CVE-2006-4570

CVE-2006-4570 affects Mozilla Thunderbird and SeaMonkey. With Load Images enabled, a remote XBL file loaded when viewing/forwarding/replying to a message can bypass the user’s JavaScript-disabled settings, enabling remote JavaScript execution. Affected versions in public advisories are Thunderbir...

CVE-2008-5016

CVE-2008-5016 affects Mozilla Firefox (3.x up to 3.0.4), Thunderbird (2.x up to 2.0.0.18), and SeaMonkey (1.x up to 1.1.13). The issue is triggered by the layout engine and can cause a remote denial of service (crash) via multiple vectors that lead to an assertion failure or other consequences. A...

CVE-2008-5022

CVE-2008-5022 affects multiple Mozilla-based browsers: nsXMLHttpRequest::NotifyEventListeners in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13. Root cause: bypass of the same-origin policy due to bypassed inner window check...

CVE-2008-5512

CVE-2008-5512 affects Mozilla Firefox 3.x before 3.0.5 and Firefox/Thunderbird/SeaMonkey lines older than the cited versions; severity details align with NFV advisories. The vulnerability arises from a flaw in how page content can pollute XPCNativeWrappers, permitting remote attackers to run arbi...

CVE-2012-3956

CVE-2012-3956 is a use-after-free in MediaStreamGraphThreadRunnable::Run in Mozilla Firefox before 15.0 (and similar affected versions for Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0/ESR 10.x before 10.0.7, SeaMonkey before 2.12). Successful exploitation could allow remote attackers t...

CVE-2012-4216

CVE-2012-4216 is a use-after-free in gfxFont::GetFontEntry affecting Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14. Exploitation could lead to remote code execution or a denial of service via h...

CVE-2012-5833

CVE-2012-5833 concerns WebGL texImage2D handling in Mozilla Firefox (and related Gecko-based products) that interacts with Mesa drivers. The vulnerability can allow remote code execution or a denial of service (memory corruption) via certain level parameter values. Affected versions include Firef...

CVE-2006-1738

CVE-2006-1738 affects Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0. The vulnerability allows a remote attacker to cause a crash (DoS) by altering the (1) -moz-grid and (2) -moz-grid-group display styles. Root cause is...

CVE-2010-3771

CVE-2010-3771 – Impact and fix (from provided sources) Affected products (per description): Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11. Root cause: improper handling of injection of an ISINDEX element into an about:blank page, which can be exploited via vec...

CVE-2012-4215

CVE-2012-4215 is a use-after-free in Mozilla Firefox’s nsPlaintextEditor::FireClipboardEvent that could allow remote code execution or a heap memory corruption, affecting Firefox before 17.0, Firefox ESR before 10.0.11, Thunderbird before 17.0, Thunderbird ESR before 10.0.11, and SeaMonkey before...

CVE-2012-5838

CVE-2012-5838 affects the WebGL copyTexImage2D in Mozilla Firefox (<17.0), Thunderbird (<17.0), and SeaMonkey (

CVE-2006-2782

Firefox 1.5.0.2 does not fix all test cases for CVE-2006-1729, allowing a remote attacker to read arbitrary files by inputting a filename into a text box that is later turned into a file upload control. The description does not provide a concrete patch version or remediation steps. No additional ...

CVE-2006-3808

CVE-2006-3808 affects Mozilla Firefox (pre-1.5.0.5) and SeaMonkey (pre-1.0.3) where a malicious Proxy Auto-Config (PAC) script could set FindProxyForURL to an eval on a privileged object, enabling remote code execution with elevated privileges. Public advisories in connected docs confirm the PAC ...

CVE-2007-3844

CVE-2007-3844 affects Mozilla Firefox 2.0.0.5, Thunderbird 2.0.0.5 and earlier (1.5.0.13), and SeaMonkey 1.1.3. The issue allows remote attackers to perform cross-context scripting (XSS) with chrome privileges by injecting a javascript: or data: link into an about:blank document loaded by chrome ...

CVE-2007-5337

CVE-2007-5337 affects Mozilla Firefox pre-2.0.0.8 and SeaMonkey pre-1.1.5 on Linux with gnome-vfs. The vulnerability lets a remote attacker cause the target to expose files by creating a page containing URIs using smb: or sftp: that access other files on the server, potentially reading data from ...

CVE-2008-4062

Summary: CVE-2008-4062 covers multiple /unspecified / vulnerabilities in Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12). The flaws involve the JavaScript engine and are triggered by vectors related to (1) misinterpretation of N...

CVE-2009-1838

CVE-2009-1838 affects Mozilla Firefox (pre-3.0.11), Thunderbird (pre-2.0.0.22), and SeaMonkey (pre-1.1.17). The garbage-collection implementation can set an element’s owner document to null under unspecified circumstances, due to an incorrect event-handler context. This allows remote attackers to...

