1977 matches found
CVE-2025-3028
CVE-2025-3028 describes a use-after-free in memory handling when JavaScript runs during XSLTProcessor document transformation. Affected products include Firefox versions before 137 and Firefox ESR before 115.22/128.9, and Thunderbird versions before 137/128.9. Public advisories (e.g., ALAS2FIREFO...
CVE-2017-5447
CVE-2017-5447 is an out-of-bounds read in glyph widths processing during text layout that can cause a crash and potentially expose memory. Affected products include Mozilla Thunderbird (<52.1) and Mozilla Firefox/Firefox ESR (ESR <52.1; Firefox
CVE-2018-5125
CVE-2018-5125 is a memory-safety issue reported in Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox
CVE-2021-38505
The CVE describes a Windows 10 Cloud Clipboard issue where copied data could be recorded to the cloud if Cloud Clipboard is enabled. Affected products/versions identified are Firefox before 94, Thunderbird before 91.3, and Firefox ESR before 91.3 on Windows 10+. The root cause is that application...
CVE-2023-5729
CVE-2023-5729 targets Mozilla Firefox and is disclosed as affecting Firefox versions prior to 119. A malicious site could enter fullscreen mode while triggering a WebAuthn prompt, potentially obscuring the fullscreen notification and enabling spoofing. The vulnerability is documented across multi...
CVE-2016-9895
CVE-2016-9895 affects Mozilla Firefox (<50.1) and Firefox ESR (<45.6) and Thunderbird (
CVE-2019-17002
CVE-2019-17002 affects Mozilla Firefox versions before 70.0. If upgrade-insecure-requests is set in the Content Security Policy and a link is dragged and dropped from that page, the link is not upgraded to https, exposing users to potential security bypass and stability issues. The primary impact...
CVE-2023-25732
CVE-2023-25732 involves an out-of-bounds memory write caused by incorrect calculation of the input size when encoding data from inputStream in xpcom. The vulnerability affects Firefox before 110, Thunderbird before 102.8, and Firefox ESR before 102.8. Connected advisories corroborate the issue an...
CVE-2017-5405
CVE-2017-5405: In Mozilla Firefox/Thunderbird the vulnerability arises from how certain FTP response codes are handled, causing uninitialized port values to be used in FTP operations. Connected advisories confirm this CVE is fixed in Thunderbird/Firefox branches around version 52 and ESR 45.8 (e....
CVE-2018-12367
CVE-2018-12367 affects Mozilla Thunderbird < 60, Firefox ESR < 60.1, and Firefox
CVE-2019-17025
CVE-2019-17025 is a Firefox memory-safety vulnerability affecting Firefox prior to 72.0. Connected advisories enumerate multiple memory-corruption–related issues in Firefox 71 that Mozilla presumes could be exploited to run arbitrary code. The Arch Linux advisory additionally details several rela...
CVE-2020-12394
CVE-2020-12394 describes a logic flaw in the Firefox location bar that could allow a local attacker to spoof the current location by selecting a different origin and removing focus from the input. Affected product: Firefox versions prior to 76.0. Root cause: input/origin handling in the address b...
CVE-2021-23977
CVE-2021-23977 affects Firefox on Android, a time-of-check-time-of-use vulnerability allowing a malicious app to read sensitive data from other application directories. The issue is limited to Firefox for Android and does not impact other OS variants; affected versions are Firefox
CVE-2023-25729
CVE-2023-25729 involves a permissions prompt issue for external schemes that was only shown for ContentPrincipals, allowing extensions using ExpandedPrincipals to open them without user interaction. This could enable actions like downloading files or interacting with installed software. Affected:...
CVE-2023-32206
CVE-2023-32206: An out-of-bounds read in the RLBox Expat driver could crash affected Mozilla components. Affected software includes Firefox <113, Firefox ESR <102.11, and Thunderbird
CVE-2016-9074
CVE-2016-9074: Mozilla NSS timing-side-channel mitigation is insufficient in some circumstances. Affects NSS-based components used by Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox
CVE-2017-5434
CVE-2017-5434 is a use-after-free in Firefox/Thunderbird related to focus-handling that can cause a potentially exploitable crash. Public details in connected advisories show the flaw affects Firefox versions before 53 (and ESR branches before 53/52.1) with Firefox 53+ fixes and ESR updates deliv...
