CVE-2008-1236

CVE-2008-1236 affects Mozilla Firefox (before 2.0.0.13), Mozilla Thunderbird (before 2.0.0.13), and SeaMonkey (before 1.1.9). The issue stems from memory-related vulnerabilities in the layout/web content processing, described as memory corruption via layout-engine interactions, allowing a remote ...

CVE-2009-2464

The CVE-2009-2464 issue affects Mozilla Firefox before 3.0.12, SeaMonkey 2.0a1pre, and Thunderbird, where nsXULTemplateQueryProcessorRDF::CheckIsSeparator can be exploited via loading multiple RDF files in a XUL tree to cause memory corruption and potential code execution, leading to DoS or crash...

CVE-2012-4184

CVE-2012-4184 affects Mozilla's COW in Firefox (and related Mozilla products) prior to version 16.0 (Firefox), ESR 10.x prior to 10.0.8, Thunderbird prior to 16.0, Thunderbird ESR 10.x prior to 10.0.8, and SeaMonkey prior to 2.13. The issue allows a crafted web site to bypass restrictions and acc...

CVE-2012-4193

CVE-2012-4193 affects Mozilla Firefox and related Mozilla products (Firefox before 16.0.1, Firefox ESR before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR before 10.0.9, SeaMonkey before 2.13.1). Root cause: a security check in the defaultValue unwrapping of security wrappers is omitted, al...

CVE-2012-4196

CVE-2012-4196 affects Mozilla Firefox (and related Mozilla components) where a prototype property-injection attack on the Location object (window.location) bypassed Same Origin Policy. Affected are Firefox prior to 16.0.2, Firefox ESR 10.x prior to 10.0.10, Thunderbird prior to 16.0.2, Thunderbir...

CVE-2013-5601

CVE-2013-5601 is a use-after-free in Mozilla Firefox’s nsEventListenerManager::SetEventHandler that could allow remote code execution. Affected products and versions include Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1 and ESR 17.x before 17.0...

CVE-2006-3113

CVE-2006-3113 affects Mozilla Firefox

CVE-2006-6499

The CVE-2006-6499 entry concerns Mozilla Firefox 2.x before 2.0.0.1, Firefox 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7. The vulnerability is a memory overwrite that occurs when floating-point precision is reduced, rather than exiting safely. This can allow remot...

CVE-2006-6504

CVE-2006-6504 affects Mozilla Firefox (2.x before 2.0.0.1, and 1.5.x before 1.5.0.9) and SeaMonkey before 1.0.7. The root cause is memory corruption triggered by appending an SVG comment DOM node to another type of document, allowing remote code execution. Connected advisories confirm fixes in co...

CVE-2008-0304

CVE-2008-0304 is a heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.12 and SeaMonkey before 1.1.8, allowing remote code execution via a crafted external-body MIME type in an email. The root cause is an incorrect memory allocation during message preview, enabling an attacker to run a...

CVE-2008-1240

Technical details for CVE-2008-1240 are not present in the connected documents. The initial description notes a jar URI content-origin parsing issue in LiveConnect affecting Firefox/SeaMonkey, but there are no accompanying technical specifics (affected product versions, root cause, or fixes) in t...

CVE-2008-2807

CVE-2008-2807 affects Mozilla Firefox <2.0.0.15 and SeaMonkey

CVE-2009-1304

CVE-2009-1304 affects the JavaScript engine in Mozilla Firefox 3.x prior to 3.0.9, Thunderbird prior to 2.0.0.22, and SeaMonkey prior to 1.1.16. The vulnerability arises from the engine’s handling of (1) js_FindPropertyHelper (related to Math and Date) and (2) js_CheckRedeclaration, enabling remo...

CVE-2009-1834

CVE-2009-1834 describes a visual truncation vulnerability in Mozilla Firefox (nsIDNService.cpp) affecting Firefox < 3.0.11 and SeaMonkey

CVE-2012-1942

CVE-2012-1942 affects Mozilla Firefox 12.0, Thunderbird 12.0 and SeaMonkey 2.9 on Windows. The root cause is the Mozilla/Windows Updater Service loading a DLL in a privileged context, enabling a local user to gain privileges by placing a malicious DLL in a privileged path before updater execution...

CVE-2013-1702

CVE-2013-1702 affects Mozilla Firefox prior to 23.0 and SeaMonkey prior to 2.20. The vulnerabilities in the browser engine allow remote attackers to cause memory corruption and crash, with the possibility of arbitrary code execution via unknown vectors. The issue is acknowledged in multiple advis...

CVE-2013-1719

CVE-2013-1719 affects Mozilla Firefox (<24.0), Thunderbird (<24.0), and SeaMonkey (

CVE-2006-0296

CVE-2006-0296 affects Mozilla Suite components including Mozilla/Firefox up to 1.5.0.1 and SeaMonkey up to 1.0. The vulnerability arises in the XULDocument.persist function where the attribute name is not validated, enabling remote attackers to inject RDF data into the user’s localstore.rdf and e...

