CVE-2016-9893

Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox 50.1, Firefox ESR 45.6, and Thunderbird 45.6...

CVE-2017-5462

A flaw in DRBG number generation within the Network Security Services NSS library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to address this issue and Firefox ESR 52.1 has been updated with NSS version 3.28.4. This vulnerabili...

CVE-2018-5144

An integer overflow can occur during conversion of text to some Unicode character sets due to an unchecked length parameter. This vulnerability affects Firefox ESR 52.7 and Thunderbird 52.7...

CVE-2017-5373

Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird 45.7, Firefox ESR 45.7, and...

CVE-2017-5428

An integer overflow in "createImageBitmap" was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the "createImageBitmap" API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer. Thi...

CVE-2017-7809

A use-after-free vulnerability can occur when an editor DOM node is deleted prematurely during tree traversal while still bound to the document. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox 55...

CVE-2017-5436

An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox...

CVE-2017-5459

A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

CVE-2017-7798

The CVE-2017-7798 issue is a XUL injection vulnerability in Firefox Developer Tools (style editor) caused by improper sanitization of the web page source. A malicious page could trigger arbitrary code execution via the style editor, affecting Firefox ESR versions <52.3 and Firefox

CVE-2018-5130

When packets with a mismatched RTP payload type are sent in WebRTC connections, in some circumstances a potentially exploitable crash is triggered. This vulnerability affects Firefox ESR 52.7 and Firefox 59...

CVE-2018-5097

A use-after-free vulnerability can occur during XSL transformations when the source document for the transformation is manipulated by script content during the transformation. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.6, Firefox ESR 52.6, and Firef...

CVE-2016-9066

CVE-2016-9066 is a Mozilla Firefox-related issue. IBM notes it as a buffer/ memory-safety problem in Firefox shipped with IBM SONAS; root cause described as a buffer overflow due to an integer overflow in nsScriptLoadHandler. Affected products include Thunderbird <45.5, Firefox ESR <45.5, a...

CVE-2016-9074

An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services NSS 3.26.1. This vulnerability affects Thunderbird 45.5, Firefox ESR 45.5, and Firefox 50...

CVE-2017-7754

CVE-2017-7754 is an out-of-bounds read in WebGL when processing a malicious ImageInfo object during WebGL operations. Affected products/versions per connected docs: Firefox versions prior to 54 and Firefox ESR prior to 52.2, and Thunderbird prior to 52.2. The vulnerability stems from an improper ...

CVE-2017-7807

A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the domain. This has been addressed by requiring fallback files be inside the manifest directory. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox 55...

CVE-2017-7785

CVE-2017-7785 is a buffer overflow in ARIA attribute handling within the DOM that affects Thunderbird (< 52.3) and Firefox components (Firefox ESR < 52.3, Firefox

CVE-2017-7800

CVE-2017-7800 is a use-after-free in WebSockets that can trigger a crash when the connection object is freed before disconnection finishes. Affected: Thunderbird < 52.3, Firefox ESR < 52.3, Firefox

CVE-2017-5404

CVE-2017-5404 is a use-after-free in Firefox/Thunderbird when manipulating ranges in selections with one node inside a native anonymous tree and one node outside it, leading to a potentially exploitable crash. Affected: Firefox versions before 52 and Firefox ESR before 45.8; Thunderbird versions ...

CVE-2018-5089

CVE-2018-5089 is a memory-safety vulnerability affecting Mozilla products: Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox

CVE-2017-7784

The CVE-2017-7784 issue is a use-after-free in the image observer during frame reconstruction after the observer has been freed, affecting Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox