3269 matches found
CVE-2009-0652
CVE-2009-0652 describes an IDN spoofing vulnerability where the IDN blacklist in Mozilla Firefox (and related Mozilla apps) failed to exclude box-drawing characters, enabling homoglyph-based phishing in subdomains of a .cn domain. Affected products include Firefox 3.0.6 (and others prior to 3.0.9...
CVE-2024-5690
Vulnerability CVE-2024-5690 affects Mozilla Firefox and Thunderbird components via a timing-attack on external protocol handler detection. Affected products explicitly include Firefox < 127, Firefox ESR < 115.12, and Thunderbird
CVE-2025-0247
CVE-2025-0247 concerns memory safety bugs in Mozilla Firefox 133 and Thunderbird 133, with impact on Firefox < 134 and Thunderbird
CVE-2019-11715
CVE-2019-11715: HTML parsing error can contribute to content XSS. Affected: Firefox ESR <60.8, Firefox <68, Thunderbird
CVE-2019-11730
CVE-2019-11730 describes a same-origin policy violation where opening a locally saved HTML file could allow file: URIs to access files in the same directory or subdirectories, enabling the Fetch API to read contents and potentially exfiltrate them. The issue affects Firefox ESR < 60.8, Firefox...
CVE-2019-9788
CVE-2019-9788 affects Mozilla Thunderbird and Firefox components via memory-safety bugs that could allow arbitrary code execution. The provided documents identify memory-corruption opportunities in Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox
CVE-2020-6814
CVE-2020-6814 refers to memory-safety bugs in Mozilla Firefox and Thunderbird (68.5 timeframe) with potential to run arbitrary code. Affected products/versions: Thunderbird < 68.6, Firefox < 74, Firefox ESR < 68.6, and Firefox ESR
CVE-2020-6825
CVE-2020-6825 is a memory-safety issue in Mozilla Firefox/Thunderbird affecting Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox
CVE-2021-29986
CVE-2021-29986 describes a race condition in getaddrinfo that can cause memory corruption and a potentially exploitable crash on Linux. Affected products include Thunderbird and Firefox variants: Thunderbird < 78.13 and < 91, Firefox ESR < 78.13, and Firefox
CVE-2024-5691
The CVE-2024-5691 entry describes a vulnerability where an attacker could trick a sandboxed iframe using an X-Frame-Options header to present a button that, if clicked, bypasses sandbox restrictions and opens a new window. Affected products (per the provided documents) include Mozilla Firefox and...
CVE-2019-11691
CVE-2019-11691 is a use-after-free vulnerability in XMLHttpRequest (XHR) triggered by an event loop, causing the XHR main thread to be invoked after the object is freed. Affects Thunderbird versions < 60.7 and Firefox/Firefox ESR versions
CVE-2020-15664
The CVE-2020-15664 issue arises from a malicious page holding a reference to eval() from an about:blank window, allowing access to InstallTrigger and prompting users to install an extension. Affected products include Firefox < 80, Thunderbird < 78.2/68.12, Firefox ESR < 68.12/78.2, and F...
CVE-2024-4768
CVE-2024-4768 involves a bug in the interaction between popup notifications and WebAuthn that could enable a user-permission bypass in the affected Mozilla products. The concrete impact described in connected advisories applies to Firefox and Firefox ESR (and Thunderbird): an attacker could trick...
CVE-2024-5701
CVE-2024-5701 is tied to memory safety bugs in Mozilla Firefox, affecting Firefox versions earlier than 127. The connected sources describe memory corruption risks with potential for arbitrary code execution and indicate the vulnerability is present in Firefox 126 (and affects Firefox
CVE-2018-8024
Apache Spark UI cross-site scripting (CVE-2018-8024) affects Spark UI before 2.3.2, including 2.1.0–2.1.2, 2.2.0–2.2.1, and 2.3.0. A malicious user can craft a URL to the Spark UI’s /jobs/ endpoint; if a user visits the URL, JavaScript can execute in the victim’s browser within the Spark UI conte...
CVE-2020-6831
CVE-2020-6831 is a bug described in Debian security advisories as a buffer overflow in the SCTP chunk input validation in the usrsctp library. The Debian entries explicitly tie this CVE to Firefox ESR (<68.8), Firefox (<76) and Thunderbird (
CVE-2025-1011
CVE-2025-1011 is a WebAssembly code-generation bug that could crash the affected Mozilla components and, per the connected advisories, may enable remote code execution. Public references indicate the vulnerability affects Firefox up to version 135 (and ESR 128.7) and Thunderbird up to 128.7 (and ...