CVE-2007-2867

CVE-2007-2867 involves multiple Mozilla components (Firefox 1.5.x before 1.5.0.12 and Firefox 2.x before 2.0.0.4, Thunderbird 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, SeaMonkey 1.0.9 and 1.1.2). The issue is described as memory-related vulnerabilities (dangling pointers, heap corruption, sig...

CVE-2009-1835

CVE-2009-1835 affects Mozilla Firefox (pre-3.0.11) and SeaMonkey (pre-1.1.17). A URL containing file:// at the start can cause the browser to associate local documents with external domain names located after the file:// substring, allowing a user-assisted remote attacker to read arbitrary cookie...

CVE-2009-1840

CVE-2009-1840 affects Mozilla Firefox (before 3.0.11), Thunderbird and SeaMonkey, where content policy checks were not performed before loading a script file into a XUL document. This allowed a crafted HTML document (e.g., via a web bug in email or a web page/ad) to bypass intended access restric...

CVE-2011-0061

CVE-2011-0061 affects Mozilla Firefox 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12. The vulnerability is a buffer overflow triggered by a crafted JPEG image, enabling remote attackers to execute arbitrary code or cause a denial of service (application crash). MITRE/O...

CVE-2012-0457

CVE-2012-0457 is a use-after-free in the Firefox DOM/SVG handling: the nsSMILTimeValueSpec::ConvertBetweenTimeContainer path can be triggered via SVG animations to allow remote code execution. Affected products and versions per sources include Mozilla Firefox before 3.6.28 and 4.x through 10.0, F...

CVE-2013-5600

CVE-2013-5600 is a use-after-free in Mozilla projects where the nsIOService::NewChannelFromURIWithProxyFlags function can be exploited via blob: URLs to execute arbitrary code. Affected packages/versions include Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbir...

CVE-2013-5610

CVE-2013-5610 is a memory-corruption vulnerability in the Mozilla Firefox browser engine (pre-26.0) and SeaMonkey (pre-2.23) with potential remote code execution via unknown vectors and denial of service. Public advisories (e.g., openSUSE/MFSA entries) indicate fixes are available by upgrading Fi...

CVE-2006-1724

CVE-2006-1724 affects Firefox and Thunderbird before 1.5.0.2, 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1. It is an unspecified vulnerability related to DHTML that can cause a denial of service (crash) and possibly remote code execution. The initial document does n...

CVE-2006-4566

CVE-2006-4566 is a heap corruption vulnerability in Mozilla family browsers caused by parsing a malformed JavaScript regular expression that ends with a backslash () in an unterminated character class (e.g., []). It affects Mozilla Firefox, Thunderbird, and SeaMonkey as listed in connected adviso...

CVE-2007-4879

CVE-2007-4879 affects Mozilla Firefox up to 2.0.0.12 (prior to 2.0.0.13) and SeaMonkey up to 1.1.8/1.1.9, allowing automatic TLS client certificate installation with minimal user interaction and automatic certificate presentation when requested. This enables cross-domain user tracking via TLS cli...

CVE-2008-1235

CVE-2008-1235 affects Mozilla Firefox <2.0.0.13, Thunderbird <2.0.0.13, and SeaMonkey

CVE-2010-3773

CVE-2010-3773 affects Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11. The flaw involves the XMLHttpRequestSpy module in the Firebug add-on mishandling interaction between the XMLHttpRequestSpy object and chrome privileged objects, allowing remote attackers to e...

CVE-2012-3963

CVE-2012-3963 is a Use-after-free in Mozilla Firefox's js::gc::MapAllocToTraceKind that can allow remote code execution. Affected: Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, SeaMonkey before 2.12. Mitigation: upgrade to Firefo...

CVE-2013-0789

CVE-2013-0789 affects Mozilla Firefox (pre-20.0) and SeaMonkey (pre-2.17) with memory-corruption/DoS and potential arbitrary-code execution via vectors related to nsContentUtils::HoldJSObjects and the nsAutoPtr class. The incident is documented across multiple feeds (Mozilla security advisories, ...

CVE-2006-3804

The CVE-2006-3804 entry describes a heap-based buffer overflow in Mozilla Thunderbird prior to 1.5.0.5 and SeaMonkey prior to 1.0.3 triggered by a VCard attachment with a malformed base64 field, due to an integer underflow, leading to a remote denial of service (crash). The vulnerability affects ...

CVE-2006-6505

CVE-2006-6505 involves multiple heap-based buffer overflows in Mozilla Thunderbird (before 1.5.0.9) and SeaMonkey (before 1.0.7). The vulnerability stems from parsing mail headers: (1) external message modies with long Content-Type headers and (2) long RFC2047-encoded (MIME non-ASCII) headers, en...

