CVE-2011-3660

CVE-2011-3660 concernsMozilla Firefox 4.x–8.0, Thunderbird 5.0–8.0, and SeaMonkey before 2.6, where multiple vulnerabilities in the browser engine enable remote denial of service or possibly arbitrary code execution via vectors that trigger a compartment mismatch in nsDOMMessageEvent::GetData and...

CVE-2012-3962

CVE-2012-3962 affects Mozilla Firefox before 15.0, Firefox ESR before 10.0.7, Thunderbird before 15.0, Thunderbird ESR before 10.0.7, and SeaMonkey before 2.12. The issue is a failure to properly iterate through characters in a text run, enabling remote code execution via a crafted document. The ...

CVE-2006-3802

CVE-2006-3802 affects Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3. The issue is that remote attackers can hijack native DOM methods from objects in another domain to conduct cross-site scripting (XSS) attacks using DOM methods of the top-level object. Th...

CVE-2008-2811

The CVE-2008-2811 issue affects Mozilla components (Firefox <2.0.0.15, Thunderbird ≤2.0.0.14, SeaMonkey

CVE-2008-5500

CVE-2008-5500 affects Mozilla Firefox 3.x before 3.0.5 and Firefox 2.x before 2.0.0.19, Mozilla Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14. The vulnerability arises from the layout engine when processing malformed content, allowing a remote attacker to cause a denial of serv...

CVE-2008-5508

CVE-2008-5508 affects Mozilla Firefox (3.x prior to 3.0.5 and 2.x prior to 2.0.0.19), Mozilla Thunderbird (2.x prior to 2.0.0.19), and SeaMonkey (1.x prior to 1.1.14). The issue stems from improper parsing of URLs that start with leading whitespace or control characters, which can allow a remote ...

CVE-2009-1836

CVE-2009-1836: The vulnerability arises from how Mozilla Firefox (pre-3.0.11), Thunderbird (pre-2.0.0.22), and SeaMonkey (pre-1.1.17) use the HTTP Host header to determine the document context in a non-200 CONNECT response from a proxy. This can enable a man-in-the-middle attacker to modify the C...

CVE-2011-2378

CVE-2011-2378 affects Mozilla Firefox before 3.6.20, Thunderbird 3.x before 3.1.12, SeaMonkey 2.x (and possibly other products). The root cause is improper handling of DOM objects in appendChild, allowing remote attackers to execute arbitrary code via vectors leading to a dangling pointer. Impact...

CVE-2006-1727

CVE-2006-1727 affects Mozilla-derived browsers: Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1. The issue allows remote attackers to gain chrome privileges through multiple attack vectors related to the use of XBL...

CVE-2006-6503

CVE-2006-6503: Affected Mozilla Firefox 2.x before 2.0.0.1, Mozilla Firefox 1.5.x before 1.5.0.9, Mozilla Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7. The issue allows bypassing cross-site scripting (XSS) protection by changing the src attribute of an IMG element to a javascript: URI. ...

CVE-2008-0419

CVE-2008-0419 affects Mozilla Firefox (pre-2.0.0.12) and SeaMonkey (pre-1.1.8). It allows remote attackers to steal navigation history and to cause a denial of service (crash) by exploiting images in a page that uses designMode frames, triggering memory corruption related to resize handles. The p...

CVE-2008-5513

CVE-2008-5513 affects Mozilla Firefox. The issue arises in the session-restore feature, where restoration of SessionStore data can bypass the Same Origin Policy, enabling content injection and cross-site scripting (XSS) via unknown vectors. Affected products/versions include Firefox 3.x prior to ...

CVE-2009-3981

CVE-2009-3981 affects Mozilla Firefox before 3.0.16, SeaMonkey before 2.0.1, and Thunderbird. The issue is an unspecified remote vulnerability in the browser engine that can cause memory corruption, leading to a crash or potentially arbitrary code execution via unknown vectors, and can result in ...

CVE-2010-3769

CVE-2010-3769 affects Mozilla Firefox (pre-3.5.16 and pre-3.6.13 on Windows), Thunderbird (pre-3.0.11 and pre-3.1.7), and SeaMonkey (pre-2.0.11) due to a flaw in line-breaking when handling very long strings. The root cause is a buffer over-read triggered by a crafted document.write call, enablin...

CVE-2011-2990

The CVE-2011-2990 vulnerability affects Mozilla Firefox 4.x–5 and SeaMonkey 2.x (before 2.3) where Content Security Policy (CSP) violation reports do not strip proxy-authorization credentials from the request headers, enabling potential leakage of credentials when a CSP report is read. The issue ...

CVE-2011-2999

The CVE-2011-2999 issue affects Mozilla Firefox (pre-3.6.23 and 4.x–5), Thunderbird (pre-6.0), and SeaMonkey (pre-2.3) where a frame named location could shadow window.location, bypassing Same Origin Policy via a crafted site. This is a remote vulnerability with no explicit exploitation details i...

