CVE-2008-5501

CVE-2008-5501 affects Mozilla’s web components used by Firefox 3.x (before 3.0.5), Thunderbird 2.x (before 2.0.0.19), and SeaMonkey 1.x (before 1.1.14). The vulnerability arises from the layout engine, where certain inputs can trigger an assertion failure, leading to a denial of service. Exploita...

CVE-2013-0784

CVE-2013-0784 is one of multiple memory-safety vulnerabilities affecting Mozilla Firefox, Thunderbird, and SeaMonkey. The connected advisories (Ubuntu USN-1729-2 and related GLSA/Nessus entries) document memory corruption risks that could lead to denial of service or potentially arbitrary code ex...

CVE-2013-6674

CVE-2013-6674 is an XSS vulnerability in Mozilla Thunderbird 17.x up to 17.0.8, Thunderbird ESR 17.x up to 17.0.10, and SeaMonkey before 2.20. The issue is triggered by an email containing a data: URL inside an IFRAME, allowing a user‑assisted remote attacker to inject arbitrary web script/HTML. ...

CVE-2006-4566

CVE-2006-4566 is a heap corruption vulnerability in Mozilla family browsers caused by parsing a malformed JavaScript regular expression that ends with a backslash () in an unterminated character class (e.g., []). It affects Mozilla Firefox, Thunderbird, and SeaMonkey as listed in connected adviso...

CVE-2008-4582

CVE-2008-4582 describes an information leak through local Windows shortcut files (.url) that could bypass Same Origin Policy and disclose data via an HTML document. Publicly documented details indicate affected products include Mozilla Firefox 3.0.1–3.0.3, Firefox 2.x prior to 2.0.0.18, and SeaMo...

CVE-2009-3987

CVE-2009-3987 affects Mozilla Firefox (before 3.0.16 and 3.5.x before 3.5.6) and SeaMonkey (before 2.0.1); the GeckoActiveXObject function returns different exception messages based on whether a ProgID is listed in the registry, enabling remote attackers to infer installed software via multiple c...

CVE-2010-2751

Summary: CVE-2010-2751 affects Mozilla Firefox (3.5.x before 3.5.11; 3.6.x before 3.6.7) and SeaMonkey (before 2.0.6). The issue arises in nsDocShell::OnRedirectStateChange, where a sequence of redirects plus history.back/history.forward can cause a document’s SSL security status to be spoofed to...

CVE-2011-0058

CVE-2011-0058 describes a buffer overflow in Mozilla Firefox (before 3.5.17 and 3.6.x before 3.6.14) and SeaMonkey (before 2.0.12) on Windows. A long string can trigger construction of a long text run, leading to remote code execution or memory corruption and potential denial of service. Affected...

CVE-2011-2985

CVE-2011-2985 affects Mozilla Firefox 4.x–5, Thunderbird before 6, and SeaMonkey 2.x before 2.3. The issue is described as memory corruption/memory safety hazards in the browser engine that could cause a crash or remote code execution via unspecified vectors. Connected documents corroborate invol...

CVE-2012-5843

CVE-2012-5843 affects Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14. The vulnerability is described as unspecified memory safety hazards in the browser engine that could lead to memory corruption and a crash (DoS) or, potentially, arbitrary code execution via unk...

CVE-2013-0781

CVE-2013-0781 is a use-after-free in Mozilla’s nsPrintEngine::CommonPrint that affects Firefox, Thunderbird, and SeaMonkey versions prior to their listed fixes (Firefox before 19.0, Thunderbird before 17.0.3, SeaMonkey before 2.16). The underlying issue is a heap memory corruption/use-after-free ...

CVE-2014-1496

CVE-2014-1496 affects Mozilla Firefox (up to 28.0) and related Mozilla suite components (Firefox ESR 24.x up to 24.4, Thunderbird up to 24.4, SeaMonkey up to 2.25). The vulnerability allows local users to gain privileges by modifying the extracted Mar contents during an update, constituting a loc...

