CVE-2012-1951

CVE-2012-1951 is an actual security issue described in the connected MiracleLinux AXSA:2012-874 advisory as a Use-after-free in Mozilla Firefox 4.x–13.0 (and Firefox ESR 10.x before 10.0.6) affecting nsSMILTimeValueSpec::IsEventBased, with Thunderbird 5.0–13.0 and SeaMonkey before 2.11 also impli...

CVE-2013-5604

CVE-2013-5604 affects the XSLT processor in Mozilla Firefox (and related Mozilla components) where txXPathNodeUtils::getBaseURI does not initialize data properly. This allows remote attackers to execute arbitrary code or cause a denial of service via crafted documents, including stack-based buffe...

CVE-2006-0294

Affected software: Mozilla Firefox <1.5.0.1, Thunderbird 1.5, and SeaMonkey

CVE-2009-3983

CVE-2009-3983 affects Mozilla Firefox before 3.0.16 and Firefox 3.5.x before 3.5.6, and SeaMonkey before 2.0.1. The issue allows remote attackers to replay NTLM credentials from a browser user, enabling authenticated requests to arbitrary applications. The vulnerability is described as a credenti...

CVE-2010-1196

CVE-2010-1196 is a heap-based buffer overflow triggered by an integer overflow in nsGenericDOMDataNode::SetTextInternal. Affected products include Mozilla Firefox 3.5.x before 3.5.10, Firefox 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5, allowing remote code execution ...

CVE-2011-0069

CVE-2011-0069 affects Mozilla Firefox 3.5.x prior to 3.5.19, Firefox 3.6.x prior to 3.6.17, and Firefox 4.x prior to 4.0.1; Thunderbird prior to 3.1.10; and SeaMonkey prior to 2.0.14. The issue is an unspecified vulnerability in the browser engine that can cause memory corruption, leading to a de...

CVE-2011-1187

CVE-2011-1187 affects Google Chrome prior to 10.0.648.127, allowing remote attackers to bypass the Same Origin Policy via an unspecified error-message leak vector. The vulnerability targets the browser’s SOP checks, enabling cross-origin access that should be restricted. Public sources within the...

CVE-2011-2995

CVE-2011-2995 is a browser engine vulnerability affecting Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4. The issue allows remote attackers to cause memory corruption and application crashes or possibly execute arbitrary code via unknown vectors;...

CVE-2012-0445

Vulnerability summary: Mozilla Firefox 4.x–9.0, Thunderbird 5.0–9.0, and SeaMonkey

CVE-2012-3982

CVE-2012-3982 affects Mozilla Firefox before 16.0, Firefox ESR before 10.0.8, Thunderbird before 16.0, Thunderbird ESR before 10.0.8, and SeaMonkey before 2.13. The description notes multiple unspecified vulnerabilities in the browser engine that can cause memory corruption and application crashe...

CVE-2013-0761

CVE-2013-0761 is a use-after-free vulnerability in Firefox’s mozilla::TrackUnionStream::EndTrack that could allow remote code execution or a denial of service via heap memory corruption. Affected products include Firefox before 18.0 (and ESR 17.x before 17.0.1), Thunderbird before 17.0.2 (and ESR...

CVE-2013-0776

CVE-2013-0776 affects Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. The flaw allows a man-in-the-middle attacker to spoof the address bar by using a proxy server that returns a 407 HTTP status...

CVE-2013-5618

CVE-2013-5618 is a use-after-free in Mozilla Firefox’s table-editing UI (nsNodeUtils::LastRelease). Affected: Firefox < 26.0, Firefox ESR < 24.2, Thunderbird < 24.2, SeaMonkey

CVE-2014-1529

CVE-2014-1529 affects Mozilla Firefox and related Mozilla products (Firefox before 29.0, ESR 24.x before 24.5, Thunderbird before 24.5, SeaMonkey before 2.26). The Web Notification API vulnerability allows remote attackers to bypass source-component restrictions and run arbitrary JavaScript in a ...

CVE-2009-0771

CVE-2009-0771 is a vulnerability described in the MiracleLinux AXSA-2009-348:01 advisory as affecting the Mozilla layout engine. The exposed products and versions include Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15. The issue allows remote attackers to cause a ...

CVE-2009-3376

CVE-2009-3376 affects Mozilla Firefox (before 3.0.15 and 3.5.x before 3.5.4) and SeaMonkey (before 2.0). The root cause is improper handling of a right-to-left override (RLO, U+202E) Unicode character in a download filename, which can cause the displayed name to differ from the actual filename. T...

CVE-2010-2766

CVE-2010-2766 is a memory/DOM handling flaw in Mozilla’s browser engines where the normalization code could remove DOM nodes during traversal, leading to an access of a deleted object and potential code execution. Affected products and versions per the provided documents: Mozilla Firefox before 3...

CVE-2010-3168

CVE-2010-3168 affects Mozilla products (Firefox, Thunderbird, SeaMonkey) where XUL tree removal could be triggered by setting certain properties. Root cause: improper restriction of property changes in triggering XUL tree removal. Impact: remote attackers could cause a denial of service (deleted ...

CVE-2011-3659

CVE-2011-3659 is a use-after-free in Mozilla Firefox (before 3.6.26 and 4.x through 9.0), Thunderbird (before 3.1.18 and 5.0 through 9.0), and SeaMonkey (before 2.7). The root cause is premature notification of AttributeChildRemoved that affects access to removed nsDOMAttribute child nodes, enabl...

CVE-2012-3991

CVE-2012-3991 affects Mozilla Firefox and related Mozilla products: Firefox and Firefox ESR before the 16.0 line, Thunderbird before 16.0, and SeaMonkey before 2.13 did not properly restrict JSAPI GetProperty access, bypassing the Same Origin Policy. This vulnerability could allow remote attacker...

CVE-2012-4185

CVE-2012-4185 describes a buffer overflow in Mozilla Firefox’s nsCharTraits::length function that could allow remote code execution or a heap memory corruption in Firefox <16.0, ESR 10.x <10.0.8, Thunderbird <16.0/ESR 10.x <10.0.8, and SeaMonkey

CVE-2013-0749

CVE-2013-0749 describes multiple unspecified vulnerabilities in the Mozilla Firefox browser engine (before 18.0) and related products (Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2 and ESR 17.x before 17.0.1, SeaMonkey before 2.15). The description states that remote attackers could c...

CVE-2013-5599

CVE-2013-5599 is a use-after-free vulnerability in the PresShell path: nsIPresShell::GetPresContext in Mozilla Firefox before 25.0 (and related ESR/Thunderbird/SeaMonkey branches) that can be triggered via a CANVAS element, a mozTextStyle attribute, and an onresize event. The underlying issue is ...

CVE-2013-5602

CVE-2013-5602 describes a vulnerability in the Web workers implementation of Mozilla Firefox and related Mozilla products where the function Worker::SetEventListener is susceptible to memory corruption/use-after-free. Affected products include Firefox before 25.0, ESR 17.x before 17.0.10 and 24.x...

CVE-2014-8634

CVE-2014-8634 affects Mozilla Firefox (and related Mozilla products) with memory-safety and implementation issues in the browser engine that could allow remote code execution or a crash. Public disclosures across multiple advisories confirm additional related CVEs (e.g., 8638, 8639, 8641, etc.) a...

CVE-2009-1302

The CVE-2009-1302 entry affects Mozilla Firefox 3.x prior to 3.0.9, Thunderbird prior to 2.0.0.22, and SeaMonkey prior to 1.1.16. The vulnerability enables remote attackers to trigger a denial of service (application crash) and potentially memory corruption via multiple vectors, including nsAsync...

CVE-2010-1200

CVE-2010-1200 is reported across multiple advisories as part of Mozilla Firefox family vulnerabilities. Affected products include Firefox 3.5.x before 3.5.10, Firefox 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5. The issue is described as multiple unspecified vulnerabi...

CVE-2010-2765

CVE-2010-2765: Integer overflow in the FRAMESET cols attribute may allow remote code execution via a large number of columns. Affected products include Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7. Exploitation c...

CVE-2013-0793

CVE-2013-0793 affects Mozilla Firefox family (Firefox, Firefox ESR, Thunderbird, SeaMonkey) and related XUL/XPCOM runtimes where the address bar could be manipulated during history navigation, enabling cross-site scripting (XSS) or phishing by timing navigation. Affected products in scope include...

CVE-2008-0592

CVE-2008-0592 affects Mozilla Firefox (before 2.0.0.12) and SeaMonkey (before 1.1.8). The root cause is improper handling of a plain/text file delivered with Content-Disposition: attachment and an invalid Content-Type: plain/text, which prevents the browser from rendering subsequent plain text fi...

CVE-2010-3174

CVE-2010-3174 is a memory-safety/remote-code issue described in MFSA 2010-64 affecting the Mozilla browser engine. Public data ties the CVE to Firefox (and related Mozilla-based products) versions around the 3.x line; the initial entry notes Firefox 3.5.x before 3.5.14, Thunderbird before 3.0.9, ...

CVE-2011-3062

CVE-2011-3062 : An off-by-one error in the OpenType Sanitizer used by Google Chrome prior to 18.0.1025.142 allows remote attackers to cause a denial of service or possibly other impact via a crafted OpenType file. The MiracleLinux/OpenSUSE/Oracle Solaris advisories reference this CVE as part of C...

CVE-2012-0459

CVE-2012-0459 affects Mozilla Firefox (4.x–10.0), Firefox ESR (10.x up to before 10.0.3), Thunderbird (5.0–10.0) and SeaMonkey (before 2.8). It is caused by remote exploitation via dynamic modification of a keyframe followed by access to the keyframe’s cssText, enabling denial of service (applica...

CVE-2012-0477

CVE-2012-0477 is one of multiple XSS-related issues affecting Mozilla Firefox 4.x–11.0, ESR 10.x before 10.0.4, Thunderbird 5.0–11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9. It enables remote attackers to inject arbitrary web script or HTML via decoding of (1) ISO-2022-KR or...

CVE-2012-1967

CVE-2012-1967 affects Mozilla Firefox 4.x–13.0, Firefox ESR 10.x prior to 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x prior to 10.0.6, and SeaMonkey prior to 2.11. Root cause: JavaScript sandbox may run javascript: URLs with insufficient context, allowing remote code execution with user pr...

CVE-2012-4188

CVE-2012-4188 is a heap-based buffer overflow in Mozilla Firefox’s Convolve3x3 path, affecting Firefox before 16.0 (and ESR 10.x before 10.0.8), Thunderbird before 16.0 (and ESR 10.x before 10.0.8), and SeaMonkey before 2.13. The vulnerability allows remote code execution via unspecified vectors;...

CVE-2013-1737

CVE-2013-1737 affects Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0/ESR 17.x before 17.0.9, and SeaMonkey before 2.21. The issue is that the attacker-controlled getter on DOM proxies may fail to correctly identify the this object, potentially bypassing acces...

CVE-2014-1590

CVE-2014-1590 affects Mozilla Firefox (before 34.0), Firefox ESR (31.x before 31.3), Thunderbird (before 31.3), and SeaMonkey (before 2.31). The issue is a denial of service caused by an error when passing a crafted JavaScript object to XMLHttpRequest.prototype.send. Remediation is to upgrade to ...

CVE-2014-1592

CVE-2014-1592 is a use-after-free in Mozilla Firefox’s nsHtml5TreeOperation (xul.dll) that enables remote code execution by adding a second root element to an HTML5 document during parsing. Affected products/versions include Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird b...

CVE-2008-0412

The CVE-2008-0412 entry describes multiple remote-denial-of-service and potential memory corruption vulnerabilities in the browser engines of Mozilla Firefox <2.0.0.12, Thunderbird <2.0.0.12, and SeaMonkey

CVE-2009-0773

Mode C: The CVE-2009-0773 issue affects Mozilla Firefox (and related Mozilla-based browsers) prior to 3.0.7, Thunderbird prior to 2.0.0.21, and SeaMonkey 1.1.15. The vulnerability is in the JavaScript engine and is triggered by: (1) a splice of an array containing some non-set elements, causing j...

CVE-2010-0177

CVE-2010-0177 affects Mozilla Firefox before 3.0.19, 3.5.x before 3.5.9, and 3.6.x before 3.6.2, and SeaMonkey before 2.0.4. The vulnerability frees the contents of the window.navigator.plugins array while a reference to an element remains active, enabling remote code execution or a crash via a d...

CVE-2012-3959

CVE-2012-3959 describes a use-after-free in Mozilla Firefox’s nsRangeUpdater::SelAdjDeleteNode, affecting Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. The vulnerability allows remote attackers to execu...

CVE-2013-0745

This CVE (CVE-2013-0745) affects Mozilla Firefox prior to 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. It is caused by the AutoWrapperChanger not interacting correctly with garbage collection, enabling remote code ...

CVE-2013-0764

CVE-2013-0764 affects Mozilla Firefox (before 18.0), Firefox ESR (before 17.0.2), Thunderbird (before 17.0.2 and ESR 17.x before 17.0.2), and SeaMonkey (before 2.15). The vulnerability is a thread-safety issue in nsSOCKSSocketInfo::ConnectToProxy that can allow remote code execution through craft...

CVE-2013-5595

CVE-2013-5595 affects the Mozilla/XUL Firefox engine. The vulnerability arises from improper memory allocation in unspecified JavaScript functions, enabling remote attackers to trigger a buffer overflow via a crafted web page. Affected are Firefox before 25.0, Firefox ESR 17.x before 17.0.10, and...

CVE-2013-5597

CVE-2013-5597 is a use-after-free vulnerability in Mozilla Firefox (and affected Mozilla platforms) caused by improper handling in nsDocLoader::doStopDocumentLoad during an offline-cache update. The issue allows remote attackers to trigger arbitrary code execution or a denial of service via a sta...

CVE-2013-5612

CVE-2013-5612 is a cross-site scripting (XSS) vulnerability in Mozilla Firefox before 26.0 and SeaMonkey before 2.23 due to the absence of a charset parameter in the Content-Type header. Connected advisories confirm Firefox/SeaMonkey fixes in 2013–2014 releases (e.g., openSUSE SU-2013:1917, Mirac...

CVE-2014-1488

CVE-2014-1488 affects Mozilla Firefox < 27.0 and SeaMonkey

CVE-2009-1311

CVE-2009-1311 affects Mozilla Firefox before 3.0.9 and SeaMonkey before 1.1.17. A web page with an embedded frame can cause POST data from the outer page to be sent to the inner frame’s URL during SAVEMODE_FILEONLY saves, exposing sensitive information. The MiracleLinux/Tenable entry confirms thi...