CVE-2011-2369

CVE-2011-2369 is a cross-site scripting vulnerability in SeaMonkey as described in NASL entry SeaMonkey

CVE-2012-1974

CVE-2012-1974 is a use-after-free vulnerability in gfxTextRun::CanBreakLineBefore affecting Mozilla Firefox (and related apps like Thunderbird/SeaMonkey) prior to version 15.0, with remote code execution or a denial of service via unspecified vectors. The connected Nessus entries confirm the CVE ...

CVE-2013-1688

CVE-2013-1688 affects Mozilla Firefox’s Profiler UI rendering where untrusted data is parsed, enabling user‑assisted remote attackers to execute arbitrary JavaScript via a crafted site. The issue is fixed by updating to Firefox 22.0+ (as reflected in MFSA 2013-52 and downstream advisories). OpenS...

CVE-2015-4504

Mozilla Firefox contains a vulnerable entry for CVE-2015-4504 in the QCMS library: lut_inverse_interp16 allows remote attackers to read sensitive data or crash the browser via crafted ICC v4 profile attributes, due to an out-of-bounds read. Affected versions are Firefox before 41.0. Mitigation: u...

CVE-2015-4508

CVE-2015-4508 is a URL spoofing vulnerability in Mozilla Firefox occurring before 41.0 when Reader Mode is enabled. The flaw allows a crafted site to cause the address-bar URL shown to the user to differ from the content being rendered, enabling possible spoofing. Public sources in the connected ...

CVE-2016-2810

The CVE-2016-2810 issue affects Mozilla Firefox for Android prior to 46.0 on devices with Android version before 5.0. It is a content-provider permission bypass that lets a crafted malicious app read data such as browser history and locally saved passwords by bypassing Signature access protection...

CVE-2005-2260

CVE-2005-2260 affects the Firefox browser (before 1.0.5), Mozilla (before 1.7.9), and Netscape 8.0.2/7.2. The issue arises from the browser UI not reliably distinguishing user-generated events from untrusted synthetic events, enabling remote attackers to trigger dangerous actions that normally re...

CVE-2006-3801

CVE-2006-3801 affects Mozilla Firefox 1.5 (pre-1.5.0.5) and SeaMonkey (pre-1.0.3). The vulnerability arises from a JavaScript reference to a frame or window that isn’t properly cleared when content is destroyed, leaving a pointer to a deleted object. This can enable remote attackers to execute ar...

CVE-2006-5464

CVE-2006-5464 affects Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6. The issue, tied to the layout/processing path, allows remote attackers to cause a denial of service (crash) via unspecified vectors. Public advisories (Oracle/Linux/OpenVAS records) corroborate t...

CVE-2008-0417

CVE-2008-0417 is a CRLF injection vulnerability affecting Mozilla Firefox prior to 2.0.0.12 (and related Mozilla-based products such as SeaMonkey/XULRunner). The issue allows a remote website to corrupt the password store by submitting newline characters during password saving. Connected advisori...

CVE-2008-2798

CVE-2008-2798 and related CVEs affected Mozilla Firefox (before 2.0.0.15), SeaMonkey (before 1.1.10), and Thunderbird (before 2.0.0.14), with issues in the layout/JavaScript processing that could crash the application and potentially allow arbitrary code execution via crafted content. The base vu...

CVE-2010-0164

CVE-2010-0164 is a use-after-free in Mozilla Firefox 3.6 (imgContainer::InternalAddFrameHelper in src/imgContainer.cpp) that can crash or potentially execute code via a multipart/x-mixed-replace animation where frames have different bits-per-pixel. Affected versions are Firefox 3.6.x prior to 3.6...

CVE-2012-3973

CVE-2012-3973 affects Mozilla Firefox before 15.0, where the debugger in the developer-tools subsystem fails to properly restrict access to the remote-debugging service when remote debugging is disabled. This allows remote attackers to execute arbitrary code by leveraging the HTTPMonitor extensio...

CVE-2013-0782

CVE-2013-0782 is a heap-based buffer overflow in Mozilla’s nsSaveAsCharset::DoCharsetConversion that affects Firefox before 19.0, ESR 17.x before 17.0.3, Thunderbird before 17.0.3, and SeaMonkey before 2.16. The connected documents confirm this vulnerability and show affected components include F...

CVE-2014-1562

CVE-2014-1562 affects Mozilla Firefox before 32.0, Firefox ESR before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1. The vulnerability arises from memory-safety issues in the browser engine, allowing remote attackers to cause memory corruption, crashes, or possi...

CVE-2015-2736

CVE-2015-2736 concerns Mozilla Firefox (pre-39.0), Firefox ESR (31.x pre-31.8 and 38.x pre-38.1), and Thunderbird (pre-38.1). The issue is in nsZipArchive::BuildFileList where unintended memory locations may be accessed when processing crafted ZIP archives, leading to a remote attacker potentiall...