CVE-2025-1020
The CVE-2025-1020 entries concern memory safety bugs in Mozilla Firefox 134 and Thunderbird 134. The connected sources confirm memory-safety issues that could lead to memory corruption, with the potential to execute arbitrary code, and apply to Firefox versions before 135 and Thunderbird versions...
CVE-2018-18505
CVE-2018-18505 concerns an IPC privilege-escalation in Mozilla products where an authentication added during IPC process creation is not applied to channels created later, enabling potential sandbox escape through IPC channels. Public advisories tie this to Thunderbird and Firefox releases prior ...
CVE-2019-9796
CVE-2019-9796 is a use-after-free in the SMIL animation controller where double registration with the refresh driver leads to a dangling pointer after the controller is removed. Affected products include Thunderbird and Firefox (Firefox ESR < 60.6, Firefox
CVE-2021-29984
CVE-2021-29984 involves instruction reordering that allowed a GC-related object misevaluation, causing memory corruption and potentially exploitable crashes in Mozilla components. Affected products include Thunderbird and Firefox ESR/Firefox releases prior to 78.13/91; the exploit would require m...
CVE-2021-29988
The CVE-2021-29988 issue is a memory safety vulnerability in Mozilla code where Firefox incorrectly treated an inline list-item as a block element, leading to an out-of-bounds read or memory corruption and a potentially exploitable crash. Affected products and versions: Thunderbird < 78.13 and...
CVE-2022-34478
Summary: CVE-2022-34478 affects Thunderbird on Windows, where the ms-msdt, search, and search-ms protocols could deliver content to Microsoft apps via prompts opened by user interaction. The underlying risk is exploitation of a prompt-based handling in these protocols that bypasses the browser. T...
CVE-2024-5698
CVE-2024-5698 affects Mozilla Firefox prior to version 127, where manipulating the fullscreen feature when opening a data-list could overlay a text box on the address bar, enabling user confusion and potential spoofing. The issue is confirmed across multiple sources (Mozilla advisories and vendor...
CVE-2010-0178
CVE-2010-0178 affects Mozilla Firefox up to 3.0.19, Firefox 3.5.x up to 3.5.9, Firefox 3.6.x up to 3.6.2, and SeaMonkey up to 2.0.3 (before 2.0.4). The vulnerability allows an applet to convert a mouse click into a drag‑and‑drop, enabling remote JavaScript execution with Chrome privileges by firs...
CVE-2021-23981
CVE-2021-23981 describes a memory-safety issue in WebGL where uploading a Texture into a Pixel Buffer Object could confuse WebGL and skip binding the buffer used to unpack it, leading to an out-of-bounds read and potential information leak or crash. Affected software includes Firefox ESR < 78....
CVE-2024-5702
The CVE-2024-5702 entry is confirmed with concrete details in connected advisories: memory corruption in the networking stack affecting Mozilla Firefox before 125, Firefox ESR before 115.12, and Thunderbird before 115.12. The root cause is memory corruption in the networking component, potentiall...
CVE-2024-6603
The CVE-2024-6603 entry describes an out-of-memory scenario where an allocation can fail but the pointer is free’d afterward, leading to memory corruption. Affected software: Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird
CVE-2024-6611
In CVE-2024-6611, a nested iframe could trigger cross-site navigation and allow cookies with SameSite=Strict or Lax to be sent. Affected products are Mozilla Firefox and Thunderbird prior to version 128. root cause: improper handling of SameSite cookies in nested iframes; impact includes potentia...
CVE-2024-6614
CVE-2024-6614 impacts Mozilla Firefox and Thunderbird before version 128, where the frame iterator could loop when processing certain wasm frames, causing incorrect stack traces. The issue, confirmed in Mozilla advisories, is addressed by upgrading to the 128.* release series (Firefox 128 / Thund...
CVE-2019-9813
CVE-2019-9813 describes an IonMonkey JIT type confusion caused by incorrect handling of proto mutations, enabling potential arbitrary memory read/write. Affected products include Firefox prior to 66.0.1, Firefox ESR prior to 60.6.1, and Thunderbird prior to 60.6.1. The underlying issue is a type-...
CVE-2020-6799
CVE-2020-6799 is a vulnerability in Mozilla Firefox where command line arguments could be injected during Firefox invocation when Firefox is the default handler for non-default filetypes and a downloaded file is opened by a third‑party application that does not sanitize URL data. The issue could ...
