CVE-2012-4182

CVE-2012-4182 is a Use-after-free in Mozilla Firefox’s nsTextEditRules::WillInsert, affecting Firefox <= 16.0 and Firefox ESR <= 10.x <= 10.0.8, Thunderbird <= 16.0 and ESR 10.x <= 10.0.8, and SeaMonkey

CVE-2014-1520

CVE-2014-1520 affects Mozilla Firefox on Windows prior to version 29.0 and Firefox ESR prior to 24.5. The issue is a local privilege escalation by placing a Trojan horse DLL into a temporary directory during the update process of the Mozilla installer, enabling the attacker to gain elevated privi...

CVE-2017-7845

CVE-2017-7845 is a concrete vulnerability: a buffer overflow in ANGLE’s Direct3D 9 path used for WebGL rendering can crash the process. It affects Windows, and is listed against Thunderbird < 52.5.2, Firefox ESR < 52.5.2, and Firefox

CVE-2025-6430

The CVE-2025-6430 entry affects Firefox and Thunderbird prior to version 140 (and ESR prior to 128.12), where the Content-Disposition header is ignored for files loaded via embed/object, creating a potential cross-site scripting risk. Connected advisories confirm this affects Firefox/Thunderbird ...

CVE-2026-6766

CVE-2026-6766 affects NSS Libraries component. The issue is incorrect boundary conditions in NSS, with fixes landed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Affected platforms include Firefox/Thunderbird releases; remediation is upgrading to the indicated versi...

CVE-2026-6786

CVE-2026-6786 refers to memory-safety bugs in Mozilla products (Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149, Thunderbird 149) with evidence of memory corruption. The description notes that some bugs could be exploited to run arbitrary code, and the fixes are implemented in Firefox 150, ...

CVE-2005-2706

The CVE-2005-2706 issue affects Firefox up to 1.0.6/1.0.x and Mozilla Suite up to 1.7.11, where an about: page (e.g., about:mozilla) could run JavaScript with chrome privileges due to a chrome privileges enforcement flaw. This could enable a remote attacker to inject or execute code with the brow...

CVE-2006-2776

CVE-2006-2776 affects Mozilla Firefox and Thunderbird prior to 1.5.0.4. Privileged UI code calls content-defined setters on an object prototype, enabling remote code execution at higher privileges. Impact is remote code execution with web content privileges; mitigation is upgrading Firefox/Thunde...

CVE-2006-2894

The CVE-2006-2894 issue affects Mozilla Firefox up to 1.5.0.4 and Firefox 2.0.x before 2.0.0.8, Mozilla Suite 1.7.13, SeaMonkey before 1.1.5, Netscape 8.1 and earlier. A user-assisted trick using OnKeyDown/OnKeyPress/OnKeyUp events can cause characters of a target filename to be inserted into a f...

CVE-2007-5339

CVE-2007-5339 is in Mozilla Firefox (pre-2.0.0.8), Mozilla Thunderbird (pre-2.0.0.8) and SeaMonkey (pre-1.1.5). The flaws arise from crafted HTML triggering memory corruption or assert errors, leading to remote denial of service (crash); some entries also indicate potential arbitrary code executi...

CVE-2008-2933

CVE-2008-2933 describes a pipe character in a URL that can trigger Chrome privilege escalation in Iceape/Iceweasel Firefox-family products. Connected advisories confirm active fixes: Iceweasel/iceape upgrades to 2.0.0.16 (etch) and later 3.0.1–1 (sid) or equivalent patched builds; Iceweasel 2.0.0...

CVE-2008-4067

CVE-2008-4067 describes a directory traversal vulnerability in Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12) on Linux. An attacker could read arbitrary files via a resource: URI containing .. and URL-encoded / sequences. The c...

CVE-2009-1305

CVE-2009-1305 is a vulnerability in the JavaScript engine of Mozilla Firefox (and affected Thunderbird/SeaMonkey) prior to version 3.0.9. It allows remote attackers to cause a denial of service (application crash) and potentially memory corruption via vectors involving JSOP_DEFVAR and properties ...

CVE-2009-1837

CVE-2009-1837 describes a race condition in Mozilla Firefox 3 before 3.0.11 within NPObjWrapper_NewResolve in nsJSNPRuntime.cpp of xul.dll. The vulnerability could allow remote code execution via a page transition during Java applet loading, related to a use-after-free involving memory tied to a ...

CVE-2010-0159

CVE-2010-0159 affects Mozilla-based browsers including Firefox 3.0.x (before 3.0.18) and 3.5.x (before 3.5.8), Thunderbird before 3.0.2, and SeaMonkey before 2.0.3. The vulnerability arises from memory-corruption in layout handling, specifically in nsBlockFrame::StealFrame and related vectors, al...

CVE-2010-0172

CVE-2010-0172 affects Mozilla Firefox 3.6 before 3.6.2 due to a race condition in the asynchronous Authorization Prompt (nsLoginManagerPrompter.js). The vulnerability arises when multiple web sites request HTTP authentication concurrently, potentially allowing a remote site to spoof an authorizat...