CVE-2016-2794

The CVE-2016-2794 entry concerns Graphite 2 prior to version 1.3.6. The vulnerable function is graphite2::TtfUtil::CmapSubtable12NextCodepoint, used by Mozilla Firefox (before 45.0) and Firefox ESR 38.x (before 38.7). A crafted Graphite font can cause a buffer over-read, leading to a denial of se...

CVE-2017-5392

CVE-2017-5392 affects Firefox for Android. Weak proxy objects hold weak references on multiple threads, causing memory usage issues and potential crashes. Affected: Firefox for Android, Firefox

CVE-2017-7831

CVE-2017-7831 affects Firefox before 57. The vulnerability arises from the security wrapper not denying access to some exposed properties via the deprecated exposedProps mechanism on proxy objects. Multiple connected Nessus entries map this CVE to Firefox < 57.0 and refer to Mozilla’s mfsa2017...

CVE-2025-1943

CVE-2025-1943 covers memory-safety bugs in Mozilla Firefox 135 and Thunderbird 135, affecting Firefox < 136 and Thunderbird

CVE-2005-2701

CVE-2005-2701 is a heap-based buffer overflow in the XBM image handling of Mozilla Firefox (pre-1.0.7) and Mozilla Suite (pre-1.7.12). Exploitation path involves a specially crafted XBM image that ends with many spaces instead of the proper end tag, enabling remote code execution under the user’s...

CVE-2005-2703

CVE-2005-2703 affects Firefox up to 1.0.7 and Mozilla Suite up to 1.7.12. The issue lets a remote attacker modify HTTP headers of XML HTTP requests made via XMLHttpRequest, potentially enabling attacks such as HTTP request smuggling or splitting. This is triggered by how XMLHttpRequests are handl...

CVE-2006-1730

CVE-2006-1730 is a heap-based buffer overflow vulnerability caused by an integer overflow in the CSS letter-spacing handling, allowing remote code execution. Affected products and versions include Mozilla Firefox and Thunderbird 1.x before 1.5.0.2, and 1.0.x before 1.0.8; Mozilla Suite before 1.7...

CVE-2006-1739

CVE-2006-1739 is a memory-corruption flaw in the CSS border rendering path used by Mozilla Firefox/Thunderbird/SeaMonkey. The issue could crash the browser or potentially allow arbitrary code execution via crafted CSS (out-of-bounds writes/buffer overflow). Affected products include Firefox/Thund...

CVE-2006-3811

CVE-2006-3811 is a memory corruption crash vulnerability within Mozilla Firefox components (notably the Firefox 1.5.x line around the 1.5.0.5 release) and related Mozilla projects (SeaMonkey/Thunderbird in affected bundles). The issue manifests as crashes and is described as memory corruption tha...

CVE-2008-5021

The CVE-2008-5021 vulnerability affects Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13. It is caused by modifying properties of a file input element while it is still initializing, followed by using blur to access un...

CVE-2009-3071

CVE-2009-3071 affects Mozilla Firefox’s browser engine. The advisory reports multiple vulnerabilities in Firefox before 3.0.14 and in the 3.5.x line before 3.5.2 that can cause remote memory corruption, leading to crashes or possibly arbitrary code execution via unknown vectors. Affected products...

CVE-2010-1202

CVE-2010-1202 affects Mozilla Firefox 3.5.x before 3.5.10, Firefox 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5. It is part of a set of vulnerabilities in the JavaScript engine/browser engine where memory corruption may lead to a crash or, potentially, arbitrary code e...

CVE-2010-3175

CVE-2010-3175 is described in connected content as: Mozilla Firefox 3.6.x before 3.6.11 and Thunderbird 3.1.x before 3.1.5 contain multiple unspecified browser-engine vulnerabilities that could lead to memory corruption, DoS, or arbitrary code execution via unknown vectors. The MiracleLinux AXSA-...

CVE-2011-3661

CVE-2011-3661 affects Mozilla’s YARR library used by Firefox 4.x–8.0, Thunderbird 5.0–8.0, and SeaMonkey before 2.6. A crafted JavaScript input could crash the application or, possibly, allow code execution. Connected updates indicate fixes were applied in SeaMonkey 2.6 and related Firefox/Thunde...

CVE-2012-3957

Affected components: Mozilla Firefox before 15.0 (and Firefox ESR 10.x before 10.0.7), Thunderbird before 15.0 (and Thunderbird ESR 10.x before 10.0.7), SeaMonkey before 2.12.** Vulnerability and root cause: Heap-based buffer overflow in nsBlockFrame::MarkLineDirty, enabling remote code execution...

CVE-2012-4208

CVE-2012-4208 affects Mozilla Firefox ≤ prior to 17.0, Thunderbird ≤ prior to 17.0, and SeaMonkey ≤ 2.13/2.14. The XrayWrapper did not consider compartment during property filtering, allowing remote sites to bypass chrome-only restrictions on reading DOM object properties. Impact per description:...

CVE-2013-1680

CVE-2013-1680 is a use-after-free vulnerability in the nsFrameList::FirstChild function of Mozilla Firefox (and related components) that could allow remote code execution or a denial of service. Per the connected MiracleLinux advisories, affected products include Firefox/XULRunner packages around...

