CVE-2010-0654

CVE-2010-0654 affects Mozilla family: Firefox 3.5.x up to 3.5.10 and 3.6.x up to 3.6.6, Thunderbird 3.0.x up to 3.0.5 and 3.1.x up to 3.1.0, and SeaMonkey before 2.0.6. The root cause is cross-origin loading of CSS stylesheets when the stylesheet download has an incorrect MIME type and the styles...

CVE-2010-3169

CVE-2010-3169 affects Mozilla's browser engine across multiple products: Firefox ≤ 3.5.11 (and 3.6.x prior to 3.6.9), Thunderbird ≤ 3.0.6 (and 3.1.x prior to 3.1.3), and SeaMonkey ≤ 2.0.6 (prior to 2.0.7). The issue is described as memory safety vulnerabilities in the browser engine that could al...

CVE-2014-1523

CVE-2014-1523 is a heap-based buffer overflow in the read_u32 function of Mozilla Firefox that can be triggered by a crafted JPEG image. Affected software per the description includes Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26, with remot...

CVE-2009-3979

CVE-2009-3979 affects Mozilla products including Firefox (before 3.0.16 and 3.5.x before 3.5.6), SeaMonkey (before 2.0.1), and Thunderbird according to the initial description and connected advisories. The vulnerability allows a remote attacker to cause memory corruption and application crashes o...

CVE-2010-2752

CVE-2010-2752 is an integer overflow in Mozilla’s CSS handling that affects Firefox 3.5.x (before 3.5.11), Firefox 3.6.x (before 3.6.7), Thunderbird 3.0.x (before 3.0.6), Thunderbird 3.1.x (before 3.1.1), and SeaMonkey before 2.0.6. The issue arises in an array class used to store CSS values, tie...

CVE-2012-3960

CVE-2012-3960 is a use-after-free in mozSpellChecker::SetCurrentDictionary that affects Mozilla Firefox <15.0, Firefox ESR <10.0.7, Thunderbird <15.0 / ESR, and SeaMonkey

CVE-2013-1725

CVE-2013-1725 affects Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21. The issue is that initialization of JavaScript objects with compartments may not occur, allowing remote attackers to execute a...

CVE-2014-1513

The CVE-2014-1513 issue affects Mozilla Firefox (and related Mozilla suite components) prior to version 28.0, and Firefox ESR 24.x prior to 24.4, with Firefox/SeaMonkey/Thunderbird affecting ArrayBuffer usage. Root cause: TypedArrayObject mishandles a zero-length transition during ArrayBuffer use...

CVE-2006-0297

CVE-2006-0297 involves integer overflow vulnerabilities in Mozilla-based products. Affects Mozilla Firefox 1.5, Thunderbird 1.5, and SeaMonkey before 1.0 when JavaScript is enabled in mail. The issues stem from three vulnerable code paths: (1) EscapeAttributeValue in jsxml.c (E4X), (2) nsSVGCairo...

CVE-2012-0470

The CVE-2012-0470 issue affects Mozilla Firefox 4.x–11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0–11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9. It is a heap-based buffer overflow in nsSVGFEDiffuseLightingElement::LightPixel caused by the use of different number syste...

CVE-2012-3969

CVE-2012-3969 is an integer overflow in the nsSVGFEMorphologyElement::Filter function of Mozilla Firefox (and related Mozilla apps) prior to version 15.0, Firefox ESR 10.x prior to 10.0.7, and corresponding Thunderbird/SeaMonkey builds. Assigned impact is a heap-based buffer overflow that enables...

CVE-2012-3986

CVE-2012-3986 affects Mozilla Firefox prior to 16.0 (and Firefox ESR 10.x prior to 10.0.8), Thunderbird prior to 16.0, and SeaMonkey before 2.13. The root cause is that certain DOMWindowUtils (nsDOMWindowUtils) methods were not protected by security checks, allowing remote JavaScript to bypass in...

CVE-2013-1709

CVE-2013-1709 is a Firefox/XUL/SeaMonkey family XSS issue caused by improper handling of FRAME elements and history, allowing remote attackers to spoof a relative location in a previously visited document. Affected products are Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderb...

CVE-2009-1306

CVE-2009-1306 affects Mozilla Firefox (before 3.0.9), Thunderbird, and SeaMonkey due to an improper handling of the Content-Disposition header in inner jar: URIs. The inner URI’s Content-Disposition: attachment can enable remote XSS and possibly other attacks when a malicious .jar is uploaded. Co...

CVE-2010-3167

CVE-2010-3167 : The nsTreeContentView in Mozilla Firefox (before 3.5.12 and 3.6.x before 3.6.9), Thunderbird (before 3.0.7 and 3.1.x before 3.1.3), and SeaMonkey (before 2.0.7) contains a dangling-pointer vulnerability in XUL trees when removing nodes. This could allow remote attackers to execute...