CVE-2009-3986

CVE-2009-3986 affects Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1. A remote attacker could execute arbitrary JavaScript with chrome privileges by exploiting a reference to a chrome window from a content window via window.opener. The underlying issue is a privi...

CVE-2010-2763

CVE-2010-2763 concerns the XPCSafeJSObjectWrapper (SJOW) in Mozilla’s Firefox/XULRunner implementation. The connected documents confirm a logical error in the SJOW scripted function handling on the Mozilla 1.9.1 development branch, allowing a caller to execute a function in the context of another...

CVE-2010-3131

CVE-2010-3131 is an untrusted search path vulnerability in Firefox/SeaMonkey/Thunderbird where dwmapi.dll loaded from the current working directory can be exploited if a malicious HTML/EML file is opened. The issue occurs on Windows (not Linux per the sources) when the browser loads dwmapi.dll at...

CVE-2011-0054

CVE-2011-0054 is a buffer overflow in the JavaScript engine affecting Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12. It could allow remote attackers to execute arbitrary code via vectors involving non-local JavaScript variables (upvarMap). The MiracleLinux adv...

CVE-2012-1940

CVE-2012-1940 is a use-after-free in Mozilla’s browser engines. Affects Firefox 4.x–12.0, ESR 10.x prior to 10.0.5, Thunderbird 5.0–12.0, ESR 10.x prior to 10.0.5, and SeaMonkey before 2.10. The flaw is in nsFrameList::FirstChild when a container of absolutely positioned elements in a column chan...

CVE-2006-1734

CVE-2006-1734 affects Mozilla Firefox/Thunderbird 1.x prior to 1.5 and 1.0.x prior to 1.0.8, Mozilla Suite prior to 1.7.13, and SeaMonkey prior to 1.0. The vulnerability arises from the Object.watch method being able to access the internal cloneParent function, enabling remote attackers to execut...

CVE-2007-0994

CVE-2007-0994 affects Mozilla Firefox 2.x before 2.0.0.2 and Firefox 1.x before 1.5.0.10, and SeaMonkey 1.1 before 1.1.1 and 1.0 before 1.0.8. A regression in handling HTML mail with javascript: URIs in , (link), or tags could bypass access checks and allow remote JavaScript execution with chro...

CVE-2007-5338

CVE-2007-5338 is a vulnerability affecting Mozilla Firefox and SeaMonkey. The issue allows remote attackers to execute arbitrary JavaScript with user privileges by abusing Script and modifying XPCNativeWrappers, causing the script to run when a chrome action is performed. The description directly...

CVE-2008-5023

CVE-2008-5023 affects Mozilla-based browsers as described in the initial entry: Firefox 3.x prior to 3.0.4, Firefox 2.x prior to 2.0.0.18, and SeaMonkey 1.x prior to 1.1.13. The issue allows remote attackers to bypass the codebase-principal protection and execute arbitrary script via the -moz-bin...

CVE-2009-2210

CVE-2009-2210 affects Mozilla Thunderbird before 2.0.0.22 and SeaMonkey before 1.1.17. It allows a remote attacker to cause a denial of service (application crash) or potentially execute arbitrary code via a multipart/alternative e‑mail message containing a text/enhanced part that triggers access...

CVE-2010-0162

The CVE-2010-0162 issue affects Mozilla Firefox 3.0.x before 3.0.18, Firefox 3.5.x before 3.5.8, and SeaMonkey before 2.0.3. The root cause is improper handling of the application/octet-stream content type in contexts involving SVG and EMBED, allowing remote attackers to bypass Same Origin Policy...

CVE-2010-0175

CVE-2010-0175 is a use-after-free in the nsTreeSelection code path for XUL tree items, affecting Mozilla Firefox before 3.0.19 and 3.5.x before 3.5.9, Thunderbird before 3.0.4, and SeaMonkey before 2.0.4. Exploitation could allow remote code execution or cause a crash via triggering the select ev...

CVE-2012-0468

CVE-2012-0468 affects Mozilla Firefox 4.x–11.0, Thunderbird 5.0–11.0, and SeaMonkey before 2.9. The browser engine’s vulnerability is tied to vectors related to jsval.h and the js::array_shift function, leading to a potential denial of service (assertion failure and memory corruption) and possibl...

CVE-2012-5835

CVE-2012-5835 describes an integer overflow in the WebGL subsystem of Mozilla Firefox prior to 17.0 (also affecting Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0 and Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14). The overflow can lead to remote code execution or a den...

CVE-2006-1736

Technical details (affected product/version/root cause/impact) are not publicly provided in the connected documents. Monitor for updates.

CVE-2006-4568

Technical details about CVE-2006-4568 are not publicly provided in the connected documents. Monitor for updates from vendors/security advisories.

