CVE-2008-2799

CVE-2008-2799 pertains to multiple unpatched JavaScript engine flaws in Mozilla Firefox (pre-2.0.0.15), Thunderbird (pre-2.0.0.14 and earlier), and SeaMonkey (pre-1.1.10). The vulnerabilities allow a remote attacker to cause a crash and potentially execute arbitrary code via unknown vectors relat...

CVE-2008-4058

CVE-2008-4058 affects Mozilla-based products (Firefox, SeaMonkey, Thunderbird) where XPConnect could be abused to pollute XPCNativeWrappers via chrome XBL/chrome JS, enabling remote arbitrary-code execution with chrome privileges. Publicly documented affected ranges include Firefox before 2.0.0.1...

CVE-2008-5500

CVE-2008-5500 affects Mozilla Firefox 3.x before 3.0.5 and Firefox 2.x before 2.0.0.19, Mozilla Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14. The vulnerability arises from the layout engine when processing malformed content, allowing a remote attacker to cause a denial of serv...

CVE-2010-2763

CVE-2010-2763 concerns the XPCSafeJSObjectWrapper (SJOW) in Mozilla’s Firefox/XULRunner implementation. The connected documents confirm a logical error in the SJOW scripted function handling on the Mozilla 1.9.1 development branch, allowing a caller to execute a function in the context of another...

CVE-2011-3670

CVE-2011-3670 affects Firefox prior to 3.6.26 and 4.x–6.0, Thunderbird prior to 3.1.18 and 5.0–6.0, and SeaMonkey prior to 2.4. The issue: improper enforcement of IPv6 literal address syntax, allowing remote attackers to cause information disclosure by reading error messages from XMLHttpRequest c...

CVE-2012-4215

CVE-2012-4215 is a use-after-free in Mozilla Firefox’s nsPlaintextEditor::FireClipboardEvent that could allow remote code execution or a heap memory corruption, affecting Firefox before 17.0, Firefox ESR before 10.0.11, Thunderbird before 17.0, Thunderbird ESR before 10.0.11, and SeaMonkey before...

CVE-2012-5833

CVE-2012-5833 concerns WebGL texImage2D handling in Mozilla Firefox (and related Gecko-based products) that interacts with Mesa drivers. The vulnerability can allow remote code execution or a denial of service (memory corruption) via certain level parameter values. Affected versions include Firef...

CVE-2013-1719

CVE-2013-1719 affects Mozilla Firefox (<24.0), Thunderbird (<24.0), and SeaMonkey (

CVE-2013-5601

CVE-2013-5601 is a use-after-free in Mozilla Firefox’s nsEventListenerManager::SetEventHandler that could allow remote code execution. Affected products and versions include Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1 and ESR 17.x before 17.0...

CVE-2007-2292

CVE-2007-2292 is a CRLF injection vulnerability in the Digest Authentication support of Mozilla Firefox (<2.0.0.8) and SeaMonkey (

CVE-2007-5339

CVE-2007-5339 is in Mozilla Firefox (pre-2.0.0.8), Mozilla Thunderbird (pre-2.0.0.8) and SeaMonkey (pre-1.1.5). The flaws arise from crafted HTML triggering memory corruption or assert errors, leading to remote denial of service (crash); some entries also indicate potential arbitrary code executi...

CVE-2008-5510

CVE-2008-5510 concerns the CSS parser in Mozilla Firefox (3.x up to 3.0.5 and 2.x up to 2.0.0.19), Thunderbird 2.x up to 2.0.0.19, and SeaMonkey 1.x up to 1.1.14, where the escaped null character (\0) is ignored, potentially allowing remote attackers to bypass sanitization protections. The descri...

CVE-2011-2981

The CVE-2011-2981 issue affects Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and related products. Root cause: the event-management implementation does not correctly choose the proper script context, allowing remote attackers to bypass the Same Origin Policy or run...

CVE-2012-4193

CVE-2012-4193 affects Mozilla Firefox and related Mozilla products (Firefox before 16.0.1, Firefox ESR before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR before 10.0.9, SeaMonkey before 2.13.1). Root cause: a security check in the defaultValue unwrapping of security wrappers is omitted, al...

CVE-2012-5835

CVE-2012-5835 describes an integer overflow in the WebGL subsystem of Mozilla Firefox prior to 17.0 (also affecting Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0 and Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14). The overflow can lead to remote code execution or a den...

CVE-2006-0296

CVE-2006-0296 affects Mozilla Suite components including Mozilla/Firefox up to 1.5.0.1 and SeaMonkey up to 1.0. The vulnerability arises in the XULDocument.persist function where the attribute name is not validated, enabling remote attackers to inject RDF data into the user’s localstore.rdf and e...