CVE-2012-0442

CVE-2012-0442 covers multiple memory-safety vulnerabilities in the Mozilla browser engine affecting Firefox before 3.6.26 and 4.x–9.0, Thunderbird before 3.1.18 and 5.0–9.0, and SeaMonkey before 2.7. The issues can cause memory corruption, application crashes, or potentially remote code execution...

CVE-2012-3978

CVE-2012-3978 affects Mozilla Firefox (and related Mozilla components) where nsLocation::CheckURL does not properly follow the location object security model, enabling remote attackers to bypass content-loading restrictions via chrome code vectors. MiracleLinux advisories list this as part of mul...

CVE-2013-1735

CVE-2013-1735 : A use-after-free in Mozilla's ScrollbarActivity in Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code via image-document scrolling vectors. Ex...

CVE-2009-0775

CVE-2009-0775 is a Mozilla Firefox/Thunderbird/SeaMonkey vulnerability described in the MiracleLinux AXSA advisory as a Double free in cloned XUL DOM elements linked as parent/child that are mishandled during garbage collection. A remote attacker could potentially execute arbitrary code by crafti...

CVE-2010-1198

CVE-2010-1198 is a use-after-free vulnerability in Mozilla Firefox 3.5.x before 3.5.10 and Firefox 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, which allows remote attackers to execute arbitrary code via vectors involving multiple plugin instances. The connected Nessus entries corroborate the ...

CVE-2012-3966

CVE-2012-3966 affects Mozilla Firefox and related Mozilla products (Firefox before 15.0, Firefox ESR before 10.0.7, Thunderbird before 15.0, SeaMonkey before 2.12). The vulnerability arises from a negative height value in a BMP image inside a .ICO file, related to improper handling of the transpa...

CVE-2013-5613

Mode C: Detailed vulnerability note for CVE-2013-5613. Affected product/variant: Mozilla Firefox components shipped in MiracleLinux 3 (firefox-24.4.0-1.0.1.AXS3) per AXSA:2014-233:01. Root cause: Use-after-free in PresShell::DispatchSynthMouseMove, linked to RestyleManager::GetHoverGeneration, en...

CVE-2013-5616

CVE-2013-5616 is a use-after-free in Mozilla Firefox before 26.0 (also affects ESR 24.x before 24.2, Thunderbird before 24.2, SeaMonkey before 2.23) triggered by nsEventListenerManager::HandleEventSubType. Exploitation could lead to remote code execution or a denial of service due to heap memory ...

CVE-2014-1487

CVE-2014-1487 affects Mozilla Firefox (Web workers) and related Mozilla suite components. The issue allows remote attackers to bypass Same Origin Policy and obtain sensitive authentication data via error-message handling in Web workers, affecting Firefox versions before 27.0 (and ESR 24.x before ...

CVE-2014-8636

CVE-2014-8636 affects Mozilla Firefox and SeaMonkey through an information flow bug in the XrayWrapper. The issue arises when interacting with a DOM object that has a named getter, allowing a remote attacker to cause arbitrary JavaScript execution with chrome privileges via unspecified vectors. A...

CVE-2009-0352

CVE-2009-0352 affects Mozilla Firefox 3.x <= 3.0.5, Mozilla Thunderbird <= 2.0.0.20, and SeaMonkey

CVE-2009-0772

Mode C: CVE-2009-0772 affects Mozilla-based products via memory corruption triggered by nsCSSStyleSheet::GetOwnerNode, related to events and Garbage Collection. Affected software includes Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15. Outcome: remote deni...

CVE-2010-1125

CVE-2010-1125 affects Mozilla Firefox 3.x (before 3.5.10) and 3.6.x (before 3.6.4), and SeaMonkey before 2.0.5. The vulnerability arises in the JavaScript focus handling: a call to focus can cause keystrokes intended for a visible form field to be delivered to a hidden frame, enabling remote expl...

CVE-2010-3179

CVE-2010-3179 : Stack-based buffer overflow in Firefox’s text rendering when a very long argument is passed to document.write. Affects Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9. Remediation per MFSA advisory:...

CVE-2010-3183

CVE-2010-3183 affects Mozilla-based products (Firefox/Thunderbird/SeaMonkey/XULRunner) where the LookupGetterOrSetter function in the browser’s JavaScript engine mishandles calls to window.lookupGetter with no arguments. The root cause is an incorrect pointer handling that can dereference a dangl...

CVE-2013-0755

CVE-2013-0755 refers to a use-after-free in the mozVibrate implementation of the Vibrate library in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. The vulnerability allows remote code execution...

CVE-2013-0780

CVE-2013-0780 is a use-after-free vulnerability in Mozilla Firefox related to the nsOverflowContinuationTracker::Finish function. It affects Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. An attacker c...

CVE-2013-0791

The connected Nessus advisories confirm CVE-2013-0791 affects Mozilla NSS and upstream products via CERT_DecodeCertPackage, allowing remote doS through out-of-bounds reads and memory corruption when processing crafted certificates. Affected: NSS libraries and apps (Firefox before 20.0, ESR 17.x b...

CVE-2010-2767

CVE-2010-2767 is a dangling-pointer vulnerability in Mozilla’s navigator.plugins handling. The issue occurs when the DOM plugin array is destroyed but a pointer to it remains, potentially allowing a remote attacker to crash the browser or execute arbitrary code. Affected products and versions (pe...

CVE-2010-2769

CVE-2010-2769 is a cross-site scripting (XSS) vulnerability affecting Mozilla Firefox (before 3.5.12 and 3.6.x before 3.6.9), Thunderbird (before 3.0.7 and 3.1.x before 3.1.3), and SeaMonkey (before 2.0.7). The issue arises when a selection is added to a document with designMode enabled, allowing...

CVE-2010-3173

CVE-2010-3173 affects Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9. Root cause: the SSL DHE (Diffie-Hellman Ephemeral) implementation does not properly enforce a safe minimum DH key length, enabling brute-force ...

CVE-2013-0768

Technical details for CVE-2013-0768 are not publicly available in the provided documents. Monitor for updates.

CVE-2013-1722

CVE-2013-1722 describes a use-after-free in nsAnimationManager::BuildAnimations within the Mozilla Firefox animation system. The vulnerability affects Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.2...

CVE-2013-5590

CVE-2013-5590 affects Mozilla Firefox and related products (Firefox/ESR, Thunderbird, SeaMonkey). The Mozilla browser engine and associated components contain memory corruption/denial-of-service vulnerabilities that could lead to arbitrary code execution via unspecified vectors. Public advisories...

CVE-2014-8638

CVE-2014-8638 affects Firefox up to 35.0 (ESR 31.x before 31.4), Thunderbird before 31.4, and SeaMonkey before 2.32. The navigator.sendBeacon implementation omits the CORS Origin header, allowing remote attackers to bypass intended CORS checks and conduct cross-site request forgery via a crafted ...

CVE-2014-8641

CVE-2014-8641 is a use-after-free in Mozilla Firefox’s WebRTC track data handling (affecting Firefox up to version 35.0 and Firefox ESR up to 31.x <31.4, and SeaMonkey

CVE-2008-5913

CVE-2008-5913 affects Mozilla Firefox 3.5.x before 3.5.10 and Firefox 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, where the JavaScript Math.random RNG is seeded only once per browser session. This enables in-session tracking and user-targeted phishing via spoofed pop-ups. The vulnerability is...

CVE-2010-1585

CVE-2010-1585 affects Mozilla Firefox (ParanoidFragmentSink) where nsIScriptableUnescapeHTML.parseFragment fails to sanitize chrome HTML, enabling remote JavaScript execution via javascript: URIs in input to extensions. Affected products/versions: Firefox <3.5.17 and <3.6.14; SeaMonkey <...

CVE-2010-2768

CVE-2010-2768 affects Mozilla Firefox (before 3.5.12 and 3.6.x before 3.6.9), Thunderbird (before 3.0.7 and 3.1.x before 3.1.3), and SeaMonkey (before 2.0.7). Root cause: Object tag type attribute not properly restricted when setting a document charset, enabling UTF-7 encoded payloads to bypass X...

CVE-2013-0760

CVE-2013-0760 describes a buffer overflow in Mozilla Firefox’s CharDistributionAnalysis::HandleOneChar, allowing remote code execution via a crafted document. Affected products per the description: Firefox before 18.0, Thunderbird before 17.0.2, and SeaMonkey before 2.15. Root cause is a memory c...

CVE-2013-1730

CVE-2013-1730 affects Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0/ESR 17.x before 17.0.9, and SeaMonkey before 2.21. A crafted web site can move XBL-backed nodes across documents, enabling remote code execution or a denial of service (JavaScript compartmen...

CVE-2010-1213

The CVE-2010-1213 vulnerability affects Mozilla Firefox (3.5.x before 3.5.11; 3.6.x before 3.6.7), Thunderbird (3.0.x before 3.0.6; 3.1.x before 3.1.1), and SeaMonkey before 2.0.6. The importScripts Web Worker method does not verify that content is valid JavaScript, allowing remote attackers to b...

CVE-2010-3176

CVE-2010-3176 affects Mozilla products including Firefox (3.5.x before 3.5.14 and 3.6.x before 3.6.11), Thunderbird (before 3.0.9 and before 3.1.5), and SeaMonkey (before 2.0.9). The issue is described as multiple unspecified vulnerabilities in the browser engine that could allow remote attackers...

CVE-2012-0449

CVE-2012-0449 affects Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7. Description: remote attackers can cause memory corruption and application crash, or possibly execute arbitrary code via a malformed XSLT stylesheet emb...

CVE-2012-0467

CVE-2012-0467 is reflected in multiple Nessus/MiracleLinux advisories for Mozilla Firefox 4.x–11.0, Firefox ESR 10.x (before 10.0.4), Thunderbird 5.0–11.0, Thunderbird ESR 10.x (before 10.0.4), and SeaMonkey before 2.9. The Connected documents describe a set of memory-safety and control-flow vuln...