Mozilla Firefox和Mozilla Thunderbird 安全漏洞

Mozilla Firefox and Mozilla Thunderbird are both products of the Mozilla Foundation in the U.S. Mozilla Firefox is an open source web browser.Mozilla Thunderbird is a separate set of Mozilla Application Suite from the Email client software. The software supports IMAP, POP mail protocols, and HTML...

PT-2025-14108

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 137 Thunderbird versions prior to 137 Description The issue allows an unexpected file to be uploaded after selecting a malicious Windows .url shortcut from the local filesystem. This bug only affects Firefox on Window...

Mozilla Thunderbird < 137.0

The version of Thunderbird installed on the remote Windows host is prior to 137.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-23 advisory. - Memory safety bugs present in Firefox 136 and Thunderbird 136. Some of these bugs showed evidence of memory...

firefox: AudioIPC StreamData could trigger a use-after-free in the Browser process

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape...

The vulnerability of the Thunderbird email client, related to incorrect import of OpenPGP keys from the WKD server, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Thunderbird email client is related to the improper import of the OpenPGP key from the WKD server. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CVE-2025-26696

Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability affects Thunderbird 136 and Thunderbird 128.8...

CVE-2025-26696

Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8...

CVE-2025-26696 Crafted email message incorrectly shown as being encrypted

Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8...

CVE-2025-26696

CVE-2025-26696 affects Mozilla Thunderbird and is triggered by certain crafted MIME messages that claim to contain an encrypted OpenPGP message but actually contain an OpenPGP signed message, causing the UI to mis-display the content as encrypted. Public references in connected documents corrobor...

CVE-2025-26695 Downloading of OpenPGP keys from WKD used incorrect padding

When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested email address. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8...

CVE-2025-26695 Downloading of OpenPGP keys from WKD used incorrect padding

When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested email address. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8...

CVE-2025-26696 Crafted email message incorrectly shown as being encrypted

Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8...

CVE-2025-26696

Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8...

firefox: Clickjacking the registerProtocolHandler info-bar Reporter

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A web page could trick a user into setting that site as the default handler for a custom URL protocol...

firefox: Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was...

Mozilla Thunderbird 安全漏洞

Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The program supports IMAP, POP mail protocols and HTML mail format. A code issue vulnerability exists in Mozilla Thunderbird versions prior to 136 and prior ...

Linux Distros Unpatched Vulnerability : CVE-2025-1019

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack...

Mozilla Thunderbird Out-of-Bounds Access Vulnerability (mfsa_2025-17) - Windows

Mozilla Thunderbird is prone to an out-of-bounds access vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird, Thunderbird ESR, relates to reading data beyond the buffer in memory, allowing an attacker to execute arbitrary code.

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird, Thunderbird ESR, is related to reading data beyond the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2025-1943

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs are present in Firefox 135 and Thunderbird 135. Some of these bugs show evidence of memory corruption and, with enough effort, some of these could be exploited to run arbitrar...