2141 matches found
CVE-2022-0511
CVE-2022-0511 corresponds to memory-safety bugs in Mozilla Firefox 96 that could have allowed arbitrary code execution via memory corruption. The public records indicate these issues affected Firefox versions prior to 97 and were addressed in Firefox 97+ and related ESR branches. The Mozilla advi...
CVE-2022-28287
Summary: CVE-2022-28287 affects Mozilla Firefox earlier than 99. In unusual circumstances, selecting text could cause text selection caching to misbehave and crash the browser. The associated data from connected sources confirms Firefox as the affected product and Firefox 99 or later as the fix/v...
CVE-2022-45408
Summary: CVE-2022-45408 describes a web/browser UI issue where a sequence of popups that reuse the same windowName can force a window into fullscreen mode without showing the notification prompt, enabling user confusion or spoofing. Affected products/versions: Firefox ESR and Firefox, Thunderbird...
CVE-2023-4048
CVE-2023-4048 involves an out-of-bounds read in DOMParser when parsing HTML in low-memory conditions, affecting Firefox < 116, Firefox ESR < 102.14, and Firefox ESR
CVE-2021-23968
CVE-2021-23968 describes a disclosure risk where, if a Content Security Policy blocked frame navigation, the violation report could reveal the destination of a redirect instead of the original frame URI. This could leak sensitive information contained in those URIs. Affected products include Fire...
CVE-2022-22755
CVE-2022-22755 describes a vulnerability in Firefox
CVE-2024-2608
The Firefox browser and Thunderbird email client are affected by an integer overflow vulnerability in the functions AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding(), and AppendEncodedCharacters(). This flaw can lead to the underallocation of an output buffer , subsequently resulti...
CVE-2020-12387
CVE-2020-12387 is a use-after-free vulnerability caused by a race condition during Web Worker shutdown in Mozilla Firefox/Thunderbird. Affected products include Firefox ESR < 68.8, Firefox < 76, and Thunderbird
CVE-2025-1013
A race condition in Mozilla Firefox and Thunderbird could allow private browsing tabs to be opened in normal browsing windows, potentially leading to a privacy leak . The vulnerability affects Firefox versions prior to 135 , Firefox ESR prior to 128.7 , Thunderbird prior to 128.7 , and Thunderbir...
CVE-2024-29944
The Firefox desktop browser is vulnerable to a flaw where an attacker can inject an event handler into a privileged object . This allows for arbitrary JavaScript execution in the parent process. This vulnerability affects Firefox versions earlier than 124.0.1 and Firefox ESR versions earlier than...
CVE-2018-18506
CVE-2018-18506 is a PAC-related issue where a PAC file can cause localhost requests to be proxied. Connected documents confirm Thunderbird is affected and publicly patched: Thunderbird 60.6.1 fixes were released across AL2 (ALAS2-2019-1195), CentOS/RHEL advisories (RHSA-2019:0680/0681), and Debia...
CVE-2023-28176
CVE-2023-28176 corresponds to memory safety bugs in Firefox 110 and Firefox ESR 102.8, with potential to cause memory corruption and possible arbitrary code execution. Affected products include Firefox <111, Firefox ESR <102.9, and Thunderbird
CVE-2018-5146
CVE-2018-5146 describes an out-of-bounds memory write in Vorbis audio data processing. Affected are Mozilla Firefox (<59.0.1), Firefox ESR (<52.7.2), and Thunderbird (
CVE-2024-9400
A potential memory corruption vulnerability exists in Firefox and Thunderbird when an attacker can trigger an Out of Memory (OOM) condition during JIT compilation . This issue affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 131, and Thunderbird
CVE-2020-26974
CVE-2020-26974 is a Firefox/Thunderbird vulnerability where using flex-basis on a table wrapper could cause a StyleGenericFlexBasis object to be cast to the wrong type, leading to a heap use-after-free and memory corruption, potentially crashing the browser. Affected: Firefox <84, Thunderbird ...
CVE-2021-29980
CVE-2021-29980 is a memory safety issue caused by uninitialized memory in a canvas object, potentially enabling memory corruption and a crash. Documents show affected products include Thunderbird and Firefox variants: Thunderbird 78.x/91.x and Firefox ESR 78.x as well as Firefox
CVE-2020-6800
CVE-2020-6800 involves memory safety bugs identified in Firefox 72 and Firefox ESR 68.4, with potential to corrupt memory and enable arbitrary code execution in browser-like contexts. Affected products include Thunderbird and Firefox versions older than 68.5/73 respectively (Thunderbird < 68.5...