CVE-2007-2292

CVE-2007-2292 is a CRLF injection vulnerability in the Digest Authentication support of Mozilla Firefox (<2.0.0.8) and SeaMonkey (

CVE-2007-5947

The CVE-2007-5947 issue affects Mozilla Firefox up to 2.0.0.10 and SeaMonkey up to 1.1.7, where the jar protocol handler retrieves the inner URL regardless of MIME type and treats HTML documents inside a jar as same-origin with the inner URL. This enables cross-site scripting (XSS) via jar: URIs....

CVE-2008-0017

CVE-2008-0017 is a buffer overflow in the http-index-format parser (nsDirIndexParser) that could lead to remote arbitrary code execution. Public advisories show affected Mozilla-family products (Firefox/Iceweasel/Iceape/SeaMonkey/XULRunner) with fixes in Firefox 3.0.4 and corresponding Mozilla/NS...

CVE-2008-1237

CVE-2008-1237 affects SeaMonkey before 1.1.9 (and related Mozilla components) per the description: multiple vulnerabilities in the JavaScript engine could allow a remote attacker to cause a crash and potentially execute arbitrary code. Connected Nessus/NASA text confirms SeaMonkey, Firefox, and T...

CVE-2008-4058

CVE-2008-4058 affects Mozilla-based products (Firefox, SeaMonkey, Thunderbird) where XPConnect could be abused to pollute XPCNativeWrappers via chrome XBL/chrome JS, enabling remote arbitrary-code execution with chrome privileges. Publicly documented affected ranges include Firefox before 2.0.0.1...

CVE-2009-0353

CVE-2009-0353 affects Mozilla components: Firefox 3.x before 3.0.6, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15. The vulnerability is related to the JavaScript engine and can allow a remote attacker to cause memory corruption and an application crash, potentially leading to arbitrary...

CVE-2010-3774

CVE-2010-3774 affects Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11. The NS_SecurityCompareURIs function in netwerk/base/public/nsNetUtil.h does not correctly handle about:neterror and about:certerror pages, allowing remote attackers to spoof the location bar ...

CVE-2010-3775

Affected software and cause: Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, fail to properly handle certain redirections involving data: URLs and Java LiveConnect scripts, leading to the wrong security principal being used. Impact: remote attackers could start...

CVE-2011-0059

CVE-2011-0059 is a CSRF vulnerability in Mozilla Firefox (before 3.5.17 and 3.6.x before 3.6.14) and SeaMonkey (before 2.0.12). It allows remote attackers to hijack a user’s authenticated state for plugin-initiated requests that are redirected (HTTP 307) to a different site. The description confi...

CVE-2011-2983

CVE-2011-2983 affects Mozilla Firefox before 3.6.20, Thunderbird 2.x and 3.x before 3.1.12, SeaMonkey 1.x and 2.x. Root cause: improper handling of RegExp.input, which can bypass the Same Origin Policy and allow reading data from a different domain via a crafted page (potential use-after-free). E...

CVE-2012-0462

CVE-2012-0462 describes multiple unspecified vulnerabilities in Mozilla Firefox’s browser engine (Firefox 4.x–10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0–10.0, Thunderbird ESR 10.x before 10.0.3, SeaMonkey before 2.8) that can cause denial of service (memory corruption and crash) or pos...

CVE-2012-1948

CVE-2012-1948 is a member of a set of vulnerabilities in the Mozilla browser engine affecting Mozilla Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11. The issue enables remote attackers to cause a denial of serv...

CVE-2012-5839

CVE-2012-5839 is a heap-based buffer overflow in Mozilla's gfxShapedWord::CompressedGlyph::IsClusterStart that affects Firefox and related Mozilla components. Affected software includes Mozilla Firefox before 17.0 (and ESR 10.x before 10.0.11), Thunderbird before 17.0 (and ESR 10.x before 10.0.11...

CVE-2006-0749

CVE-2006-0749 affects Mozilla Firefox and Thunderbird (Firefox/Thunderbird 1.x before 1.5 and Mozilla Suite before 1.7.13; SeaMonkey before 1.0.8). The issue is a memory corruption triggered by a particular sequence of HTML tags, leading to memory corruption, a remote crash, and possibly arbitrar...

CVE-2007-2870

CVE-2007-2870 affects Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, as well as SeaMonkey 1.0.9 and 1.1.2. The vulnerability arises from using addEventListener to register an event listener for a site, which can then execute in the context of that site and bypass the same-origin po...

CVE-2007-3511

CVE-2007-3511 is a file input focus stealing vulnerability present in SeaMonkey (and related Mozilla suites) up to versions affected by the 2007 advisories (e.g., SeaMonkey before 1.1.5). The root cause involves focus handling for onkeydown triggered by the label’s for attribute, enabling an atta...

CVE-2008-1236

CVE-2008-1236 affects Mozilla Firefox (before 2.0.0.13), Mozilla Thunderbird (before 2.0.0.13), and SeaMonkey (before 1.1.9). The issue stems from memory-related vulnerabilities in the layout/web content processing, described as memory corruption via layout-engine interactions, allowing a remote ...