CVE-2007-1362

CVE-2007-1362 affects Mozilla Firefox 1.5.x prior to 1.5.0.12 and 2.x prior to 2.0.0.4, and SeaMonkey 1.0.9/1.1.2, enabling a remote attacker to trigger a denial of service via cookie path issues: either a very large cookie path parameter causing memory consumption or an internal delimiter in coo...

CVE-2008-2810

CVE-2008-2810 affects Mozilla Firefox prior to 2.0.0.15 and SeaMonkey prior to 1.1.10. Root cause: improper identification of the context of Windows shortcut files, enabling a user-assisted remote attacker to bypass the Same Origin Policy via a crafted site for which the user has saved a shortcut...

CVE-2008-4065

CVE-2008-4065 affects Mozilla Firefox (≤2.0.0.16, and ≤3.0.1/3.0.x before 3.0.2), Thunderbird (≤2.0.0.16), and SeaMonkey (≤1.1.11) with a BOM-based stripping issue that can bypass cross‑site scripting (XSS) protections. The root cause is removal of Stripped BOM characters from JavaScript code pri...

CVE-2010-3778

The CVE-2010-3778 issue affects Mozilla Firefox 3.5.x before 3.5.16 , Thunderbird before 3.0.11 , and SeaMonkey before 2.0.11 . It is described as an unspecified vulnerability allowing remote attackers to cause memory corruption and an application crash, potentially enabling arbitrary code execut...

CVE-2011-0058

CVE-2011-0058 describes a buffer overflow in Mozilla Firefox (before 3.5.17 and 3.6.x before 3.6.14) and SeaMonkey (before 2.0.12) on Windows. A long string can trigger construction of a long text run, leading to remote code execution or memory corruption and potential denial of service. Affected...

CVE-2011-2985

CVE-2011-2985 affects Mozilla Firefox 4.x–5, Thunderbird before 6, and SeaMonkey 2.x before 2.3. The issue is described as memory corruption/memory safety hazards in the browser engine that could cause a crash or remote code execution via unspecified vectors. Connected documents corroborate invol...

CVE-2012-1953

CVE-2012-1953 affects Mozilla Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11. The ElementAnimations::EnsureStyleRuleFor function can cause denial of service (buffer over-read, incorrect pointer dereference, hea...

CVE-2012-4179

CVE-2012-4179 is a use-after-free in Mozilla Firefox's nsHTMLCSSUtils::CreateCSSPropertyTxn that can lead to code execution or heap memory corruption. Affected are Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey befor...

CVE-2012-4183

CVE-2012-4183 is a use-after-free in DOMSVGTests::GetRequiredFeatures affecting Firefox before 16.0, Firefox ESR before 10.0.8, Thunderbird before 16.0, and SeaMonkey before 2.13, with potential for remote code execution or a denial of service via heap memory corruption. Connected advisories from...

CVE-2013-0784

CVE-2013-0784 is one of multiple memory-safety vulnerabilities affecting Mozilla Firefox, Thunderbird, and SeaMonkey. The connected advisories (Ubuntu USN-1729-2 and related GLSA/Nessus entries) document memory corruption risks that could lead to denial of service or potentially arbitrary code ex...

CVE-2014-1519

CVE-2014-1519 refers to multiple vulnerabilities in Mozilla Firefox (browser engine) prior to 29.0 and SeaMonkey prior to 2.26. The core issue is memory corruption that can cause a denial of service or possibly allow arbitrary code execution via unknown vectors. The connected documents corroborat...

CVE-2006-1729

CVE-2006-1729 affects Mozilla Firefox 1.x (before 1.5.0.2) and 1.0.x (before 1.0.8), Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1. The vulnerability lets remote attackers read arbitrary files by abusing input controls: (1) insert the target filename into a text box and convert that box...

CVE-2008-4068

CVE-2008-4068 is a directory-traversal vulnerability in Mozilla Firefox (pre-2.0.0.17 and 3.x pre-3.0.2), Thunderbird (pre-2.0.0.17), and SeaMonkey (pre-1.1.12) triggered by crafted resource: URIs. The flaw lets remote attackers bypass local HTML restrictions, read sensitive information, and prom...

CVE-2010-3770

CVE-2010-3770 refers to multiple XSS vulnerabilities in the Mozilla Firefox/SeaMonkey rendering engine. The issue allows remote attackers to inject arbitrary scripts via certain character encodings: x-mac-arabic, x-mac-farsi, or x-mac-hebrew, which may be converted to angle brackets during render...

CVE-2006-6498

CVE-2006-6498 is a vulnerability in the JavaScript engine affecting multiple Mozilla-era products (Firefox, SeaMonkey, Thunderbird) that could lead to memory corruption, crash, and potential remote code execution. Public advisories indicate fixes are delivered through updated Firefox/SeaMonkey/Th...

CVE-2007-5960

CVE-2007-5960 affects SeaMonkey (and Firefox) where the Referer header is set to the script window/frame instead of the content initiator, enabling spoofing of Referer-based CSRF protections. The vulnerability arises from a race condition when window.location is set, potentially causing a CSRF at...