Mozilla Firefox 3.6a1, 3.5.3, 3.5.2, and earlier 3.5.x versions, and 3.0.14 and earlier 2.x and 3.x versions, on Linux uses a predictable /tmp pathname for files selected from the Downloads window, which allows local users to replace an arbitrary downloaded file by placing a file in a /tmp location before the download occurs, related to the Download Manager component. NOTE: some of these details are obtained from third party information.

Mozilla Firefox 3.6a1, 3.5.3, 3.5.2, and earlier 3.5.x versions, and 3.0.14 and earlier 2.x and 3.x versions, on Linux uses a predictable /tmp pathname for files selected from the Downloads window, which allows local users to replace an arbitrary downloaded file by placing a file in a /tmp location before the download occurs, related to the Download Manager component. NOTE: some of these details are obtained from third party information.

MozillaFirefox-50.1.0-1.1 on GA media

array index error in dtoa implementation of many products firefox: (rejected CVE-2009-1563) Firefox heap buffer overflow in string to number conversion Firefox: Predictable /tmp pathname use Firefox form history vulnerable to stealing Firefox crash in proxy auto-configuration regexp parsing Firefox heap buffer overflow in GIF color map parser XPCVariant:: VariantDataToJS() Firefox cross-origin data theft through document.getSelection() Firefox download filename spoofing with RTL override Firefox crashes with evidence of memory corruption Firefox crashes with evidence of memory corruption Firefox integer underflow in FTP directory list parser