CVE-2025-1015

CVE-2025-1015: The Thunderbird Address Book contains unsanitized URI fields that could be exploited by attackers. By creating an address book with malicious links, an attacker may trick another user into importing the compromised address book. If the user clicks on the unsanitized link within...

CVE-2024-4367-Analysis

CVE-2024-4367: Arbitrary JavaScript Execution in PDF.js Overview CVE-2024-4367 is a critical vulnerability in the PDF.js library that allows arbitrary JavaScript execution in a user's browser, leading to Cross-Site Scripting XSS attacks. This affects Firefox Example: python3 poc.py "alert1" Demo...

[SECURITY] Fedora 44 Update: thunderbird-158.0-2.fc44

Mozilla Thunderbird is a standalone mail and newsgroup client...

CVE-2024-4367-PoC

CVE-2024-4367 & CVE-2024-34342: Arbitrary JavaScript execution in PDF.js A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. If pdf.js is...

Linux Distros Unpatched Vulnerability : CVE-2026-109750

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. CVE-2026-109750 Note that Nessus...

CVE-2026-100821

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Panning and Zooming component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

CVE-2026-100819

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the XPCOM component Mitigation Mitigation for this issue is either not available or the currently available options do not...

CVE-2026-100807

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Service Workers component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

CVE-2026-100803

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the WebExtensions component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

CVE-2026-100801

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DLL Services component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2026-100794

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the Internationalization component Mitigation Mitigation for this issue is either not available or the currently available...

CVE-2026-100832

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Graphics: Canvas2D component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2026-100792

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript: WebAssembly component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Ha...

CVE-2026-100790

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XSLT component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security...

CVE-2026-100788

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the JavaScript: WebAssembly component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

CVE-2026-100785

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2026-100783

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Uninitialized memory in the Audio/Video component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2026-100782

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to incorrect boundary conditions in the Graphics component Mitigation Mitigation for this issue is either not available or the currently available option...

CVE-2026-100781

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component Mitigation Mitigation for this issue is either not available or the currently available...

CVE-2026-100780

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...