CVE-2006-1738

CVE-2006-1738 affects Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0. The vulnerability allows a remote attacker to cause a crash (DoS) by altering the (1) -moz-grid and (2) -moz-grid-group display styles. Root cause is...

CVE-2006-5463

CVE-2006-5463 affects Mozilla Firefox (before 1.5.0.8), Thunderbird (before 1.5.0.8), and SeaMonkey (before 1.0.6). The vulnerability arises from modifying a Script object while it is executing, which could allow remote attackers to execute arbitrary JavaScript bytecode. Exploitation could enable...

CVE-2008-2802

The CVE-2008-2802 entry affects Mozilla Firefox <= 2.0.0.14/2.0.0.15? and earlier Thunderbird 2.0.0.14 and SeaMonkey

CVE-2008-2807

CVE-2008-2807 affects Mozilla Firefox <2.0.0.15 and SeaMonkey

CVE-2008-4061

CVE-2008-4061: An integer overflow in the MathML component of Mozilla Firefox can be triggered by an mtd element with a large rowspan value. Affects Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12. Impact: remote memory corruption, denial of ...

CVE-2008-5022

CVE-2008-5022 affects multiple Mozilla-based browsers: nsXMLHttpRequest::NotifyEventListeners in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13. Root cause: bypass of the same-origin policy due to bypassed inner window check...

CVE-2009-3986

CVE-2009-3986 affects Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1. A remote attacker could execute arbitrary JavaScript with chrome privileges by exploiting a reference to a chrome window from a content window via window.opener. The underlying issue is a privi...

CVE-2010-0175

CVE-2010-0175 is a use-after-free in the nsTreeSelection code path for XUL tree items, affecting Mozilla Firefox before 3.0.19 and 3.5.x before 3.5.9, Thunderbird before 3.0.4, and SeaMonkey before 2.0.4. Exploitation could allow remote code execution or cause a crash via triggering the select ev...

CVE-2011-0054

CVE-2011-0054 is a buffer overflow in the JavaScript engine affecting Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12. It could allow remote attackers to execute arbitrary code via vectors involving non-local JavaScript variables (upvarMap). The MiracleLinux adv...

CVE-2011-0059

CVE-2011-0059 is a CSRF vulnerability in Mozilla Firefox (before 3.5.17 and 3.6.x before 3.6.14) and SeaMonkey (before 2.0.12). It allows remote attackers to hijack a user’s authenticated state for plugin-initiated requests that are redirected (HTTP 307) to a different site. The description confi...

CVE-2012-0462

CVE-2012-0462 describes multiple unspecified vulnerabilities in Mozilla Firefox’s browser engine (Firefox 4.x–10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0–10.0, Thunderbird ESR 10.x before 10.0.3, SeaMonkey before 2.8) that can cause denial of service (memory corruption and crash) or pos...

CVE-2012-5838

CVE-2012-5838 affects the WebGL copyTexImage2D in Mozilla Firefox (<17.0), Thunderbird (<17.0), and SeaMonkey (

CVE-2013-0771

CVE-2013-0771 describes a heap-based buffer overflow in Mozilla Firefox’s gfxTextRun::ShrinkToLigatureBoundaries, affecting Firefox before 18.0 (and ESR 17.x before 17.0.1), Thunderbird before 17.0.2 (and ESR 17.x before 17.0.1), and SeaMonkey before 2.15. Successful exploitation via a crafted do...

CVE-2006-0749

CVE-2006-0749 affects Mozilla Firefox and Thunderbird (Firefox/Thunderbird 1.x before 1.5 and Mozilla Suite before 1.7.13; SeaMonkey before 1.0.8). The issue is a memory corruption triggered by a particular sequence of HTML tags, leading to memory corruption, a remote crash, and possibly arbitrar...

CVE-2008-1234

This CVE-2008-1234 relates to an XSS vulnerability in Mozilla components: Firefox < 2.0.0.13, Thunderbird < 2.0.0.13, and SeaMonkey

CVE-2009-1838

CVE-2009-1838 affects Mozilla Firefox (pre-3.0.11), Thunderbird (pre-2.0.0.22), and SeaMonkey (pre-1.1.17). The garbage-collection implementation can set an element’s owner document to null under unspecified circumstances, due to an incorrect event-handler context. This allows remote attackers to...

CVE-2010-3774

CVE-2010-3774 affects Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11. The NS_SecurityCompareURIs function in netwerk/base/public/nsNetUtil.h does not correctly handle about:neterror and about:certerror pages, allowing remote attackers to spoof the location bar ...

CVE-2012-3956

CVE-2012-3956 is a use-after-free in MediaStreamGraphThreadRunnable::Run in Mozilla Firefox before 15.0 (and similar affected versions for Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0/ESR 10.x before 10.0.7, SeaMonkey before 2.12). Successful exploitation could allow remote attackers t...