CVE-2021-23982
CVE-2021-23982 is a concrete WebRTC-based information-disclosure vulnerability affecting Mozilla products. The connected documents confirm that a malicious webpage could probe an internal network’s hosts and services running on the user’s machine via WebRTC. Affected products/versions: Firefox ES...
CVE-2021-23984
The CVE-2021-23984 entry describes a vulnerability in which a malicious extension could open a popup window without an address bar, allowing spoofing of a site and credential theft. Affected products include Firefox ESR < 78.9, Firefox < 87, and Thunderbird
CVE-2024-11692
CVE-2024-11692 describes a spoofing-related issue in Mozilla Firefox/Thunderbird where a select dropdown could be rendered over another tab, causing user confusion. The vulnerability affects Firefox versions before 133, Firefox ESR before 128.5, Thunderbird before 133, and Thunderbird before 128....
CVE-2024-5692
The CVE-2024-5692 entry affects Mozilla Firefox and Thunderbird on Windows 10, where the Save As flow could bypass filename extension restrictions by including an invalid character in the extension, enabling saving with a disallowed extension like .url. Connected Mozilla advisories (MFSA) corrobo...
CVE-2025-1017
CVE-2025-1017: Memory-safety bugs in Firefox 134/THUNDERBIRD 134 (and related ESR) with potential for arbitrary code execution. Affects Firefox <135, Firefox ESR <128.7, Thunderbird
CVE-2021-38504
The CVE-2021-38504 issue is a real vulnerability affecting Firefox < 94, Thunderbird < 91.3, and Firefox ESR
CVE-2025-0240
CVE-2025-0240 affects Mozilla Firefox and Thunderbird (Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, Thunderbird
CVE-2025-1016
CVE-2025-1016 corresponds to memory-safety bugs in Firefox 134/Thunderbird 134 (and ESR lines) that could allow arbitrary code execution. Affected: Firefox <135, Firefox ESR <115.20/128.7, Thunderbird
CVE-2019-11743
CVE-2019-11743 describes cross-origin access to unload event attributes, enabling timing-side-channel exposure of history in certain browsers. Connected docs confirm affected products and versions, with fixes noted in Thunderbird updates (e.g., Thunderbird 60.9.0) and Firefox/ESR advisories addre...
CVE-2021-29976
CVE-2021-29976 is a memory-safety issue affecting Mozilla code shared by Firefox and Thunderbird. The advisory details indicate memory-safety bugs that could be exploited to run arbitrary code, impacting Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox
CVE-2024-11698
CVE-2024-11698 is a macOS-specific fullscreen lock-up in Firefox/Thunderbird when a modal dialog interrupts a fullscreen transition. Affected products are Firefox and Thunderbird desktop releases older than Firefox 133, Firefox ESR 128.5, Thunderbird 133, and Thunderbird ESR 128.5. The issue can ...
CVE-2024-4769
CVE-2024-4769 : In Firefox and Thunderbird, Web Workers handling could reveal cross-origin information by distinguishing between responses with the content-type application/javascript vs non-script types. This could lead to information disclosure across origins. Affected products are Firefox befo...
CVE-2024-9401
CVE-2024-9401 affects Firefox and Thunderbird memory-safety bugs (memory corruption) in Firefox 130, ESR 115.15, ESR 128.2, and Thunderbird 128.2; vulnerable ranges extend to Firefox < 131, ESR < 128.3, ESR < 115.16, Thunderbird < 128.3, and Thunderbird
CVE-2019-17011
CVE-2019-17011 : A race condition in DocShell antitracking can cause a use-after-free and potentially crash the process. Affected: Thunderbird < 68.3, Firefox ESR < 68.3, Firefox
CVE-2019-9800
CVE-2019-9800 is supported by multiple connected advisories indicating memory safety bugs in Mozilla products (Thunderbird 60.x, Firefox ESR 60.x, Firefox 66–67 range) that could allow arbitrary code execution. The root cause is memory safety issues leading to memory corruption; affected versions...
CVE-2020-15683
CVE-2020-15683 : Mozilla Firefox and Thunderbird memory-safety issues reported affecting Firefox ESR < 78.4, Firefox < 82, and Thunderbird
CVE-2023-6209
CVE-2023-6209 corresponds to a parsing vulnerability where relative URLs starting with three slashes and a "/../" path could override the specified host, potentially enabling security issues on affected sites. The issue is documented for Firefox and Thunderbird, with affected versions cited as Fi...