CVE-2006-1740

CVE-2006-1740 affects Mozilla-derived browsers, allowing remote attackers to spoof secure site indicators (e.g., the lock icon) by abusing a popup window that loads the trusted site and then navigates to a malicious site. Affected products include Firefox 1.x prior to 1.5 and 1.0.x prior to 1.0.8...

CVE-2006-6500

CVE-2006-6500 describes a heap-based buffer overflow in Mozilla-related products. A remote attacker could crash the application or possibly execute arbitrary code by crafting CSS cursor images that trigger an incorrect Windows bitmap size calculation during conversion. Affected software per the d...

CVE-2007-1362

CVE-2007-1362 affects Mozilla Firefox 1.5.x prior to 1.5.0.12 and 2.x prior to 2.0.0.4, and SeaMonkey 1.0.9/1.1.2, enabling a remote attacker to trigger a denial of service via cookie path issues: either a very large cookie path parameter causing memory consumption or an internal delimiter in coo...

CVE-2008-0420

The CVE-2008-0420 issue affects Mozilla Firefox (before 2.0.0.12), Mozilla Thunderbird (before 2.0.0.12), and SeaMonkey (before 1.1.8). It stems from incorrect calculations in the BMP decoder (nsBMPDecoder.cpp) related to the mColors table for 8-bit BMPs, enabling an out-of-bounds read of heap me...

CVE-2010-3770

CVE-2010-3770 refers to multiple XSS vulnerabilities in the Mozilla Firefox/SeaMonkey rendering engine. The issue allows remote attackers to inject arbitrary scripts via certain character encodings: x-mac-arabic, x-mac-farsi, or x-mac-hebrew, which may be converted to angle brackets during render...

CVE-2006-1530

Technical details for CVE-2006-1530 are not publicly available in the provided documents. Monitor for updates.

CVE-2006-3812

CVE-2006-3812 affects Mozilla Firefox prior to 1.5.0.5, Thunderbird prior to 1.5.0.5, and SeaMonkey prior to 1.0.3. The flaw allows a remote attacker to trick a user into copying or dragging a link to reference remote files and potentially load chrome: URLs, leading to partial confidentiality/int...

CVE-2006-6498

CVE-2006-6498 is a vulnerability in the JavaScript engine affecting multiple Mozilla-era products (Firefox, SeaMonkey, Thunderbird) that could lead to memory corruption, crash, and potential remote code execution. Public advisories indicate fixes are delivered through updated Firefox/SeaMonkey/Th...

CVE-2008-2801

CVE-2008-2801 affects Mozilla Firefox (pre-2.0.0.15) and SeaMonkey (pre-1.1.10) due to a flaw in JAR signing implementation that allows remote attackers to run arbitrary code via JavaScript in a JAR or via a JAR archive using relative URLs to JavaScript files. The underlying issue is improper han...

CVE-2008-5013

CVE-2008-5013 affects Mozilla Firefox 2.x (pre-2.0.0.18) and SeaMonkey 1.x (pre-1.1.13). The issue arises when the Flash module is dynamically unloaded via an outside JavaScript function, leading to an access of an expired memory address and allowing remote code execution with a crafted SWF file....

CVE-2010-1201

CVE-2010-1201 affects Mozilla Firefox 3.5.x before 3.5.10, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5. The vulnerability is described as an unspecified memory corruption in the browser engine that could allow a remote attacker to cause a denial of service or potentially execute arbitrar...

CVE-2011-3001

CVE-2011-3001 affects Mozilla Firefox 4.x–6, Thunderbird before 7.0, and SeaMonkey before 2.4. The issue allows a user-assisted remote bypass of access restrictions by triggering an internal error on a crafted site that triggers adding a browser extension through a holding Enter key sequence. The...

