_CONTEXT]
|
Other Applications G
|
Venkman JS Debugger
|
gijskruitbosch+bugs
|
RESO
|
FIXE
|
2018-10-16
|
339124
|
|
IntelMac: nsISound::Play() does not work
|
Core Graveyard
|
Widget: Mac
|
jaas
|
RESO
|
FIXE
|
2009-11-21
|
339695
|
|
New version of JEP (0.9.5+e), please land on trunk and branch(es)
|
Core Graveyard
|
Plug-ins
|
jaas
|
RESO
|
FIXE
|
2022-05-16
|
343180
|
|
New version of JEP (0.9.5+f), please land on trunk and branches
|
Core Graveyard
|
Plug-ins
|
jaas
|
RESO
|
FIXE
|
2022-05-16
|
329159
|
|
StringIndexOutOfBoundsException in Mozilla.getGREPathFromRegistryFile
|
Core Graveyard
|
Java to XPCOM Bridge
|
jhpedemonte
|
RESO
|
FIXE
|
2014-09-24
|
181860
|
|
Mozilla interprets mailto: and other malformed URLs in IMG SRC tag
|
Core
|
Graphics: ImageLib
|
jonas
|
RESO
|
FIXE
|
2018-12-18
|
324501
|
|
Search field input box renders with unnecessary border
|
Camino Graveyard
|
HTML Form Controls
|
jonas
|
RESO
|
FIXE
|
2007-03-29
|
338391
|
|
Out of bounds and crash [@ nsAttrAndChildArray::RemoveChildAt] removing a node during a mutation event for its removal
|
Core
|
DOM: Core & HTML
|
jonas
|
RESO
|
FIXE
|
2019-03-13
|
342507
|
|
Memory corruption with simultaneous events (SA19873, CVE-2006-3113)
|
Core
|
Security
|
jstenback+bmo
|
RESO
|
FIXE
|
2007-08-17
|
344249
|
|
Menu key commands processed twice after loading Java
|
Core Graveyard
|
Java: OJI
|
mark
|
RESO
|
FIXE
|
2010-10-16
|
336582
|
|
Crash when window gets destroyed when clicking on iframe which has focus event handler
|
Core
|
DOM: UI Events & Foc
|
MatsPalmgren_bugz
|
RESO
|
FIXE
|
2019-03-13
|
334947
|
|
freeze if drop vCard with base64 encoded photo
|
MailNews Core
|
Address Book
|
mozilla
|
RESO
|
FIXE
|
2008-07-31
|
339740
|
|
extraneous '=' in vcard base64 leads to heap overwrite (crash)
|
MailNews Core
|
Address Book
|
mozilla
|
RESO
|
FIXE
|
2020-05-23
|
327037
|
|
[gcc4 + -O2 + i386] Newsgroup names over-abbreviated on UB Mac
|
MailNews Core
|
Backend
|
mscott
|
RESO
|
FIXE
|
2008-07-31
|
344710
|
|
Thunderbird GA-IE Crashes when entering IMAP password [@ nsCRT::strlen]
|
Mozilla Localization
|
Other
|
nobody
|
RESO
|
FIXE
|
2006-07-20
|
331883
|
|
Disable anonymous box selectors outside of UA stylesheets (was: Crash [@ nsContainerFrame::Destroy] [@ nsFrame::Destroy] involving ::-moz-line-frame (malformed view tree))
|
Core
|
Layout
|
roc
|
RESO
|
FIXE
|
2011-06-13
|
338129
|
|
Crash [@ nsQueryInterface::operator()] with designMode and window gets removed on mousedown/click of resizer
|
Core
|
DOM: Editor
|
smaug
|
RESO
|
FIXE
|
2007-08-21
|
334142
|
|
Firefox 1.5.0.2 doesn't work with some online banking systems
|
Core
|
Networking: HTTP
|
darin.moz
|
VERI
|
FIXE
|
2007-11-19
|
325425
|
|
jsxml.c: Bad assumptions about js_ConstructObject
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
FIXE
|
2007-02-08
|
327597
|
|
nsIFoo.toString.apply(Components) crashes Firefox [@ GetWrappedNativeOfJSObject]
|
Core
|
XPConnect
|
mrbkap
|
VERI
|
FIXE
|
2006-08-16
|
342960
|
|
String.toSource() on a large string causes crash, probably due to arena bug
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
FIXE
|
2007-02-08
|
328697
|
|
[FIX]null deref crash when using a javascript: URI with a chrome XMLHTTPRequest [@ nsJSThunk::EvaluateScript]
|
Core
|
DOM: Core & HTML
|
bzbarsky
|
VERI
|
FIXE
|
2019-03-13
|
338709
|
|
All ReadOnly properties can be overwritten by using Object and try..throw..catch
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
FIXE
|
2006-07-19
|
340024
|
|
E4X regression: <tag {expression}="constant" attr2="constant"/> now raises error