CVE-2017-7791
CVE-2017-7791: A data: protocol-based modal alert spoofing vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox
CVE-2017-7809
CVE-2017-7809 is a use-after-free in an editor DOM node during tree traversal that can crash the process. Affected products cited across connected docs include Mozilla Thunderbird and Mozilla Firefox components; IBM SONAS ships vulnerable Firefox releases and lists a fix in IBM SONAS version 1.5....
CVE-2021-23956
Mozilla Firefox before 85.0 is affected by CVE-2021-23956 due to an ambiguous file-picker UI that could confuse users intending to upload a single file, potentially resulting in a whole directory being uploaded and exposing directory contents. Public advisories (e.g., Arch Linux ASA-202102-1 and ...
CVE-2022-36318
CVE-2022-36318 involves directory listings for chrome:// URLs where some URL parameters were reflected. The connected documents show affected products: Firefox (including ESR lines) and Thunderbird, across multiple distributions. The underlying issue is reflected parameters in directory indexes f...
CVE-2023-29550
CVE-2023-29550 corresponds to memory-safety bugs in Mozilla Firefox 111 and Firefox ESR 102.9 (affecting Firefox < 112, Focus for Android < 112, ESR < 102.10, Firefox for Android < 112, Thunderbird
CVE-2023-5726
The CVE-2023-5726 issue is a macOS-only browser UI vulnerability where an obscured fullscreen notification could be exposed via the file-open dialog, potentially enabling spoofing or user confusion. Affected products/versions are Firefox older than 119, Firefox ESR older than 115.4, and Thunderbi...
CVE-2014-1490
CVE-2014-1490 : A race condition in NSS libssl session ticket processing (use-after-free) could allow remote attackers to cause a denial of service or, per the description, potentially other impact via a resumption handshake. Affected: NSS up to 3.15.4 and, by extension, Mozilla products (Firefox...
CVE-2017-7787
CVE-2017-7787 is a same-origin policy bypass vulnerability affecting Thunderbird and Firefox browsers. Affected products include Thunderbird versions older than 52.3, Firefox ESR older than 52.3, and Firefox older than 55. The issue occurs on pages with embedded iframes during page reloads, allow...
CVE-2017-7793
CVE-2017-7793 is a use-after-free in Thunderbird/Fetch API where the worker or window is freed while in use, leading to a potentially exploitable crash. Public details reference Thunderbird
CVE-2023-6208
CVE-2023-6208 is a Firefox/Thunderbird issue limited to X11: text selected via the Selection API is copied into the primary selection. Affected: Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird
CVE-2017-5441
CVE-2017-5441 is a use-after-free in Mozilla Firefox (and related Mozilla products) that occurs when holding a text selection during scroll events, leading to a potentially exploitable crash. Affected: Firefox < 53 (and ESR lines), Thunderbird < 52.1, Firefox ESR
CVE-2017-7786
A buffer overflow in the image renderer can be triggered when painting non-displayable SVG elements, causing a crash and, in some advisories, potential arbitrary-code execution. Affected products include Mozilla Thunderbird and Firefox/Firefox ESR prior to certain versions (Thunderbird < 52.3,...
CVE-2018-12397
CVE-2018-12397 affects Mozilla Firefox/Firefox ESR. The vulnerability arises from a WebExtension’s ability to access local files without the user-visible warning, bypassing the intended “Access your data for all websites” prompt. This can allow extensions to run content scripts on local pages wit...
CVE-2020-12396
CVE-2020-12396 is a set of memory-safety bugs reported in Firefox 75 that may allow arbitrary code execution. The vulnerability affects Firefox versions
CVE-2022-34469
CVE-2022-34469 affects Mozilla Firefox for Android. The issue allows a user to bypass a TLS certificate error on domains protected by HSTS, enabling bypass of certificate warnings (reported only on Android; other OSes unaffected). The vulnerability is addressed in Firefox 102 per the linked advis...