CVE-2012-4179

CVE-2012-4179 is a use-after-free in Mozilla Firefox's nsHTMLCSSUtils::CreateCSSPropertyTxn that can lead to code execution or heap memory corruption. Affected are Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey befor...

CVE-2012-4195

CVE-2012-4195 concerns Mozilla Firefox (and related Mozilla components) where nsLocation::CheckURL does not correctly determine the calling document/principal, enabling cross-site scripting (XSS) via crafted sites and certain add-on behaviors. Affected products/versions include Firefox before 16....

CVE-2006-6502

CVE-2006-6502 is a use-after-free vulnerability in the LiveConnect bridge code affecting Mozilla Firefox 2.x (before 2.0.0.1), Mozilla Firefox 1.5.x (before 1.5.0.9), SeaMonkey (before 1.0.7), and Thunderbird (before 1.5.0.9). It allows remote attackers to cause a crash (denial of service) via un...

CVE-2014-1478

This CVE (CVE-2014-1478) affects Mozilla Firefox before 27.0 and SeaMonkey before 2.24. The issue involves memory corruption in the browser engine (MPostWriteBarrier in js/src/jit/MIR.h and stack alignment in js/src/jit/AsmJS.cpp in OdinMonkey) and may allow remote code execution or cause a crash...

CVE-2010-3181

CVE-2010-3181 pertains to an untrusted search path (DLL loading) vulnerability in Mozilla Firefox (pre-3.5.14), Firefox 3.6.x (pre-3.6.11), Thunderbird (pre-3.0.9 and pre-3.1.5), and SeaMonkey (pre-2.0.9) on Windows. The root cause is Trojan horse DLLs loaded from the current working directory, e...

CVE-2012-1941

CVE-2012-1941 corresponds to a heap-based buffer overflow in Mozilla Firefox/Thunderbird/SeaMonkey components (nsHTMLReflowState::CalculateHypotheticalBox) that can be triggered when resizing a window displaying absolutely positioned and relatively positioned elements in nested columns. Affected ...

CVE-2007-1282

CVE-2007-1282 is a reported integer/buffer overflow in Mozilla Thunderbird (pre-1.5.0.10) and SeaMonkey (pre-1.0.8) triggered by extremely long lines in text/enhanced or text/richtext emails, allowing potential remote code execution. Connected advisories (Red Hat RHSA-2007:0108/0078/0077 and rela...

CVE-2008-0413

CVE-2008-0413 affects the JavaScript engine in Mozilla Firefox < 2.0.0.12, Thunderbird < 2.0.0.12, and SeaMonkey

CVE-2009-3982

The CVE-2009-3982 entry concerns Mozilla Firefox 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird, where exposure is via the JavaScript engine. The connected documents confirm a memory-corruption impact in the JS engine that could allow remote code execution or a crash, caused by unspe...

CVE-2013-5591

CVE-2013-5591 affects Mozilla Firefox before 25.0 (and ESR 24.x before 24.1), Thunderbird before 24.1, and SeaMonkey before 2.22, due to an unspecified browser‑engine vulnerability that could allow a remote attacker to cause memory corruption and an application crash, or possibly execute arbitrar...

CVE-2006-2777

CVE-2006-2777 is a remote-code-execution issue in Mozilla Firefox up to 1.5.0.3/1.5.x and SeaMonkey up to 1.0.1/1.0.x via nsISelectionPrivate: a SelectionListener/notifications flow executes in a privileged context. Affected products: Firefox before 1.5.0.4 and SeaMonkey before 1.0.2. Root cause:...

CVE-2008-2806

CVE-2008-2806 affects Mozilla Firefox <= 2.0.0.15 and SeaMonkey

CVE-2012-0443

CVE-2012-0443 affects Mozilla Firefox (4.x–9.0), Thunderbird (5.0–9.0) and SeaMonkey prior to 2.7. The browser engine vulnerabilities allow remote attackers to cause memory corruption, crash the application, or potentially execute arbitrary code via unknown vectors; several advisories reference t...