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
FIXE
|
2006-07-19
|
336162
|
|
nsListControlFrame::FireMenuItemActiveEvent called at unsafe times
|
Core
|
Disability Access AP
|
aaronlev
|
VERI
|
FIXE
|
2007-12-20
|
342677
|
|
select.options.add(null) crashes [@ JS_GetClass]
|
Core
|
DOM: Core & HTML
|
ajvincent
|
VERI
|
FIXE
|
2019-03-13
|
325984
|
|
DOMWindow leak with <col onload>
|
Core
|
Layout: Tables
|
bernd_mozilla
|
VERI
|
FIXE
|
2007-12-16
|
329900
|
|
Crash with evil testcase, using table-column-group, table-column, table-cell
|
Core
|
Layout: Tables
|
bernd_mozilla
|
VERI
|
FIXE
|
2009-04-24
|
333493
|
|
Hang with sub - display: table-cell and div - display: table-column
|
Core
|
Layout: Tables
|
bernd_mozilla
|
VERI
|
FIXE
|
2006-06-22
|
338001
|
|
integer overflow in jsfun.c:Function
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2008-03-28
|
319551
|
|
crash when browsing testcase for bug 314922 [@ nsDocLoader::QueryInterface] [@ DocumentViewerImpl::Destroy]
|
Core
|
DOM: Navigation
|
bryner
|
VERI
|
FIXE
|
2006-10-03
|
326645
|
|
Crash when changing enumerated properties of iframe [@ nsHTMLDocument::MatchLinks]
|
Core
|
DOM: Core & HTML
|
bzbarsky
|
VERI
|
FIXE
|
2019-03-13
|
336586
|
|
Crash when window gets destroyed when dragdropping something in iframe
|
Core
|
Widget
|
bzbarsky
|
VERI
|
FIXE
|
2009-06-02
|
342085
|
|
Crash with a fuzzed iframe [@ nsAttributeChildList::GetLength]
|
Core
|
DOM: Core & HTML
|
bzbarsky
|
VERI
|
FIXE
|
2019-03-13
|
335384
|
|
Firefox 1.5.0.x fy-NL trademarks review
|
Mozilla Localization
|
Other
|
fryskefirefox
|
VERI
|
FIXE
|
2006-08-04
|
268370
|
|
missing argument when failing to add a search engine
|
Firefox
|
Search
|
gavin.sharp
|
VERI
|
FIXE
|
2006-07-07
|
327691
|
|
E4X crash [@ js_IsXMLName]
|
Core
|
JavaScript Engine
|
general
|
VERI
|
FIXE
|
2011-06-13
|
344960
|
|
Crash [@ kernel32.dll CommonConstructor] with testcase using GeckoActiveXObject
|
Core
|
DOM: Core & HTML
|
general
|
VERI
|
FIXE
|
2019-03-13
|
324117
|
|
GC hazard during namespace scanning
|
Core
|
JavaScript Engine
|
igor
|
VERI
|
FIXE
|
2007-02-08
|
338804
|
|
GC hazards in constructor functions
|
Core
|
JavaScript Engine
|
igor
|
VERI
|
FIXE
|
2007-02-08
|
339785
|
|
scanner: memory exposure to scripts
|
Core
|
JavaScript Engine
|
igor
|
VERI
|
FIXE
|
2007-02-08
|
341877
|
|
GC hazard with for-in loop
|
Core
|
JavaScript Engine
|
igor
|
VERI
|
FIXE
|
2007-05-26
|
341956
|
|
GC hazards in jsarray.c: unrooted atoms for large index
|
Core
|
JavaScript Engine
|
igor
|
VERI
|
FIXE
|
2007-02-08
|
342766
|
|
crash on xslt testcase
|
Core
|
CSS Parsing and Comp
|
jonas
|
VERI
|
FIXE
|
2007-06-30
|
340071
|
|
[mac only] pasting html from ff 1.5.0.4 into compose window in tb 1.5.0.4 doesn't paste anything
|
Thunderbird
|
Message Compose Wind
|
mark
|
VERI
|
FIXE
|
2007-04-04
|
340890
|
|
Drag and drop of URLs in and out of Rosetta needs to be byte-swapped
|
Core Graveyard
|
Widget: Mac
|
mark
|
VERI
|
FIXE
|
2009-11-21
|
296526
|
|
While autocomplete list is visible opening the context menu causes a misplacement, the focus is lost and a crash occurs when trying to load another URL [@nsAutoCompleteController::HandleEnter]
|
Firefox
|
Address Bar
|
martijn.martijn
|
VERI
|
FIXE
|
2011-06-09
|
314130
|
|
input numbers twice when using Unispim IME at chinese input mode
|
Core
|
Widget: Win32
|
masayuki
|
VERI
|
FIXE
|
2010-06-18
|
338859
|
|
[RFC 2231] even if the attachment file name has 0x2f, it's not escaped
|
MailNews Core
|
Attachments
|
masayuki
|
VERI
|
FIXE
|
2008-07-31
|