CVE-2006-4568

Technical details about CVE-2006-4568 are not publicly provided in the connected documents. Monitor for updates from vendors/security advisories.

CVE-2006-4570

CVE-2006-4570 affects Mozilla Thunderbird and SeaMonkey. With Load Images enabled, a remote XBL file loaded when viewing/forwarding/replying to a message can bypass the user’s JavaScript-disabled settings, enabling remote JavaScript execution. Affected versions in public advisories are Thunderbir...

CVE-2007-3511

CVE-2007-3511 is a file input focus stealing vulnerability present in SeaMonkey (and related Mozilla suites) up to versions affected by the 2007 advisories (e.g., SeaMonkey before 1.1.5). The root cause involves focus handling for onkeydown triggered by the label’s for attribute, enabling an atta...

CVE-2007-5947

The CVE-2007-5947 issue affects Mozilla Firefox up to 2.0.0.10 and SeaMonkey up to 1.1.7, where the jar protocol handler retrieves the inner URL regardless of MIME type and treats HTML documents inside a jar as same-origin with the inner URL. This enables cross-site scripting (XSS) via jar: URIs....

CVE-2008-0017

CVE-2008-0017 is a buffer overflow in the http-index-format parser (nsDirIndexParser) that could lead to remote arbitrary code execution. Public advisories show affected Mozilla-family products (Firefox/Iceweasel/Iceape/SeaMonkey/XULRunner) with fixes in Firefox 3.0.4 and corresponding Mozilla/NS...

CVE-2008-5024

CVE-2008-5024 concerns Mozilla Firefox 3.x prior to 3.0.4, Firefox 2.x prior to 2.0.0.18, Thunderbird 2.x prior to 2.0.0.18, and SeaMonkey 1.x prior to 1.1.13. The issue arises from improper escaping of quote characters in XML processing via E4X (default namespace), enabling remote XML injection....

CVE-2008-5512

CVE-2008-5512 affects Mozilla Firefox 3.x before 3.0.5 and Firefox/Thunderbird/SeaMonkey lines older than the cited versions; severity details align with NFV advisories. The vulnerability arises from a flaw in how page content can pollute XPCNativeWrappers, permitting remote attackers to run arbi...

CVE-2009-1834

CVE-2009-1834 describes a visual truncation vulnerability in Mozilla Firefox (nsIDNService.cpp) affecting Firefox < 3.0.11 and SeaMonkey

CVE-2010-3771

CVE-2010-3771 – Impact and fix (from provided sources) Affected products (per description): Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11. Root cause: improper handling of injection of an ISINDEX element into an about:blank page, which can be exploited via vec...

CVE-2010-3775

Affected software and cause: Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, fail to properly handle certain redirections involving data: URLs and Java LiveConnect scripts, leading to the wrong security principal being used. Impact: remote attackers could start...

CVE-2012-0468

CVE-2012-0468 affects Mozilla Firefox 4.x–11.0, Thunderbird 5.0–11.0, and SeaMonkey before 2.9. The browser engine’s vulnerability is tied to vectors related to jsval.h and the js::array_shift function, leading to a potential denial of service (assertion failure and memory corruption) and possibl...

CVE-2012-1940

CVE-2012-1940 is a use-after-free in Mozilla’s browser engines. Affects Firefox 4.x–12.0, ESR 10.x prior to 10.0.5, Thunderbird 5.0–12.0, ESR 10.x prior to 10.0.5, and SeaMonkey before 2.10. The flaw is in nsFrameList::FirstChild when a container of absolutely positioned elements in a column chan...

CVE-2012-4196

CVE-2012-4196 affects Mozilla Firefox (and related Mozilla components) where a prototype property-injection attack on the Location object (window.location) bypassed Same Origin Policy. Affected are Firefox prior to 16.0.2, Firefox ESR 10.x prior to 10.0.10, Thunderbird prior to 16.0.2, Thunderbir...

CVE-2013-1702

CVE-2013-1702 affects Mozilla Firefox prior to 23.0 and SeaMonkey prior to 2.20. The vulnerabilities in the browser engine allow remote attackers to cause memory corruption and crash, with the possibility of arbitrary code execution via unknown vectors. The issue is acknowledged in multiple advis...

CVE-2006-6499

The CVE-2006-6499 entry concerns Mozilla Firefox 2.x before 2.0.0.1, Firefox 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7. The vulnerability is a memory overwrite that occurs when floating-point precision is reduced, rather than exiting safely. This can allow remot...

CVE-2008-4065

CVE-2008-4065 affects Mozilla Firefox (≤2.0.0.16, and ≤3.0.1/3.0.x before 3.0.2), Thunderbird (≤2.0.0.16), and SeaMonkey (≤1.1.11) with a BOM-based stripping issue that can bypass cross‑site scripting (XSS) protections. The root cause is removal of Stripped BOM characters from JavaScript code pri...