CVE-2011-2981

The CVE-2011-2981 issue affects Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and related products. Root cause: the event-management implementation does not correctly choose the proper script context, allowing remote attackers to bypass the Same Origin Policy or run...

CVE-2012-4203

CVE-2012-4203 relates to Mozilla Firefox (pre-17.0) where the New Tab page executes JavaScript code via a bookmarklet in a privileged context. The vulnerability could allow a user-assisted attacker to run arbitrary code by a crafted javascript: URL stored as a bookmark, due to the privileged cont...

CVE-2015-4486

CVE-2015-4486 affects Mozilla Firefox and Firefox ESR via a libvpx-based issue in WebM decoding (decrease_ref_count). The vulnerability can allow remote code execution or a denial of service through malformed WebM data, with the described impact of an out-of-bounds read. Affected products are Fir...

CVE-2015-7185

CVE-2015-7185 affects Mozilla Firefox for Android prior to 42.0, where the address bar is not restored after exiting fullscreen, enabling spoofing via crafted JavaScript. Affected product: Firefox for Android; root cause: missing restoration of the address bar on exit from fullscreen mode; impact...

CVE-2025-14321

The CVE-2025-14321 entry documents a Use-after-free in the WebRTC: Signaling component affecting Firefox before 146 and Firefox ESR before 140.6, and Thunderbird before 146/140.6. Public advisories (ALAS and Debian S/DLA notes) indicate memory-safety/allocations issues are part of the Firefox/Thu...

CVE-2025-6427

CVE-2025-6427 affects Firefox and Thunderbird prior to version 140. The issue is a bypass of the CSP connect-src directive via manipulation of subdocuments, which could also conceal network connections from DevTools Network tab. Affected products: Firefox < 140 and Thunderbird

CVE-2005-2261

CVE-2005-2261 affects multiple browsers: Firefox <1.0.5, Thunderbird <1.0.5, Mozilla

CVE-2006-1732

Technical details (affected products, root cause, and exploit specifics) for CVE-2006-1732 are not provided in the supplied documents. Monitor for updates from official advisories.

CVE-2006-2782

Firefox 1.5.0.2 does not fix all test cases for CVE-2006-1729, allowing a remote attacker to read arbitrary files by inputting a filename into a text box that is later turned into a file upload control. The description does not provide a concrete patch version or remediation steps. No additional ...

CVE-2006-3805

CVE-2006-3805 affects Mozilla Firefox (before 1.5.0.5), Thunderbird (before 1.5.0.5), and SeaMonkey (before 1.0.3). The issue stems from the JavaScript engine: a garbage-collection path could delete a temporary object still in use, potentially allowing arbitrary code execution. Public advisories ...

CVE-2006-3807

CVE-2006-3807 describes a privilege-escalation vulnerability in Mozilla Firefox (pre-1.5.0.5), Thunderbird (pre-1.5.0.5), and SeaMonkey (pre-1.0.3). The issue arises when the standard Object() constructor is redefined by script, allowing named JavaScript functions to reference a privileged parent...

CVE-2006-4565

CVE-2006-4565 is a vulnerability in Mozilla-related products (Firefox/SeaMonkey/Thunderbird) tied to processing of certain JavaScript regular expressions. The root cause is flaws in handling specific regular expressions, which could crash the application or allow arbitrary code execution. Public ...

CVE-2006-5463

CVE-2006-5463 affects Mozilla Firefox (before 1.5.0.8), Thunderbird (before 1.5.0.8), and SeaMonkey (before 1.0.6). The vulnerability arises from modifying a Script object while it is executing, which could allow remote attackers to execute arbitrary JavaScript bytecode. Exploitation could enable...

CVE-2008-1234

This CVE-2008-1234 relates to an XSS vulnerability in Mozilla components: Firefox < 2.0.0.13, Thunderbird < 2.0.0.13, and SeaMonkey

CVE-2008-2802

The CVE-2008-2802 entry affects Mozilla Firefox <= 2.0.0.14/2.0.0.15? and earlier Thunderbird 2.0.0.14 and SeaMonkey

CVE-2008-2809

This CVE (CVE-2008-2809) describes a flaw in Mozilla-based browsers where, if a user accepts an SSL server certificate based on the CN in the DN, that certificate is also accepted for all names listed in subjectAltName:dNSName. Affected products include Mozilla 1.9 M8 and earlier, Firefox 2 befor...

CVE-2008-5017

CVE-2008-5017 is an integer overflow in xpcom/io/nsEscape.cpp in the Mozilla browser engine. The vulnerability could allow a remote attacker to crash the affected application (DoS) via unspecified vectors in Mozilla Firefox 3.x prior to 3.0.4, Firefox 2.x prior to 2.0.0.18, Thunderbird 2.x prior ...

CVE-2010-0162

The CVE-2010-0162 issue affects Mozilla Firefox 3.0.x before 3.0.18, Firefox 3.5.x before 3.5.8, and SeaMonkey before 2.0.3. The root cause is improper handling of the application/octet-stream content type in contexts involving SVG and EMBED, allowing remote attackers to bypass Same Origin Policy...

