CVE-2014-1530

CVE-2014-1530 affects Mozilla Firefox family components (Firefox before 29.0, ESR 24.x before 24.5, Thunderbird before 24.5, SeaMonkey before 2.26). The issue arises in the docshell loading logic: a crafted site performing history navigation can set a spoofed baseURI, enabling cross-site scriptin...

CVE-2012-3972

CVE-2012-3972 affects the XSLT format-number functionality in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. The vulnerability allows remote attackers to obtain sensitive information via unspecif...

CVE-2013-0787

CVE-2013-0787 is a Use-after-free in Mozilla Firefox’s editor component (nsEditor::IsPreformatted) that could allow remote code execution. Affected: Firefox <19.0.2, Firefox ESR <17.0.4, Thunderbird <17.0.4, Thunderbird ESR <17.0.4, and SeaMonkey

CVE-2013-1709

CVE-2013-1709 is a Firefox/XUL/SeaMonkey family XSS issue caused by improper handling of FRAME elements and history, allowing remote attackers to spoof a relative location in a previously visited document. Affected products are Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderb...

CVE-2013-1714

CVE-2013-1714 concerns Mozilla Firefox and related Mozilla components. The affected products are Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20. Root cause (per the connected MiracleLinux/Nessus entry):...

CVE-2014-1481

CVE-2014-1481 affects Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24. It enables remote attackers to bypass restrictions on window objects by exploiting inconsistencies in native JavaScript engine getter methods. Impact per sources is...

CVE-2014-1524

CVE-2014-1524 is reported in several Nessus entries tied to Mozilla Firefox components. Affected: Mozilla Firefox (before 29.0), Firefox ESR 24.x (before 24.5), Thunderbird (before 24.5), and SeaMonkey (before 2.26). Root cause: nsXBLProtoImpl::InstallImplementation does not reliably verify that ...

CVE-2012-0467

CVE-2012-0467 is reflected in multiple Nessus/MiracleLinux advisories for Mozilla Firefox 4.x–11.0, Firefox ESR 10.x (before 10.0.4), Thunderbird 5.0–11.0, Thunderbird ESR 10.x (before 10.0.4), and SeaMonkey before 2.9. The Connected documents describe a set of memory-safety and control-flow vuln...

CVE-2012-0470

The CVE-2012-0470 issue affects Mozilla Firefox 4.x–11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0–11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9. It is a heap-based buffer overflow in nsSVGFEDiffuseLightingElement::LightPixel caused by the use of different number syste...

CVE-2013-0783

CVE-2013-0783 refers to multiple unspecified vulnerabilities in the Mozilla Firefox browser engine (Firefox <19.0, ESR 17.x <17.0.3, Thunderbird <17.0.3, SeaMonkey

CVE-2013-1735

CVE-2013-1735 : A use-after-free in Mozilla's ScrollbarActivity in Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code via image-document scrolling vectors. Ex...

CVE-2010-1199

CVE-2010-1199 : Integer overflow in the XSLT node sorting implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5 allows remote attackers to execute arbitrary code via a large text value for a node. Affected products are t...

CVE-2012-3960

CVE-2012-3960 is a use-after-free in mozSpellChecker::SetCurrentDictionary that affects Mozilla Firefox <15.0, Firefox ESR <10.0.7, Thunderbird <15.0 / ESR, and SeaMonkey

CVE-2012-4194

The CVE-2012-4194 issue affects Mozilla Firefox and related Mozilla components where the valueOf shadowing of the location object (window.location) enables cross-site scripting via plugin vectors. Affected software and versions (stated in the provided sources) include: Mozilla Firefox before 16.0...

CVE-2013-0747

Technical details for CVE-2013-0747 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2014-1587

CVE-2014-1587 affects Mozilla Firefox before 34.0, Firefox ESR before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31. It stems from memory safety bugs in the browser engine that can be exploited remotely to cause memory corruption, denial of service, or possibly arbitrary code execution...

CVE-2010-0173

CVE-2010-0173 affects Mozilla Firefox before 3.5.9 and 3.6.x before 3.6.2, Thunderbird before 3.0.4, and SeaMonkey before 2.0.4. The issue is memory corruption in the browser engine that can cause denial of service or potentially allow remote code execution. Mitigation per connected docs: upgrade...

CVE-2010-0654

CVE-2010-0654 affects Mozilla family: Firefox 3.5.x up to 3.5.10 and 3.6.x up to 3.6.6, Thunderbird 3.0.x up to 3.0.5 and 3.1.x up to 3.1.0, and SeaMonkey before 2.0.6. The root cause is cross-origin loading of CSS stylesheets when the stylesheet download has an incorrect MIME type and the styles...

CVE-2010-2768

CVE-2010-2768 affects Mozilla Firefox (before 3.5.12 and 3.6.x before 3.6.9), Thunderbird (before 3.0.7 and 3.1.x before 3.1.3), and SeaMonkey (before 2.0.7). Root cause: Object tag type attribute not properly restricted when setting a document charset, enabling UTF-7 encoded payloads to bypass X...

CVE-2010-1214

CVE-2010-1214 describes an integer overflow in plugin content handling that affects Mozilla Firefox 3.5.x (before 3.5.11) and Firefox 3.6.x (before 3.6.7), and SeaMonkey before 2.0.6. The vulnerability arises from an integer overflow when parsing plugin parameter elements, leading to memory corru...

CVE-2012-0442

CVE-2012-0442 covers multiple memory-safety vulnerabilities in the Mozilla browser engine affecting Firefox before 3.6.26 and 4.x–9.0, Thunderbird before 3.1.18 and 5.0–9.0, and SeaMonkey before 2.7. The issues can cause memory corruption, application crashes, or potentially remote code execution...

CVE-2013-1722

CVE-2013-1722 describes a use-after-free in nsAnimationManager::BuildAnimations within the Mozilla Firefox animation system. The vulnerability affects Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.2...

CVE-2013-5616

CVE-2013-5616 is a use-after-free in Mozilla Firefox before 26.0 (also affects ESR 24.x before 24.2, Thunderbird before 24.2, SeaMonkey before 2.23) triggered by nsEventListenerManager::HandleEventSubType. Exploitation could lead to remote code execution or a denial of service due to heap memory ...

CVE-2009-0776

CVE-2009-0776 affects Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15. Root cause: nsIRDFService allows a cross-domain redirect to bypass the same-origin policy, enabling reading XML data from a different domain. Impact per sources: remote read access to cro...

CVE-2010-3173

CVE-2010-3173 affects Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9. Root cause: the SSL DHE (Diffie-Hellman Ephemeral) implementation does not properly enforce a safe minimum DH key length, enabling brute-force ...

CVE-2012-4192

CVE-2012-4192 affects Mozilla Firefox 16.0, Thunderbird 16.0, and SeaMonkey 2.13 (and related ESR/derivatives) where a crafted page can bypass the Same Origin Policy and read the properties of the Location object (window.location). The root cause is described as a security check not being applied...

CVE-2013-5590

CVE-2013-5590 affects Mozilla Firefox and related products (Firefox/ESR, Thunderbird, SeaMonkey). The Mozilla browser engine and associated components contain memory corruption/denial-of-service vulnerabilities that could lead to arbitrary code execution via unspecified vectors. Public advisories...

CVE-2009-0775

CVE-2009-0775 is a Mozilla Firefox/Thunderbird/SeaMonkey vulnerability described in the MiracleLinux AXSA advisory as a Double free in cloned XUL DOM elements linked as parent/child that are mishandled during garbage collection. A remote attacker could potentially execute arbitrary code by crafti...

CVE-2009-3979

CVE-2009-3979 affects Mozilla products including Firefox (before 3.0.16 and 3.5.x before 3.5.6), SeaMonkey (before 2.0.1), and Thunderbird according to the initial description and connected advisories. The vulnerability allows a remote attacker to cause memory corruption and application crashes o...

CVE-2010-2767

CVE-2010-2767 is a dangling-pointer vulnerability in Mozilla’s navigator.plugins handling. The issue occurs when the DOM plugin array is destroyed but a pointer to it remains, potentially allowing a remote attacker to crash the browser or execute arbitrary code. Affected products and versions (pe...

CVE-2010-3169

CVE-2010-3169 affects Mozilla's browser engine across multiple products: Firefox ≤ 3.5.11 (and 3.6.x prior to 3.6.9), Thunderbird ≤ 3.0.6 (and 3.1.x prior to 3.1.3), and SeaMonkey ≤ 2.0.6 (prior to 2.0.7). The issue is described as memory safety vulnerabilities in the browser engine that could al...

CVE-2012-1951

CVE-2012-1951 is an actual security issue described in the connected MiracleLinux AXSA:2012-874 advisory as a Use-after-free in Mozilla Firefox 4.x–13.0 (and Firefox ESR 10.x before 10.0.6) affecting nsSMILTimeValueSpec::IsEventBased, with Thunderbird 5.0–13.0 and SeaMonkey before 2.11 also impli...

CVE-2012-3986

CVE-2012-3986 affects Mozilla Firefox prior to 16.0 (and Firefox ESR 10.x prior to 10.0.8), Thunderbird prior to 16.0, and SeaMonkey before 2.13. The root cause is that certain DOMWindowUtils (nsDOMWindowUtils) methods were not protected by security checks, allowing remote JavaScript to bypass in...

CVE-2013-0780

CVE-2013-0780 is a use-after-free vulnerability in Mozilla Firefox related to the nsOverflowContinuationTracker::Finish function. It affects Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. An attacker c...

CVE-2014-1529

CVE-2014-1529 affects Mozilla Firefox and related Mozilla products (Firefox before 29.0, ESR 24.x before 24.5, Thunderbird before 24.5, SeaMonkey before 2.26). The Web Notification API vulnerability allows remote attackers to bypass source-component restrictions and run arbitrary JavaScript in a ...

CVE-2007-0009

CVE-2007-0009 describes a stack-based buffer overflow in the SSLv2 handling of the Mozilla Network Security Services (NSS) library, caused by improper handling of the Client Master Key length values. This can enable remote attackers to execute arbitrary code in the context of the affected process...

CVE-2009-0771

CVE-2009-0771 is a vulnerability described in the MiracleLinux AXSA-2009-348:01 advisory as affecting the Mozilla layout engine. The exposed products and versions include Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15. The issue allows remote attackers to cause a ...

CVE-2009-0772

Mode C: CVE-2009-0772 affects Mozilla-based products via memory corruption triggered by nsCSSStyleSheet::GetOwnerNode, related to events and Garbage Collection. Affected software includes Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15. Outcome: remote deni...

CVE-2010-3167

CVE-2010-3167 : The nsTreeContentView in Mozilla Firefox (before 3.5.12 and 3.6.x before 3.6.9), Thunderbird (before 3.0.7 and 3.1.x before 3.1.3), and SeaMonkey (before 2.0.7) contains a dangling-pointer vulnerability in XUL trees when removing nodes. This could allow remote attackers to execute...

CVE-2012-3966

CVE-2012-3966 affects Mozilla Firefox and related Mozilla products (Firefox before 15.0, Firefox ESR before 10.0.7, Thunderbird before 15.0, SeaMonkey before 2.12). The vulnerability arises from a negative height value in a BMP image inside a .ICO file, related to improper handling of the transpa...

CVE-2012-3978

CVE-2012-3978 affects Mozilla Firefox (and related Mozilla components) where nsLocation::CheckURL does not properly follow the location object security model, enabling remote attackers to bypass content-loading restrictions via chrome code vectors. MiracleLinux advisories list this as part of mul...

CVE-2013-0791

The connected Nessus advisories confirm CVE-2013-0791 affects Mozilla NSS and upstream products via CERT_DecodeCertPackage, allowing remote doS through out-of-bounds reads and memory corruption when processing crafted certificates. Affected: NSS libraries and apps (Firefox before 20.0, ESR 17.x b...

CVE-2013-5613

Mode C: Detailed vulnerability note for CVE-2013-5613. Affected product/variant: Mozilla Firefox components shipped in MiracleLinux 3 (firefox-24.4.0-1.0.1.AXS3) per AXSA:2014-233:01. Root cause: Use-after-free in PresShell::DispatchSynthMouseMove, linked to RestyleManager::GetHoverGeneration, en...

CVE-2014-1590

CVE-2014-1590 affects Mozilla Firefox (before 34.0), Firefox ESR (31.x before 31.3), Thunderbird (before 31.3), and SeaMonkey (before 2.31). The issue is a denial of service caused by an error when passing a crafted JavaScript object to XMLHttpRequest.prototype.send. Remediation is to upgrade to ...

CVE-2006-0297

CVE-2006-0297 involves integer overflow vulnerabilities in Mozilla-based products. Affects Mozilla Firefox 1.5, Thunderbird 1.5, and SeaMonkey before 1.0 when JavaScript is enabled in mail. The issues stem from three vulnerable code paths: (1) EscapeAttributeValue in jsxml.c (E4X), (2) nsSVGCairo...

CVE-2010-1198

CVE-2010-1198 is a use-after-free vulnerability in Mozilla Firefox 3.5.x before 3.5.10 and Firefox 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, which allows remote attackers to execute arbitrary code via vectors involving multiple plugin instances. The connected Nessus entries corroborate the ...

CVE-2010-2769

CVE-2010-2769 is a cross-site scripting (XSS) vulnerability affecting Mozilla Firefox (before 3.5.12 and 3.6.x before 3.6.9), Thunderbird (before 3.0.7 and 3.1.x before 3.1.3), and SeaMonkey (before 2.0.7). The issue arises when a selection is added to a document with designMode enabled, allowing...

CVE-2011-3005

CVE-2011-3005 is a use-after-free in Mozilla Firefox (4.x–6) that can be triggered via crafted OGG headers in a .ogg file, potentially leading to remote code execution or a crash. Affected products/versions include Firefox 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4. Root caus...

CVE-2012-3969

CVE-2012-3969 is an integer overflow in the nsSVGFEMorphologyElement::Filter function of Mozilla Firefox (and related Mozilla apps) prior to version 15.0, Firefox ESR 10.x prior to 10.0.7, and corresponding Thunderbird/SeaMonkey builds. Assigned impact is a heap-based buffer overflow that enables...

CVE-2013-0755

CVE-2013-0755 refers to a use-after-free in the mozVibrate implementation of the Vibrate library in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. The vulnerability allows remote code execution...