303818
|
|
[@ nsCopySupport::HTMLCopy]
|
Core
|
DOM: Selection
|
MatsPalmgren_bugz
|
VERI
|
FIXE
|
2006-06-20
|
324533
|
|
crash [@ js_HashString() line 2813] in e4x/Regress/regress-319872.js
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
FIXE
|
2011-06-13
|
338121
|
|
probably something badly wrong with JS_ARENA_ALLOCATE_CAST
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
FIXE
|
2007-09-18
|
314009
|
|
Draft messages not deleted when Send Later used
|
MailNews Core
|
Composition
|
mscott
|
VERI
|
FIXE
|
2008-07-31
|
344633
|
|
bookmarks menu in fy-NL version not displaying item correctly
|
Mozilla Localization
|
Other
|
rhelmer
|
VERI
|
FIXE
|
2006-07-19
|
340055
|
|
enable compatible extensions on downgrade
|
Toolkit
|
Add-ons Manager
|
robert.strong.bugs
|
VERI
|
FIXE
|
2008-07-31
|
288357
|
|
Evil columns testcase causes crash (-moz-column-count:2;position:absolute) [@ DoDeletingFrameSubtree] [@ nsCSSFrameConstructor::ReinsertContent]
|
Core
|
Layout
|
roc
|
VERI
|
FIXE
|
2011-06-09
|
310668
|
|
Evil xul tree testcase and overflow:scroll crashes Mozilla [@ nsTreeBodyFrame::GetRowAt]
|
Core
|
Layout
|
roc
|
VERI
|
FIXE
|
2011-06-09
|
342167
|
|
In <EditorOverride.css>, 2 "Warning: Expected pseudo-element but found '-moz-XYZ'. Ruleset ignored due to bad selector."
|
MailNews Core
|
Composition
|
roc
|
VERI
|
FIXE
|
2008-07-31
|
339530
|
|
Basic auth fails with XMLHttpRequest
|
Core
|
XML
|
sayrer
|
VERI
|
FIXE
|
2006-08-07
|
281139
|
|
crash doing onfocus="alert()" and Reloading [@ nsEventStateManager::PreHandleEvent]
|
Core
|
DOM: UI Events & Foc
|
smaug
|
VERI
|
FIXE
|
2019-03-13
|
320982
|
|
Crash when browse this Site over top menu [@ nsGlobalWindow::RunTimeout]
|
Core
|
DOM: Core & HTML
|
smaug
|
VERI
|
FIXE
|
2006-06-26
|
331561
|
|
nsAutoComplete crash on entering URL [@ nsAutoCompleteController::HandleEnter]
|
Firefox
|
Address Bar
|
smaug
|
VERI
|
FIXE
|
2011-06-09
|
336587
|
|
Crash when window gets destroyed during DOMMouseScroll event
|
Core
|
DOM: UI Events & Foc
|
smaug
|
VERI
|
FIXE
|
2019-03-13
|
336978
|
|
Crash when window gets destroyed on pagehide event
|
Core
|
DOM: Navigation
|
smaug
|
VERI
|
FIXE
|
2006-07-11
|
337219
|
|
onfocus="window.close()" in body of popup causes crash [@ nsXULElement::`vftable']
|
Core
|
DOM: UI Events & Foc
|
smaug
|
VERI
|
FIXE
|
2019-03-13
|
338897
|
|
Popup window crashes browser on close via javascript [@ nsLayoutUtils::HasPseudoStyle]
|
Core
|
Layout
|
smaug
|
VERI
|
FIXE
|
2011-06-09
|
340084
|
|
[regression] document.getBoxObjectFor on node not in document throws NS_ERROR_DOM_WRONG_DOCUMENT_ERR
|
Core
|
DOM: Core & HTML
|
smaug
|
VERI
|
FIXE
|
2019-03-13
|
341297
|
|
Crash [@nsBoxObject::GetDocShell]
|
Core
|
XUL
|
smaug
|
VERI
|
FIXE
|
2008-07-31
|
342352
|
|
Bug 338897 may have caused other crash
|
Core
|
DOM: UI Events & Foc
|
smaug
|
VERI
|
FIXE
|
2019-03-13
|
315381
|
|
accents incorrectly encoded - decoded
|
Core
|
Internationalization
|
smontagu
|
VERI
|
FIXE
|
2006-07-16
|
332324
|
|
crash [@ IsChildOfDomWindow]
|
Core Graveyard
|
Security: UI
|
timeless
|
VERI
|
FIXE
|
2016-09-27
|
340028
|
|
Rendering problem in <svg:image> on intel macs
|
Core
|
SVG
|
tor
|
VERI
|
FIXE
|
2006-06-19
|
340581
|
|
Text not rendering correctly in SVG on Intel Mac
|
Core
|
SVG
|
tor
|
VERI
|
FIXE
|
2006-07-15
|
331846
|
|
Can't indent/outdent RTL blocks in Composer and Design Mode
|
Core
|
DOM: Editor
|
uriber
|
VERI
|
FIXE
|
2008-04-07
|
334217
|
|
Armenian unicode characters are not accessible anymore
|
Firefox
|
General
|
VYV03354
|
VERI
|
FIXE
|
2006-06-20
|