CVE-2011-3002

CVE-2011-3002 concerns Mozilla Firefox (pre-7.0) and SeaMonkey (pre-2.4) where ANGLE does not validate the return value of GrowAtomTable, enabling memory-allocation errors that can cause a crash or potentially allow arbitrary code execution. The vulnerability is triggered by vectors that lead to ...

CVE-2012-5840

CVE-2012-5840 is a Use-after-free vulnerability in Mozilla Firefox’s nsTextEditorState::PrepareEditor, affecting Firefox prior to 17.0, Firefox ESR 10.x prior to 10.0.11, Thunderbird prior to 17.0, Thunderbird ESR 10.x prior to 10.0.11, and SeaMonkey prior to 2.14. The flaw allows remote attacker...

CVE-2006-2894

The CVE-2006-2894 issue affects Mozilla Firefox up to 1.5.0.4 and Firefox 2.0.x before 2.0.0.8, Mozilla Suite 1.7.13, SeaMonkey before 1.1.5, Netscape 8.1 and earlier. A user-assisted trick using OnKeyDown/OnKeyPress/OnKeyUp events can cause characters of a target filename to be inserted into a f...

CVE-2006-4565

CVE-2006-4565 is a vulnerability in Mozilla-related products (Firefox/SeaMonkey/Thunderbird) tied to processing of certain JavaScript regular expressions. The root cause is flaws in handling specific regular expressions, which could crash the application or allow arbitrary code execution. Public ...

CVE-2006-5747

CVE-2006-5747 affects Mozilla Firefox <=1.5.0.7/8, Thunderbird <=1.5.0.7/8, and SeaMonkey

CVE-2006-5748

CVE-2006-5748 involves memory-corruption flaws in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, potentially causing a crash or arbitrary code execution via unspecified vectors. The connected advisories confirm these products and versions are affected and ...

CVE-2007-5339

CVE-2007-5339 is in Mozilla Firefox (pre-2.0.0.8), Mozilla Thunderbird (pre-2.0.0.8) and SeaMonkey (pre-1.1.5). The flaws arise from crafted HTML triggering memory corruption or assert errors, leading to remote denial of service (crash); some entries also indicate potential arbitrary code executi...

CVE-2008-5017

CVE-2008-5017 is an integer overflow in xpcom/io/nsEscape.cpp in the Mozilla browser engine. The vulnerability could allow a remote attacker to crash the affected application (DoS) via unspecified vectors in Mozilla Firefox 3.x prior to 3.0.4, Firefox 2.x prior to 2.0.0.18, Thunderbird 2.x prior ...

CVE-2008-5510

CVE-2008-5510 concerns the CSS parser in Mozilla Firefox (3.x up to 3.0.5 and 2.x up to 2.0.0.19), Thunderbird 2.x up to 2.0.0.19, and SeaMonkey 1.x up to 1.1.14, where the escaped null character (\0) is ignored, potentially allowing remote attackers to bypass sanitization protections. The descri...

CVE-2009-1305

CVE-2009-1305 is a vulnerability in the JavaScript engine of Mozilla Firefox (and affected Thunderbird/SeaMonkey) prior to version 3.0.9. It allows remote attackers to cause a denial of service (application crash) and potentially memory corruption via vectors involving JSOP_DEFVAR and properties ...

CVE-2010-0159

CVE-2010-0159 affects Mozilla-based browsers including Firefox 3.0.x (before 3.0.18) and 3.5.x (before 3.5.8), Thunderbird before 3.0.2, and SeaMonkey before 2.0.3. The vulnerability arises from memory-corruption in layout handling, specifically in nsBlockFrame::StealFrame and related vectors, al...

CVE-2011-0056

CVE-2011-0056: Buffer overflow in the JavaScript engine of Mozilla Firefox (before 3.5.17) and Firefox 3.6.x (before 3.6.14), and SeaMonkey before 2.0.12. The issue arises from an atom map handling of a large number of string values and exception timing, potentially allowing remote code execution...

CVE-2011-2981

The CVE-2011-2981 issue affects Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and related products. Root cause: the event-management implementation does not correctly choose the proper script context, allowing remote attackers to bypass the Same Origin Policy or run...

CVE-2011-3670

CVE-2011-3670 affects Firefox prior to 3.6.26 and 4.x–6.0, Thunderbird prior to 3.1.18 and 5.0–6.0, and SeaMonkey prior to 2.4. The issue: improper enforcement of IPv6 literal address syntax, allowing remote attackers to cause information disclosure by reading error messages from XMLHttpRequest c...

CVE-2006-1731

CVE-2006-1731 affects Mozilla Firefox/Thunderbird 1.x and related Mozilla suites; the flaw lets a remote attacker trigger XSS by valueOf.call/valueOf.apply with no args, returning the Object prototype instead of the global window. Impact is cross-site scripting; vendors released fixes in Firefox/...

CVE-2006-3805

CVE-2006-3805 affects Mozilla Firefox (before 1.5.0.5), Thunderbird (before 1.5.0.5), and SeaMonkey (before 1.0.3). The issue stems from the JavaScript engine: a garbage-collection path could delete a temporary object still in use, potentially allowing arbitrary code execution. Public advisories ...