CVE-2023-32205
CVE-2023-32205 affects Firefox (versions < 113), Firefox ESR (< 102.11), and Thunderbird (
CVE-2024-11704
A double-free issue exists in the sec_pkcs7_decoder_start_decrypt() function when handling an error path. Under specific conditions, the same symmetric key could be freed twice, potentially leading to memory corruption . This vulnerability affects Firefox < 133 , Thunderbird < 133 , Firefox...
CVE-2024-4767
The Firefox browser and Thunderbird email client are affected by a vulnerability where IndexedDB files are not properly deleted when a window is closed, provided the browser.privatebrowsing.autostart preference is enabled. This configuration is disabled by default in Firefox. The issue impacts Fi...
CVE-2019-9791
CVE-2019-9791 affects Thunderbird and Firefox (including Firefox ESR) and stems from the IonMonkey JIT: type confusion for constructors entered via on-stack replacement. The advisory notes that the vulnerability can enable arbitrary reading/writing of objects during an exploitable crash, with fix...
CVE-2024-11699
Mozilla products, including Firefox 132 , Firefox ESR 128.4 , and Thunderbird 128.4 , contain memory safety bugs that can lead to memory corruption . These flaws could potentially be exploited with significant effort to execute arbitrary code . The vulnerabilities affect versions of Firefox earli...
CVE-2024-2610
A markup injection vulnerability in Firefox , Firefox ESR , and Thunderbird allows an attacker to steal nonce values . This can be leveraged to bypass strict content security policies (CSP). The vulnerability affects Firefox < 124 , Firefox ESR < 115.9 , and Thunderbird
CVE-2010-1205
CVE-2010-1205 is a buffer overflow in libpng (pngpread.c) that could allow remote code execution via a crafted PNG image. Affected libpng versions are prior to 1.2.44 and prior to 1.4.3. The overflow is tied to the internal copy in pngpread.c and is described across advisories mentioning memory c...
CVE-2023-4047
CVE-2023-4047 is a vulnerability in Firefox popup notifications delay calculation that could allow an attacker to trick a user into granting permissions. The issue affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR
CVE-2023-4057
CVE-2023-4057 affects Firefox (115 and ESR 115.x) and Thunderbird 115.x. The connected sources confirm memory-safety bugs in Firefox/Thunderbird that could allow memory corruption and, with sufficient effort, arbitrary code execution. The documented impact states affected versions are Firefox <...
CVE-2021-38493
CVE-2021-38493 covers memory-safety bugs in Mozilla Firefox 91/ESR 78.13 (and Thunderbird <78.14) that could lead to memory corruption and potentially arbitrary code execution. Affected: Firefox ESR <78.14, Thunderbird <78.14, and Firefox
CVE-2025-0242
Mozilla Firefox and Thunderbird are affected by memory safety bugs that can lead to memory corruption . If exploited, these vulnerabilities could allow an attacker to execute arbitrary code . The issue impacts the following versions: Firefox 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird...
CVE-2023-3600
CVE-2023-3600 affects Firefox (all channels) < 115.0.2, Firefox ESR < 115.0.2, and Thunderbird
CVE-2023-4046
CVE-2023-4046 corresponds to a bug where an incorrect value used during WASM JIT compilation could cause a stale global variable to influence compilation, yielding an exploitable crash in the content process. The vulnerability affects Firefox plus ESR branches: Firefox < 116, ESR < 102.14, ...
CVE-2024-5700
This vulnerability involves memory safety bugs affecting Firefox , Firefox ESR , and Thunderbird . The issues manifest as memory corruption , which could potentially be exploited to execute arbitrary code with sufficient effort. Affected versions include Firefox < 127 , Firefox ESR < 115.12...
CVE-2019-9792
The CVE-2019-9792 issue is an IonMonkey JIT leak in Firefox/Thunderbird where the JS_OPTIMIZED_OUT magic value is leaked during bailout, enabling memory corruption and potentially a crash. Affected: Thunderbird < 60.6, Firefox ESR < 60.6, Firefox
CVE-2024-11694
The Google SafeFrame shim within the Web Compatibility extension contains a vulnerability where Enhanced Tracking Protection's Strict mode may inadvertently allow a CSP frame-src bypass and DOM-based XSS . This flaw could expose users to malicious frames masquerading as legitimate content. Affect...
