CVE-2018-5184

Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird ESR 52.8 and Thunderbird 52.8...

CVE-2017-5446

An out-of-bounds read when an HTTP/2 connection to a servers sends "DATA" frames with incorrect data content. This leads to a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

CVE-2018-5144

CVE-2018-5144 describes an integer overflow during Unicode text conversion caused by an unchecked length parameter. Affected products: Firefox ESR and Thunderbird (pre-52.7). Root cause: overflow during Unicode conversion. Impact: potential remote code execution or memory issues as implied by the...

CVE-2018-5145

CVE-2018-5145 concerns memory safety bugs in Mozilla Firefox ESR 52.6 that could lead to memory corruption and potential arbitrary code execution. The vulnerability affects Firefox ESR versions before 52.7 and Thunderbird versions before 52.7. Several distributions document fixes in Thunderbird a...

CVE-2018-5144

An integer overflow can occur during conversion of text to some Unicode character sets due to an unchecked length parameter. This vulnerability affects Firefox ESR 52.7 and Thunderbird 52.7...

CVE-2018-5125

CVE-2018-5125 is a memory-safety issue reported in Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox

CVE-2018-5130

When packets with a mismatched RTP payload type are sent in WebRTC connections, in some circumstances a potentially exploitable crash is triggered. This vulnerability affects Firefox ESR 52.7 and Firefox 59...

CVE-2016-9066

CVE-2016-9066 is a Mozilla Firefox-related issue. IBM notes it as a buffer/ memory-safety problem in Firefox shipped with IBM SONAS; root cause described as a buffer overflow due to an integer overflow in nsScriptLoadHandler. Affected products include Thunderbird <45.5, Firefox ESR <45.5, a...

CVE-2016-9064

Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious...

CVE-2016-9074

CVE-2016-9074: Mozilla NSS timing-side-channel mitigation is insufficient in some circumstances. Affects NSS-based components used by Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox

CVE-2016-9074

An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services NSS 3.26.1. This vulnerability affects Thunderbird 45.5, Firefox ESR 45.5, and Firefox 50...

CVE-2016-9893

Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox 50.1, Firefox ESR 45.6, and Thunderbird 45.6...

CVE-2017-7798

The CVE-2017-7798 issue is a XUL injection vulnerability in Firefox Developer Tools (style editor) caused by improper sanitization of the web page source. A malicious page could trigger arbitrary code execution via the style editor, affecting Firefox ESR versions <52.3 and Firefox

CVE-2017-5436

An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox...

CVE-2017-5435

CVE-2017-5435 is a use-after-free in Firefox/Thunderbird during editor design-mode transaction processing, causing a potentially exploitable crash. Public details place affected products as Firefox/Firefox ESR and Thunderbird prior to certain fixed versions (e.g., Thunderbird < 52.1, Firefox E...

CVE-2017-5428

An integer overflow in "createImageBitmap" was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the "createImageBitmap" API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer. Thi...

CVE-2017-5373

Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird 45.7, Firefox ESR 45.7, and...

CVE-2017-5470

Memory safety bugs were reported in Firefox 53 and Firefox ESR 52.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox 54, Firefox ESR 52.2, and Thunderbird...

CVE-2017-5449

CVE-2017-5449 affects Mozilla Firefox (and Thunderbird) components where a crash can be triggered during layout/manipulation of bidirectional Unicode text in concert with CSS animations. Public records in connected advisories indicate affected versions: Thunderbird < 52.1, Firefox ESR < 52....

CVE-2017-7807

CVE-2017-7807 describes a domain URL hijack via AppCache fallback, resolved by requiring fallback files to be inside the manifest directory. Affected products include Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox