CVE-2012-4207

CVE-2012-4207 affects Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0 / ESR 10.x, and SeaMonkey before 2.14. The flaw in the HZ-GB-2312 charset implementation allows remote attackers to perform cross-site scripting (XSS) via a crafted document, due to imprope...

CVE-2013-5595

CVE-2013-5595 affects the Mozilla/XUL Firefox engine. The vulnerability arises from improper memory allocation in unspecified JavaScript functions, enabling remote attackers to trigger a buffer overflow via a crafted web page. Affected are Firefox before 25.0, Firefox ESR 17.x before 17.0.10, and...

CVE-2013-5597

CVE-2013-5597 is a use-after-free vulnerability in Mozilla Firefox (and affected Mozilla platforms) caused by improper handling in nsDocLoader::doStopDocumentLoad during an offline-cache update. The issue allows remote attackers to trigger arbitrary code execution or a denial of service via a sta...

CVE-2008-3837

CVE-2008-3837 affects Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2) and SeaMonkey (before 1.1.12). A crafted onmousedown action that calls window.moveBy can allow a user‑assisted remote attacker to move a window during a mouse click, potentially triggering a drag‑and‑drop–related action ...

CVE-2009-1311

CVE-2009-1311 affects Mozilla Firefox before 3.0.9 and SeaMonkey before 1.1.17. A web page with an embedded frame can cause POST data from the outer page to be sent to the inner frame’s URL during SAVEMODE_FILEONLY saves, exposing sensitive information. The MiracleLinux/Tenable entry confirms thi...

CVE-2009-1312

CVE-2009-1312 affects Mozilla Firefox prior to 3.0.9 and SeaMonkey prior to 1.1.17, where javascript: URIs in Refresh headers are not blocked in HTTP responses, enabling remote XSS via header injection or header content manipulation. The connected documents indicate the issue was addressed in rel...

CVE-2009-3984

CVE-2009-3984 affects Mozilla Firefox up to 3.0.16 and Firefox 3.5.x up to 3.5.6, as well as SeaMonkey up to 2.0.1. Root cause: spoofing of the SSL indicator by navigating a document.location to an HTTPS URL that serves a 204 No Content with an empty body, enabling a user-facing location-bar spoo...

CVE-2010-0176

CVE-2010-0176 affects Mozilla Firefox (before 3.0.19; 3.5.x before 3.5.9; 3.6.x before 3.6.2), Thunderbird before 3.0.4, and SeaMonkey before 2.0.4. The issue is a reference-counting error for option elements in a XUL tree optgroup, described as a dangling pointer vulnerability that could allow r...

CVE-2010-1209

CVE-2010-1209 affects Mozilla Firefox (3.5.x up to 3.5.10; 3.6.x up to 3.6.6) and SeaMonkey (up to 2.0.5) via a use-after-free in the NodeIterator implementation. The issue arises when a crafted NodeFilter detaches nodes during traversal, enabling memory corruption and potential remote code execu...

CVE-2011-0083

CVE-2011-0083 is a use-after-free in the nsSVGPathSegList::ReplaceItem path in Mozilla Firefox (<3.6.18), Thunderbird (<3.1.11), and SeaMonkey (

CVE-2011-2993

CVE-2011-2993 describes unsigned JavaScript calling into signed JAR code, allowing Same Origin Policy bypass and privilege gain in Mozilla SeaMonkey/Firefox. Connected sources confirm the issue across SeaMonkey 2.x (fixed in SeaMonkey 2.3) and Firefox 4.x–5 timelines, with MFSA advisories and pat...

CVE-2012-0458

CVE-2012-0458 affects Mozilla Firefox and related Mozilla products where a drag-and-drop of a javascript: URL to the home button could bypass restrictions and execute arbitrary JavaScript with chrome privileges in the about:sessionrestore context. Affected products include Firefox before 3.6.28 a...

CVE-2012-0471

CVE-2012-0471 is documented in multiple connected advisories as a Cross-site Scripting (XSS) vulnerability in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9. The root cause is a vulnerabi...

CVE-2012-3967

CVE-2012-3967 is a Firefox/WebGL vulnerability on Linux where the WebGL implementation fails to interact correctly with Mesa drivers when a large number of sampler uniforms are used. This can let remote attackers execute arbitrary code or cause a denial of service (stack memory corruption) via a ...

CVE-2012-4202

CVE-2012-4202 describes a heap-based buffer overflow in Firefox’s image::RasterImage::DrawFrameTo, exploitable via a crafted GIF image to execute arbitrary code. Affected products include Mozilla Firefox before 17.0, Firefox ESR before 10.0.11 (10.x), Thunderbird before 17.0, Thunderbird ESR befo...

CVE-2011-2377

CVE-2011-2377 affects Mozilla Firefox (Firefox <3.6.18 and 4.x ≤ 4.0.1), Thunderbird (

CVE-2012-0456

CVE-2012-0456 concerns the SVG Filters implementation in Mozilla Firefox (and related Mozilla products) that can allow remote attackers to obtain sensitive information from process memory via an out-of-bounds read. Affected products include Firefox versions prior to 3.6.28 and 4.x through 10.0, F...

CVE-2012-0479

CVE-2012-0479 affects Mozilla Firefox (4.x–11.0; ESR 10.x before 10.0.4), Thunderbird (5.0–11.0), and SeaMonkey (before 2.9). Root cause per description: spoofing of the address bar via an https URL for invalid RSS/Atom XML content. This enables remote attackers to mislead users about the site th...

CVE-2012-1956

CVE-2012-1956 affects Mozilla Firefox (pre-15.0), Thunderbird (pre-15.0), and SeaMonkey (pre-2.12). The issue is that Object.defineProperty can shadow the top-level location object (window.location), enabling cross-site scripting via plugin-imbued vectors. MiracleLinux advisories enumerate CVE-20...

CVE-2012-1959

CVE-2012-1959 affects Mozilla Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0 and Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11. The root cause is the failure to consider same-compartment security wrappers (SCSW) during cross-compartment wrapping, allowing r...

CVE-2012-3992

CVE-2012-3992 affects Mozilla Firefox (and related Firefox-based apps) where history data is not properly handled. The flaw lets remote attackers perform cross-site scripting (XSS) or obtain sensitive POST content via a location.hash write operation combined with history navigation that loads a U...

CVE-2012-5836

CVE-2012-5836 affects Mozilla Firefox (before 17.0), Mozilla Thunderbird (before 17.0), and SeaMonkey (before 2.14). The issue can allow remote code execution or an application crash when CSS properties are combined with SVG text, due to the root cause described by MFSA 2012-94. Public advisories...

CVE-2012-5842

CVE-2012-5842 is a Mozilla Firefox browser engine vulnerability described as multiple unspecified vulnerabilities that can cause memory corruption leading to a crash or possibly remote code execution. Affected products/versions per description: Mozilla Firefox before 17.0, Firefox ESR 10.x before...

CVE-2013-0747

Technical details for CVE-2013-0747 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2013-5615

CVE-2013-5615 concerns GetElementIC typed array stubs being generated outside observed typesets in the Mozilla JavaScript engine. The connected vendor notes identify affected products as Mozilla Firefox (and related Firefox ESR/Thunderbird/SeaMonkey lines in the 2013 MFSA bundle) with fixes imple...

CVE-2014-1593

CVE-2014-1593 is a stack-based buffer overflow in Mozilla Firefox’s mozilla::FileBlockCache::Read that could allow remote code execution via crafted media content. Affected products and versions in the provided documents: Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird befo...

CVE-2009-0357

CVE-2009-0357 affects Mozilla Firefox (before 3.0.6) and SeaMonkey (before 1.1.15). The vulnerability stems from not properly restricting access from web pages to the Set-Cookie/Set-Cookie2 HTTP response headers, allowing an attacker to read cookie data via XMLHttpRequest calls and potentially ex...

CVE-2009-1308

CVE-2009-1308 is a cross-site scripting (XSS) vulnerability in Mozilla Firefox prior to 3.0.9, also affecting Thunderbird and SeaMonkey. The issue allows remote attackers to inject arbitrary web script or HTML via vectors involving XBL JavaScript bindings and remote stylesheets, with exploitation...

CVE-2009-1309

CVE-2009-1309 affects Mozilla Firefox (pre-3.0.9) and its related Mozilla suite components (Thunderbird, SeaMonkey). The issue arises from improper Same Origin Policy handling for XMLHttpRequest (document principal mismatch) and XPCNativeWrapper.toString (incorrect proto scope), enabling cross-si...

CVE-2012-0473

CVE-2012-0473 : In Mozilla Firefox and related Mozilla products, the WebGLBuffer::FindMaxUshortElement function calls FindMaxElementInSubArray with incorrect template arguments, allowing remote attackers to obtain sensitive information from video memory via a crafted WebGL.drawElements call. Affe...