CVE-2019-11740
CVE-2019-11740 corresponds to memory-safety bugs in Firefox 68/ESR 68 and Firefox 60.8, with potential for arbitrary code execution. According to the consolidated sources, affected products include Firefox < 69, Thunderbird < 68.1/60.9, and Firefox ESR
CVE-2024-2607
This vulnerability affects Firefox < 124 , Firefox ESR < 115.9 , and Thunderbird
CVE-2024-10464
This vulnerability affects Firefox < 132 , Firefox ESR < 128.4 , Thunderbird < 128.4 , and Thunderbird
CVE-2021-23994
CVE-2021-23994 describes a WebGL-related memory corruption due to a framebuffer not initialized early enough, causing an out-of-bounds write. Affected products are Firefox ESR versions earlier than 78.10, Thunderbird versions earlier than 78.10, and Firefox versions earlier than 88. The root caus...
CVE-2020-6811
CVE-2020-6811 concerns Mozilla Firefox/Thunderbird where Devtools Network tab’s Copy as cURL did not properly escape the HTTP method. The underlying issue could allow command injection if the generated curl command is pasted into a terminal. Public advisories indicate affected products include Th...
CVE-2023-23598
CVE-2023-23598 describes an Arbitrary file read via GTK drag-and-drop in Firefox/Thunderbird where the GTK wrapper uses text/plain for drag data; GTK treats text/plain MIMEs with file URLs as dragged, enabling DataTransfer.setData to read local files. Affected versions: Firefox < 109, Firefox ...
CVE-2021-29991
CVE-2021-29991 affects Mozilla Firefox and Mozilla Thunderbird. The issue arises when Firefox incorrectly accepts a newline in an HTTP/3 header, treating it as two separate headers, enabling a header-splitting scenario for servers using HTTP/3. Affected versions are Firefox < 91.0.1 and Thunde...
CVE-2023-4045
CVE-2023-4045 involves Offscreen Canvas cross-origin taint tracking in Firefox and ESR branches. Affects Firefox < 116 and ESR
CVE-2023-4055
CVE-2023-4055 concerns cookies per domain in the browser’s cookie jar. When domain cookie count exceeded, the actual sent cookie jar could diverge from the expected state, causing some cookies to be missing from requests. This affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR
CVE-2024-4770
A use-after-free vulnerability exists in Firefox , Firefox ESR , and Thunderbird when saving a page to PDF. The flaw is triggered by specific font styles , which could lead to a crash . This affects Firefox < 126 , Firefox ESR < 115.11 , and Thunderbird
CVE-2025-1010
A use-after-free vulnerability exists in the Custom Highlight API component of Mozilla Firefox , Firefox ESR , and Thunderbird . An attacker could exploit this flaw to cause a potentially exploitable crash or service failure. This issue affects Firefox versions prior to 135 , Firefox ESR versions...
CVE-2021-29989
CVE-2021-29989 covers memory safety bugs in Firefox 90/ESR 78.12 that could lead to memory corruption and potentially arbitrary code execution; affected products include Thunderbird <78.13, Firefox ESR <78.13, and Firefox
CVE-2024-6600
A memory corruption vulnerability in the WebGL API of Mozilla Firefox (and associated products) allows a remote attacker to trigger an out-of-bounds access . The root cause is due to Angle for GLSL shaders having lenient allocation checks when allocating more than 8192 integers in private shader ...
CVE-2024-7519
CVE-2024-7519 describes memory corruption due to insufficient checks when processing graphics shared memory, enabling sandbox escape. Affected products include Firefox <129, Firefox ESR <115.14, Firefox ESR <128.1, Thunderbird <128.1, and Thunderbird
CVE-2024-8381
CVE-2024-8381 describes a potentially exploitable type confusion triggered when looking up a property name on an object used as the with environment. Affected products include Firefox (pre-130 and ESR pre-128.2/115.15) and Thunderbird (pre-128.2/115.15). The root cause is type confusion during pr...
CVE-2024-9393
Summary: CVE-2024-9393 describes a cross-origin JavaScript execution in PDFs via a crafted multipart response, allowing access to cross-origin content under the resource://pdf.js origin. Affected software (from provided docs): Mozilla Firefox and Thunderbird (including ESR branches). Desktop Site...