CVE-2013-1736

CVE-2013-1736 affects Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21. The vulnerability is due to improper establishment of parent-child relationships of range-request nodes in nsGfxScrollFrameInn...

CVE-2013-5598

CVE-2013-5598 affects Mozilla Firefox up to version 25.0 (and Firefox ESR 24.x up to 24.1). The vulnerability arises from how Firefox handles appending an IFRAME element inside an embedded PDF object, enabling a remote attacker to read arbitrary files or execute arbitrary JavaScript with chrome p...

CVE-2015-2733

CVE-2015-2733 is a use-after-free in Mozilla Firefox’s CanonicalizeXPCOMParticipant when an XMLHttpRequest is attached to a dedicated worker. This affects Firefox < 39.0 and Firefox ESR < 31.8 (and 38.x

CVE-2015-4493

CVE-2015-4493 describes a heap-based buffer overflow in libstagefright’s stagefright::ESDS::parseESDescriptor within Firefox before 40.0 and Firefox ESR 38.x before 38.2, exploitable via an invalid size in an esds chunk of MPEG-4 video data that could allow remote code execution. Connected CVE-20...

CVE-2016-1975

CVE-2016-1975 describes multiple race conditions in the WebRTC code path, specifically in dom/media/systemservices/CamerasChild.cpp, within Mozilla Firefox prior to 45.0 on Windows. The race conditions could allow remote attackers to trigger a denial of service via memory corruption or potentiall...

CVE-2016-2813

CVE-2016-2813 affects Mozilla Firefox on Android earlier than 46.0. The issue: JavaScript can access device orientation and motion data without adequate restrictions, enabling a remote attacker to infer sensitive information about the device’s physical environment and potentially reveal PIN value...

CVE-2016-5267

Mozilla Firefox for Android is affected by CVE-2016-5267. Description: Firefox on Android prior to 48.0 allows remote attackers to spoof the address bar by combining left-to-right characters with a right-to-left character set. Impact: address-bar spoofing vulnerability. Root cause: handling of mi...

CVE-2017-5458

CVE-2017-5458 describes a reflected XSS in Firefox where dragging a javascript: URL into the address bar can be executed by the victim. The vulnerability affects Firefox versions prior to 53; the issue arises from insufficient validation of javascript: URLs in the address bar during drag-and-drop...

CVE-2018-5110

This CVE (CVE-2018-5110) affects Firefox on macOS (OS X) prior to version 58. The issue occurs when cursor visibility is toggled by script from 'none' to an image and back, rendering the cursor temporarily invisible. The description does not specify the exact root cause beyond this behavior, nor ...

CVE-2023-37205

The vulnerability CVE-2023-37205 affects Mozilla Firefox (and ESR per related advisories) and is caused by the use of RTL Arabic characters in the address bar, which could allow URL spoofing. Affected versions are Firefox before 115. The risk is described in multiple sources, with Mozilla MFSA ad...

CVE-2023-37209

Mozilla Firefox CVE-2023-37209 involves a use-after-free in NotifyOnHistoryReload where a freed LoadingSessionHistoryEntry could be referenced later, enabling a potentially exploitable condition. Affected product: Firefox (versions older than 115). Root cause: use-after-free memory issue related ...

CVE-2025-6425

CVE-2025-6425 concerns a WebCompat WebExtension issue in Firefox/Thunderbird where enumerating resources could obtain a persistent, browser-identifying UUID that remains across containers and normal/private browsing (not in profiles). Affected: Firefox < 140, Firefox ESR < 115.25, Firefox E...

CVE-2025-6436

CVE-2025-6436 relates to memory safety bugs in Firefox 139 and Thunderbird 139 that could allow memory corruption and potentially run arbitrary code. Affected products are Firefox and Thunderbird versions before 140. The Mozilla advisories MFSA2025-54 and MFSA2025-51 describe the nature of the is...

CVE-2026-6747

CVE-2026-6747 is a use-after-free vulnerability in the WebRTC component. Technical details across connected advisories show this affects Firefox/Firefox ESR and Thunderbird suites, with fixes applied in Firefox 150 and ESR 140.10, and in Thunderbird 150 (also 140.10). Remediation per the linked a...

CVE-2007-0776

Technical details for CVE-2007-0776 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2008-5506

CVE-2008-5506 affects Mozilla components (e.g., Firefox/Thunderbird/SeaMonkey) where an XMLHttpRequest to an attacker-controlled resource that performs a 302 redirect to a different domain can bypass same-origin policy, allowing reading of the redirected response. This can enable a remote attacke...

CVE-2009-3371

CVE-2009-3371 is a use-after-free vulnerability in Mozilla Firefox 3.5.x that can cause a denial of service or remote code execution when a JavaScript web worker is recursively created. A fix was released in Firefox 3.5.4 (MFSA 2009-54), and multiple advisories confirm the issue affected Firefox/...