CVE-2006-3807

CVE-2006-3807 describes a privilege-escalation vulnerability in Mozilla Firefox (pre-1.5.0.5), Thunderbird (pre-1.5.0.5), and SeaMonkey (pre-1.0.3). The issue arises when the standard Object() constructor is redefined by script, allowing named JavaScript functions to reference a privileged parent...

CVE-2006-5463

CVE-2006-5463 affects Mozilla Firefox (before 1.5.0.8), Thunderbird (before 1.5.0.8), and SeaMonkey (before 1.0.6). The vulnerability arises from modifying a Script object while it is executing, which could allow remote attackers to execute arbitrary JavaScript bytecode. Exploitation could enable...

CVE-2008-2799

CVE-2008-2799 pertains to multiple unpatched JavaScript engine flaws in Mozilla Firefox (pre-2.0.0.15), Thunderbird (pre-2.0.0.14 and earlier), and SeaMonkey (pre-1.1.10). The vulnerabilities allow a remote attacker to cause a crash and potentially execute arbitrary code via unknown vectors relat...

CVE-2008-2802

The CVE-2008-2802 entry affects Mozilla Firefox <= 2.0.0.14/2.0.0.15? and earlier Thunderbird 2.0.0.14 and SeaMonkey

CVE-2008-2809

This CVE (CVE-2008-2809) describes a flaw in Mozilla-based browsers where, if a user accepts an SSL server certificate based on the CN in the DN, that certificate is also accepted for all names listed in subjectAltName:dNSName. Affected products include Mozilla 1.9 M8 and earlier, Firefox 2 befor...

CVE-2009-1841

CVE-2009-1841 affects Mozilla products: Firefox <3.0.11, Thunderbird <2.0.0.22, SeaMonkey

CVE-2011-2982

CVE-2011-2982 affects Mozilla Firefox before 3.6.20, Thunderbird 2.x/3.x before 3.1.12, SeaMonkey 1.x/2.x, and possibly other Mozilla-based products. The issue stems from multiple unspecified browser‑engine vulnerabilities causing memory corruption and remote code execution or DoS via unknown vec...

CVE-2012-3958

CVE-2012-3958 describes a use-after-free in Mozilla’s browser components, specifically nsHTMLEditRules::DeleteNonTableElements. A remote attacker could exploit this to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. Affected products include M...

CVE-2012-3968

CVE-2012-3968 is a use-after-free in Firefox’s WebGL implementation related to deletion of a fragment shader by its accessor. The issue allows remote attackers to execute arbitrary code via crafted web content. Affected products include Mozilla Firefox (and Firefox ESR 10.x lineage) prior to patc...

CVE-2012-4182

CVE-2012-4182 is a Use-after-free in Mozilla Firefox’s nsTextEditRules::WillInsert, affecting Firefox <= 16.0 and Firefox ESR <= 10.x <= 10.0.8, Thunderbird <= 16.0 and ESR 10.x <= 10.0.8, and SeaMonkey

CVE-2006-1732

Technical details (affected products, root cause, and exploit specifics) for CVE-2006-1732 are not provided in the supplied documents. Monitor for updates from official advisories.

CVE-2008-1234

This CVE-2008-1234 relates to an XSS vulnerability in Mozilla components: Firefox < 2.0.0.13, Thunderbird < 2.0.0.13, and SeaMonkey

CVE-2008-2800

The CVE-2008-2800 entry affects Mozilla Firefox up to 2.0.0.15 and SeaMonkey up to 1.1.10, enabling remote XSS via bypassing Same Origin Policy. Reported vectors include an event handler on an outer window, a SCRIPT element in an unloaded document, and the onreadystatechange handler with XMLHttpR...

CVE-2008-4061

CVE-2008-4061: An integer overflow in the MathML component of Mozilla Firefox can be triggered by an mtd element with a large rowspan value. Affects Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12. Impact: remote memory corruption, denial of ...

CVE-2008-4067

CVE-2008-4067 describes a directory traversal vulnerability in Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12) on Linux. An attacker could read arbitrary files via a resource: URI containing .. and URL-encoded / sequences. The c...

CVE-2011-0055

CVE-2011-0055 is a use-after-free in JSON.stringify in js3250.dll affecting Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12. The issue is related to the js_HasOwnProperty handling and garbage collection; exploitation details are not specified in the provided doc...

CVE-2012-4180

CVE-2012-4180 : A heap-based buffer overflow in the nsHTMLEditor::IsPrevCharInNodeWhitespace function in Mozilla Firefox prior to 16.0 (and Firefox ESR 10.x prior to 10.0.8; Thunderbird prior to 16.0; Thunderbird ESR 10.x prior to 10.0.8; SeaMonkey prior to 2.13) could allow remote code execution...

CVE-2013-0771

CVE-2013-0771 describes a heap-based buffer overflow in Mozilla Firefox’s gfxTextRun::ShrinkToLigatureBoundaries, affecting Firefox before 18.0 (and ESR 17.x before 17.0.1), Thunderbird before 17.0.2 (and ESR 17.x before 17.0.1), and SeaMonkey before 2.15. Successful exploitation via a crafted do...