CVE-2022-34483
The issue is CVE-2022-34483 affecting Firefox prior to version 102. A user engaging via drag-and-drop of an image to a filesystem could have resulted in a filename containing an executable extension, potentially leading to execution of malicious code. The Astra Linux advisories corroborate that F...
CVE-2022-38477
CVE-2022-38477 concerns memory safety bugs reported by Mozilla’s Fuzzing Team in Firefox 103 and Firefox ESR 102.1. The entry notes evidence of memory corruption and a presumption that, with sufficient effort, some bugs could be exploited to execute arbitrary code. Affected products explicitly li...
CVE-2017-5465
CVE-2017-5465 is an out-of-bounds read in ConvolvePixel used when processing SVG content. The issue can crash the application and may copy memory into SVG content, potentially affecting rendering. Affected products include Thunderbird and Mozilla Firefox variants: Thunderbird < 52.1, Firefox E...
CVE-2017-7802
CVE-2017-7802 is a use-after-free in the DOM during an image element resize event. The vulnerability occurs when freed image elements are accessed due to lack of strong references, potentially causing a crash. Affected products/versions from the provided documents include Thunderbird < 52.3, F...
CVE-2017-7843
Summary (CVE-2017-7843) : In Firefox, Private Browsing mode could be exploited by a web worker to persist data in IndexedDB, enabling cross-session fingerprinting. Affected are Firefox ESR versions older than 52.5.2 and Firefox versions older than 57.0.1. The root cause is that IndexedDB remains ...
CVE-2020-12391
CVE-2020-12391 affects Firefox up to version 76. The issue is that documents formed using data: URLs in an OBJECT element do not inherit the CSP of the creating context, which can allow the execution of scripts that should be blocked, albeit with a unique opaque origin. The description explicitly...
CVE-2022-29910
CVE-2022-29910 affects Firefox for Android. When the app is closed or sent to the background, HSTS settings were not properly recorded/persisted, potentially weakening TLS protections. Affected: Firefox for Android, versions before 100; other OSs are unaffected. Mitigation: update to the latest F...
CVE-2022-40959
The CVE-2022-40959 entry corresponds to a Mozilla vulnerability where during iframe navigation, FeaturePolicy was not fully initialized, allowing a bypass that leaked device permissions to untrusted subdocuments. Affected products include Firefox ESR before 102.3, Thunderbird before 102.3, and Fi...
CVE-2023-25739
CVE-2023-25739 affects Firefox <110, Thunderbird <102.8, and Firefox ESR
CVE-2023-37201
CVE-2023-37201 is a WebRTC-related use-after-free in Firefox/Thunderbird: an attacker could trigger memory corruption during HTTPS WebRTC setup. Affected: Firefox <115, Firefox ESR <102.13, Thunderbird
CVE-2023-6856
CVE-2023-6856 describes a heap-buffer-overflow in the WebGL DrawElementsInstanced path when run with the Mesa VM driver. Impacted products include Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox
CVE-2017-5438
CVE-2017-5438 is a use-after-free in XSLT processing caused by the result handler being held by a freed handler. Publicly documented impact includes crashes and potential code execution in affected Mozilla products. Affected: Firefox
CVE-2017-5464
CVE-2017-5464 affects Mozilla products: Thunderbird
CVE-2017-7785
CVE-2017-7785 is a buffer overflow in ARIA attribute handling within the DOM that affects Thunderbird (< 52.3) and Firefox components (Firefox ESR < 52.3, Firefox
CVE-2017-7792
The CVE-2017-7792 issue affects Thunderbird (< 52.3), Firefox ESR (< 52.3), and Firefox (
CVE-2017-7800
CVE-2017-7800 is a use-after-free in WebSockets that can trigger a crash when the connection object is freed before disconnection finishes. Affected: Thunderbird < 52.3, Firefox ESR < 52.3, Firefox
CVE-2017-7807
CVE-2017-7807 describes a domain URL hijack via AppCache fallback, resolved by requiring fallback files to be inside the manifest directory. Affected products include Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox