CVE-2010-1209

CVE-2010-1209 affects Mozilla Firefox (3.5.x up to 3.5.10; 3.6.x up to 3.6.6) and SeaMonkey (up to 2.0.5) via a use-after-free in the NodeIterator implementation. The issue arises when a crafted NodeFilter detaches nodes during traversal, enabling memory corruption and potential remote code execu...

CVE-2009-1308

Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey allows remote attackers to inject arbitrary web script or HTML via vectors involving XBL JavaScript bindings and remote stylesheets, as exploited in the wild by a March 2009 eBay listing.

CVE-2011-0083

CVE-2011-0083 is a use-after-free in the nsSVGPathSegList::ReplaceItem path in Mozilla Firefox (<3.6.18), Thunderbird (<3.1.11), and SeaMonkey (

CVE-2012-0471

CVE-2012-0471 is documented in multiple connected advisories as a Cross-site Scripting (XSS) vulnerability in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9. The root cause is a vulnerabi...

CVE-2012-4207

CVE-2012-4207 affects Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0 / ESR 10.x, and SeaMonkey before 2.14. The flaw in the HZ-GB-2312 charset implementation allows remote attackers to perform cross-site scripting (XSS) via a crafted document, due to imprope...

CVE-2013-5595

CVE-2013-5595 affects the Mozilla/XUL Firefox engine. The vulnerability arises from improper memory allocation in unspecified JavaScript functions, enabling remote attackers to trigger a buffer overflow via a crafted web page. Affected are Firefox before 25.0, Firefox ESR 17.x before 17.0.10, and...

CVE-2013-5597

CVE-2013-5597 is a use-after-free vulnerability in Mozilla Firefox (and affected Mozilla platforms) caused by improper handling in nsDocLoader::doStopDocumentLoad during an offline-cache update. The issue allows remote attackers to trigger arbitrary code execution or a denial of service via a sta...

CVE-2013-5618

CVE-2013-5618 is a use-after-free in Mozilla Firefox’s table-editing UI (nsNodeUtils::LastRelease). Affected: Firefox < 26.0, Firefox ESR < 24.2, Thunderbird < 24.2, SeaMonkey

CVE-2008-3837

CVE-2008-3837 affects Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2) and SeaMonkey (before 1.1.12). A crafted onmousedown action that calls window.moveBy can allow a user‑assisted remote attacker to move a window during a mouse click, potentially triggering a drag‑and‑drop–related action ...

CVE-2010-2765

CVE-2010-2765: Integer overflow in the FRAMESET cols attribute may allow remote code execution via a large number of columns. Affected products include Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7. Exploitation c...

CVE-2011-3062

CVE-2011-3062 : An off-by-one error in the OpenType Sanitizer used by Google Chrome prior to 18.0.1025.142 allows remote attackers to cause a denial of service or possibly other impact via a crafted OpenType file. The MiracleLinux/OpenSUSE/Oracle Solaris advisories reference this CVE as part of C...

CVE-2012-0473

CVE-2012-0473 : In Mozilla Firefox and related Mozilla products, the WebGLBuffer::FindMaxUshortElement function calls FindMaxElementInSubArray with incorrect template arguments, allowing remote attackers to obtain sensitive information from video memory via a crafted WebGL.drawElements call. Affe...

CVE-2012-4202

CVE-2012-4202 describes a heap-based buffer overflow in Firefox’s image::RasterImage::DrawFrameTo, exploitable via a crafted GIF image to execute arbitrary code. Affected products include Mozilla Firefox before 17.0, Firefox ESR before 10.0.11 (10.x), Thunderbird before 17.0, Thunderbird ESR befo...

CVE-2013-0745

This CVE (CVE-2013-0745) affects Mozilla Firefox prior to 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. It is caused by the AutoWrapperChanger not interacting correctly with garbage collection, enabling remote code ...

CVE-2013-5615

CVE-2013-5615 concerns GetElementIC typed array stubs being generated outside observed typesets in the Mozilla JavaScript engine. The connected vendor notes identify affected products as Mozilla Firefox (and related Firefox ESR/Thunderbird/SeaMonkey lines in the 2013 MFSA bundle) with fixes imple...

CVE-2014-1594

CVE-2014-1594 affects Mozilla Firefox (pre-34.0), Firefox ESR (pre-31.3), Thunderbird (pre-31.3), and SeaMonkey (pre-2.31). The underlying issue is a casting error: an incorrect cast from the BasicThebesLayer data type to the BasicContainerLayer data type. This can allow a remote attacker to exec...

CVE-2011-2993

CVE-2011-2993 describes unsigned JavaScript calling into signed JAR code, allowing Same Origin Policy bypass and privilege gain in Mozilla SeaMonkey/Firefox. Connected sources confirm the issue across SeaMonkey 2.x (fixed in SeaMonkey 2.3) and Firefox 4.x–5 timelines, with MFSA advisories and pat...

CVE-2012-0456

CVE-2012-0456 concerns the SVG Filters implementation in Mozilla Firefox (and related Mozilla products) that can allow remote attackers to obtain sensitive information from process memory via an out-of-bounds read. Affected products include Firefox versions prior to 3.6.28 and 4.x through 10.0, F...

CVE-2012-1958

CVE-2012-1958 is a use-after-free vulnerability in Mozilla Firefox’s nsGlobalWindow::PageHidden path that could allow remote code execution. The vulnerability affects Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2...

CVE-2012-3959

CVE-2012-3959 describes a use-after-free in Mozilla Firefox’s nsRangeUpdater::SelAdjDeleteNode, affecting Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. The vulnerability allows remote attackers to execu...

CVE-2012-4201

CVE-2012-4201 is a concrete Firefox/XULRunner/Thunderbird/SeaMonkey vulnerability: the evalInSandbox path mishandles the context when processing JavaScript that sets location.href, enabling remote XSS or read access to arbitrary files via a sandboxed add-on. Affected software includes Mozilla Fir...

CVE-2013-0772

CVE-2013-0772 is a memory-safety issue in Mozilla's image rendering: RasterImage::DrawFrameTo allows out-of-bounds reads in crafted GIFs, enabling possible information disclosure or denial of service. Affected products and versions per connected docs: Mozilla Firefox up to version 19.0 (prior to ...

CVE-2013-0773

CVE-2013-0773 corresponds to a vulnerability in the Chrome Object Wrapper (COW) and System Only Wrapper (SOW) security wrappers in Mozilla-based products. The issue allowed modifications to a prototype, enabling a non-specified remote site to access chrome objects or potentially execute JavaScrip...

CVE-2008-0592

CVE-2008-0592 affects Mozilla Firefox (before 2.0.0.12) and SeaMonkey (before 1.1.8). The root cause is improper handling of a plain/text file delivered with Content-Disposition: attachment and an invalid Content-Type: plain/text, which prevents the browser from rendering subsequent plain text fi...

CVE-2009-1311

CVE-2009-1311 affects Mozilla Firefox before 3.0.9 and SeaMonkey before 1.1.17. A web page with an embedded frame can cause POST data from the outer page to be sent to the inner frame’s URL during SAVEMODE_FILEONLY saves, exposing sensitive information. The MiracleLinux/Tenable entry confirms thi...

CVE-2009-3388

CVE-2009-3388 affects Mozilla Firefox 3.5.x prior to 3.5.6 and SeaMonkey prior to 2.0.1, with the underlying issue described as memory safety problems. Public disclosures in multiple advisories indicate that the vulnerability involves memory-safety issues in the liboggplay library (memory safety ...

CVE-2011-2377

CVE-2011-2377 affects Mozilla Firefox (Firefox <3.6.18 and 4.x ≤ 4.0.1), Thunderbird (

CVE-2012-0477

CVE-2012-0477 is one of multiple XSS-related issues affecting Mozilla Firefox 4.x–11.0, ESR 10.x before 10.0.4, Thunderbird 5.0–11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9. It enables remote attackers to inject arbitrary web script or HTML via decoding of (1) ISO-2022-KR or...

CVE-2012-0479

CVE-2012-0479 affects Mozilla Firefox (4.x–11.0; ESR 10.x before 10.0.4), Thunderbird (5.0–11.0), and SeaMonkey (before 2.9). Root cause per description: spoofing of the address bar via an https URL for invalid RSS/Atom XML content. This enables remote attackers to mislead users about the site th...

CVE-2012-3992

CVE-2012-3992 affects Mozilla Firefox (and related Firefox-based apps) where history data is not properly handled. The flaw lets remote attackers perform cross-site scripting (XSS) or obtain sensitive POST content via a location.hash write operation combined with history navigation that loads a U...

CVE-2012-4181

CVE-2012-4181 is a use-after-free in Mozilla Firefox's nsSMILAnimationController::DoSample that can lead to remote code execution or a denial of service (heap memory corruption). Affected products include Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunde...

CVE-2009-0773

Mode C: The CVE-2009-0773 issue affects Mozilla Firefox (and related Mozilla-based browsers) prior to 3.0.7, Thunderbird prior to 2.0.0.21, and SeaMonkey 1.1.15. The vulnerability is in the JavaScript engine and is triggered by: (1) a splice of an array containing some non-set elements, causing j...

CVE-2009-1392

The CVE-2009-1392 issue affects Mozilla Firefox 3 before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17. It enables memory corruption that can cause a denial of service or potentially allow arbitrary code execution via multiple code paths in the browser engine and UI (e.g., nsEv...

CVE-2012-5842

CVE-2012-5842 is a Mozilla Firefox browser engine vulnerability described as multiple unspecified vulnerabilities that can cause memory corruption leading to a crash or possibly remote code execution. Affected products/versions per description: Mozilla Firefox before 17.0, Firefox ESR 10.x before...

CVE-2014-1488

CVE-2014-1488 affects Mozilla Firefox < 27.0 and SeaMonkey

CVE-2014-1593

CVE-2014-1593 is a stack-based buffer overflow in Mozilla Firefox’s mozilla::FileBlockCache::Read that could allow remote code execution via crafted media content. Affected products and versions in the provided documents: Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird befo...

CVE-2009-1309

CVE-2009-1309 affects Mozilla Firefox (pre-3.0.9) and its related Mozilla suite components (Thunderbird, SeaMonkey). The issue arises from improper Same Origin Policy handling for XMLHttpRequest (document principal mismatch) and XPCNativeWrapper.toString (incorrect proto scope), enabling cross-si...

CVE-2009-3984

CVE-2009-3984 affects Mozilla Firefox up to 3.0.16 and Firefox 3.5.x up to 3.5.6, as well as SeaMonkey up to 2.0.1. Root cause: spoofing of the SSL indicator by navigating a document.location to an HTTPS URL that serves a 204 No Content with an empty body, enabling a user-facing location-bar spoo...

CVE-2012-0458

CVE-2012-0458 affects Mozilla Firefox and related Mozilla products where a drag-and-drop of a javascript: URL to the home button could bypass restrictions and execute arbitrary JavaScript with chrome privileges in the about:sessionrestore context. Affected products include Firefox before 3.6.28 a...

CVE-2012-1947

CVE-2012-1947 describes a heap-based buffer overflow in the utf16_to_isolatin1 function affecting Mozilla Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The vulnerability allows remote attackers to execute arb...

CVE-2012-1957

CVE-2012-1957 : An unspecified parser-utility class in Mozilla Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 mishandles EMBED elements inside RSS description feeds, enabling remote XSS via a feed. Affected pro...

CVE-2012-3984

CVE-2012-3984 affects Mozilla Firefox (<16.0), Mozilla Thunderbird (<16.0), and SeaMonkey (

CVE-2013-1708

Summary (CVE-2013-1708) : Mozilla Firefox before 23.0 and SeaMonkey before 2.20 were vulnerable to a denial-of-service via a crafted WAV file that is not properly handled by nsCString::CharAt, causing an application crash. OpenSUSE/SUSE advisories (and the Gentoo GLSA reference) link this CVE to ...

CVE-2012-4213

The CVE-2012-4213 issue is a concrete use-after-free vulnerability in Mozilla codepath: nsEditor::FindNextLeafNode affects Firefox and related products. Affected components per the initial description are Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14, with remote...

CVE-2012-5836

CVE-2012-5836 affects Mozilla Firefox (before 17.0), Mozilla Thunderbird (before 17.0), and SeaMonkey (before 2.14). The issue can allow remote code execution or an application crash when CSS properties are combined with SVG text, due to the root cause described by MFSA 2012-94. Public advisories...

CVE-2013-5593

The CVE-2013-5593 issue affects Mozilla Firefox (and related Mozilla products) where the SELECT element’s handling of HTML in dropdowns did not properly restrict content, allowing remote attackers to spoof the address bar or perform clickjacking via navigation-redirect vectors. Affected products/...

CVE-2013-6672

CVE-2013-6672: Firefox (Linux) and SeaMonkey are affected by a Linux clipboard information disclosure via middle-click paste. The initial entry specifies Firefox < 26.0 and SeaMonkey

CVE-2014-1483

Technical details for CVE-2014-1483 are not publicly provided in the connected documents; sources reference the CVE but do not disclose affected products, versions, root cause, impact, or fixes. Monitor for updates.

CVE-2014-8639

CVE-2014-8639 affects Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32. It improperly interprets Set-Cookie headers in responses with a 407 Proxy Authentication Required status, enabling a remote proxy to perform session fixation by inj...

CVE-2009-0774

The CVE-2009-0774 entry affects the Mozilla layout/JavaScript stack: Firefox 2 and 3 prior to 3.0.7, Thunderbird prior to 2.0.0.21, and SeaMonkey prior to 1.1.15 are vulnerable to remote-triggered denial of service and potential arbitrary code execution via gczeal-related vectors (distinct from C...