CVE-2012-0450

Mozilla Firefox (Linux/macOS) and SeaMonkey

CVE-2012-1964

CVE-2012-1964 corresponds to the certificate-warning clickjacking issue in Mozilla Firefox (4.x–12.0), Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–12.0, and SeaMonkey before 2.10. The vulnerability arises from improper handling of clickjacking on the about:certerror page, allowing a MITM atta...

CVE-2012-4217

CVE-2012-4217 is a use-after-free in Mozilla Firefox <17.0, Thunderbird <17.0, and SeaMonkey

CVE-2014-1494

CVE-2014-1494 concerns multiple memory-safety vulnerabilities in the browser engine of Mozilla Firefox prior to 28.0 and SeaMonkey prior to 2.25, with remote denial of service or potential arbitrary code execution via unknown vectors. The connected docs confirm that these issues are part of MFSA ...

CVE-2007-0778

CVE-2007-0778 affects Mozilla Firefox (and related Gecko-based browsers like SeaMonkey) prior to 1.5.0.10 / 2.x before 2.0.0.2, and SeaMonkey before 1.0.8. The vulnerability stems from the page cache implementation, where hash collisions can cause page data to be appended to the wrong cache entry...

CVE-2007-1092

CVE-2007-1092 affects Mozilla Firefox 1.5.0.9 and 2.0.0.1 and SeaMonkey before 1.0.8. The issue stems from JavaScript onUnload handlers that can modify the document structure, causing memory corruption due to the absence of a finalize hook on DOM window objects, enabling remote code execution. Re...

CVE-2007-2868

This CVE-2007-2868 entry concerns memory corruption in the JavaScript engine of Mozilla-derived products. Affected software includes Mozilla Firefox 1.5.x up to 1.5.0.12 and 2.x up to 2.0.0.4, Thunderbird 1.5.x up to 1.5.0.12 and 2.x up to 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2. Exploitation coul...

CVE-2008-2808

Vulnerability CVE-2008-2808 affects Mozilla Firefox <2.0.0.15 and SeaMonkey

CVE-2010-0163

CVE-2010-0163 affects SeaMonkey before 1.1.19 and Mozilla Thunderbird before 2.0.0.24. The issue stems from a mail-attachment parser that performs casts and line termination incorrectly, enabling a remote attacker to crash the application or potentially execute arbitrary code via a crafted messag...

CVE-2011-0076

CVE-2011-0076 affects the Java Embedding Plugin (JEP) in Mac OS X builds of Firefox (before 3.5.19 and Firefox 3.6.x before 3.6.17) and SeaMonkey (before 2.0.14). The MFSA advisory indicates this could be exploited to obtain elevated access to a user’s resources. Open discussions in connected doc...

CVE-2008-1241

CVE-2008-1241 describes a GUI overlay vulnerability in Mozilla Firefox up to 2.0.0.13 and SeaMonkey up to 1.1.9. A borderless XUL pop-up window opened from a background tab could spoof form elements and redirect user inputs, exposing users to UI manipulation. The issue is tied to how the browser ...

CVE-2008-5052

Mozilla Firefox 2.x (pre-2.0.0.18), Thunderbird 2.x (pre-2.0.0.18), and SeaMonkey 1.x (pre-1.1.13) are affected by CVE-2008-5052. The vulnerability arises in AppendAttributeValue in the JavaScript engine and is described as memory corruption that can cause a remote crash (Denial of Service) via u...

CVE-2010-0161

CVE-2010-0161 affects Thunderbird (before 2.0.0.24) and SeaMonkey (before 1.1.19) on Windows, where the nsAuthSSPI::Unwrap function in extensions/auth/nsAuthSSPI.cpp can be triggered by data from a remote SMTP/IMAP/POP server using SSPI. This may cause heap memory corruption and application crash...