CVE-2011-3670

CVE-2011-3670 affects Firefox prior to 3.6.26 and 4.x–6.0, Thunderbird prior to 3.1.18 and 5.0–6.0, and SeaMonkey prior to 2.4. The issue: improper enforcement of IPv6 literal address syntax, allowing remote attackers to cause information disclosure by reading error messages from XMLHttpRequest c...

CVE-2012-3968

CVE-2012-3968 is a use-after-free in Firefox’s WebGL implementation related to deletion of a fragment shader by its accessor. The issue allows remote attackers to execute arbitrary code via crafted web content. Affected products include Mozilla Firefox (and Firefox ESR 10.x lineage) prior to patc...

CVE-2013-1686

CVE-2013-1686 is a use-after-free in the mozilla::ResetDir function affecting Firefox before 22.0 (and Thunderbird before 17.0.7; ESR 17.x before 17.0.7). The connected MiracleLinux advisories map the issue to Firefox/XUL components and list affected versions (Firefox/Thunderbird 17.x line with 1...

CVE-2014-1548

CVE-2014-1548 affects Mozilla Firefox and Mozilla Thunderbird browser engines prior to version 31.0. The issues are described as multiple unspecified vulnerabilities that could lead to memory corruption, application crash, or possibly remote arbitrary code execution via unknown vectors. The conne...

CVE-2016-5299

CVE-2016-5299 affects Firefox for Android (Android), where a previously installed malicious app with signature-level permissions can intercept AuthTokens intended for Firefox. The issue is limited to Firefox for Android and does not affect other platforms; vulnerable version is Firefox prior to 5...

CVE-2025-3034

CVE-2025-3034 corresponds to memory-safety bugs in Firefox 136 and Thunderbird 136. Some flaws show memory corruption and could be exploitable with enough effort to run arbitrary code. Affected products are Firefox < 137 and Thunderbird

CVE-2005-4134

CVE-2005-4134 affects Mozilla Firefox 1.5, Netscape 8.x (8.0.4 and 7.2) and K-Meleon prior to 0.9.12. A remote attacker can cause a denial of service (high CPU usage and delayed startup) by presenting a website with a large title, which is stored in history.dat but not efficiently processed durin...

CVE-2006-1790

The CVE-2006-1790 entry is supported by connected documents, specifying a vulnerability in Mozilla Firefox prior to or including 1.0.7 where a regression fix in Firefox 1.0.7 allows a remote attacker to trigger a denial of service (crash) and potentially execute arbitrary code via the InstallTrig...

CVE-2006-3808

CVE-2006-3808 affects Mozilla Firefox (pre-1.5.0.5) and SeaMonkey (pre-1.0.3) where a malicious Proxy Auto-Config (PAC) script could set FindProxyForURL to an eval on a privileged object, enabling remote code execution with elevated privileges. Public advisories in connected docs confirm the PAC ...

CVE-2008-2799

CVE-2008-2799 pertains to multiple unpatched JavaScript engine flaws in Mozilla Firefox (pre-2.0.0.15), Thunderbird (pre-2.0.0.14 and earlier), and SeaMonkey (pre-1.1.10). The vulnerabilities allow a remote attacker to cause a crash and potentially execute arbitrary code via unknown vectors relat...

CVE-2008-2800

The CVE-2008-2800 entry affects Mozilla Firefox up to 2.0.0.15 and SeaMonkey up to 1.1.10, enabling remote XSS via bypassing Same Origin Policy. Reported vectors include an event handler on an outer window, a SCRIPT element in an unloaded document, and the onreadystatechange handler with XMLHttpR...

CVE-2009-1841

CVE-2009-1841 affects Mozilla products: Firefox <3.0.11, Thunderbird <2.0.0.22, SeaMonkey

CVE-2011-2376

CVE-2011-2376 affects Mozilla Firefox before 3.6.18 and Thunderbird before 3.1.11. The vulnerability is in the browser engine, described as unspecified, with memory corruption that can cause a denial of service or an eventual arbitrary code execution via unknown vectors, potentially crashing the ...

CVE-2011-2982

CVE-2011-2982 affects Mozilla Firefox before 3.6.20, Thunderbird 2.x/3.x before 3.1.12, SeaMonkey 1.x/2.x, and possibly other Mozilla-based products. The issue stems from multiple unspecified browser‑engine vulnerabilities causing memory corruption and remote code execution or DoS via unknown vec...

CVE-2012-3956

CVE-2012-3956 is a use-after-free in MediaStreamGraphThreadRunnable::Run in Mozilla Firefox before 15.0 (and similar affected versions for Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0/ESR 10.x before 10.0.7, SeaMonkey before 2.12). Successful exploitation could allow remote attackers t...

CVE-2012-3958

CVE-2012-3958 describes a use-after-free in Mozilla’s browser components, specifically nsHTMLEditRules::DeleteNonTableElements. A remote attacker could exploit this to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. Affected products include M...