CVE-2012-0478

CVE-2012-0478 affects Mozilla Firefox WebGL texImage2D in Firefox 4.x–11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0–11.0 and ESR 10.x before 10.0.4, and SeaMonkey before 2.9. Root cause is improper restriction of JSVAL_TO_OBJECT casts in WebGL, enabling remote code execution via a crafted...

CVE-2012-1947

CVE-2012-1947 describes a heap-based buffer overflow in the utf16_to_isolatin1 function affecting Mozilla Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The vulnerability allows remote attackers to execute arb...

CVE-2012-1958

CVE-2012-1958 is a use-after-free vulnerability in Mozilla Firefox’s nsGlobalWindow::PageHidden path that could allow remote code execution. The vulnerability affects Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2...

CVE-2013-0772

CVE-2013-0772 is a memory-safety issue in Mozilla's image rendering: RasterImage::DrawFrameTo allows out-of-bounds reads in crafted GIFs, enabling possible information disclosure or denial of service. Affected products and versions per connected docs: Mozilla Firefox up to version 19.0 (prior to ...

CVE-2014-1483

Technical details for CVE-2014-1483 are not publicly provided in the connected documents; sources reference the CVE but do not disclose affected products, versions, root cause, impact, or fixes. Monitor for updates.

CVE-2009-0774

The CVE-2009-0774 entry affects the Mozilla layout/JavaScript stack: Firefox 2 and 3 prior to 3.0.7, Thunderbird prior to 2.0.0.21, and SeaMonkey prior to 1.1.15 are vulnerable to remote-triggered denial of service and potential arbitrary code execution via gczeal-related vectors (distinct from C...

CVE-2010-2754

CVE-2010-2754 affects Mozilla Firefox 3.5.x before 3.5.11, Firefox 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6. It relates to the window.onerror path and may allow a remote attacker to obtain sensitive information about script parameters v...

CVE-2010-3166

CVE-2010-3166 concerns a heap-based buffer overflow in Mozilla code (nsTextFrameUtils::TransformText) that could allow remote code execution via a bidirectional text run. Affected products/versions: Firefox before 3.5.12 and 3.6.x before 3.6.9; Thunderbird before 3.0.7 and 3.1.x before 3.1.3; Sea...

CVE-2014-1594

CVE-2014-1594 affects Mozilla Firefox (pre-34.0), Firefox ESR (pre-31.3), Thunderbird (pre-31.3), and SeaMonkey (pre-2.31). The underlying issue is a casting error: an incorrect cast from the BasicThebesLayer data type to the BasicContainerLayer data type. This can allow a remote attacker to exec...

CVE-2014-8639

CVE-2014-8639 affects Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32. It improperly interprets Set-Cookie headers in responses with a 407 Proxy Authentication Required status, enabling a remote proxy to perform session fixation by inj...

CVE-2012-4213

The CVE-2012-4213 issue is a concrete use-after-free vulnerability in Mozilla codepath: nsEditor::FindNextLeafNode affects Firefox and related products. Affected components per the initial description are Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14, with remote...

CVE-2013-1708

Summary (CVE-2013-1708) : Mozilla Firefox before 23.0 and SeaMonkey before 2.20 were vulnerable to a denial-of-service via a crafted WAV file that is not properly handled by nsCString::CharAt, causing an application crash. OpenSUSE/SUSE advisories (and the Gentoo GLSA reference) link this CVE to ...

CVE-2013-5593

The CVE-2013-5593 issue affects Mozilla Firefox (and related Mozilla products) where the SELECT element’s handling of HTML in dropdowns did not properly restrict content, allowing remote attackers to spoof the address bar or perform clickjacking via navigation-redirect vectors. Affected products/...

CVE-2009-1392

The CVE-2009-1392 issue affects Mozilla Firefox 3 before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17. It enables memory corruption that can cause a denial of service or potentially allow arbitrary code execution via multiple code paths in the browser engine and UI (e.g., nsEv...

CVE-2012-1957

CVE-2012-1957 : An unspecified parser-utility class in Mozilla Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 mishandles EMBED elements inside RSS description feeds, enabling remote XSS via a feed. Affected pro...

CVE-2012-3994

Mode C: CVE-2012-3994 affects Mozilla Firefox family and related Mozilla components (e.g., Firefox, Firefox ESR, Thunderbird, SeaMonkey). Root cause: use of Object.defineProperty to shadow the top object and interaction with top.location, enabling remote XSS via a binary plugin. Affected versions...

CVE-2012-4181

CVE-2012-4181 is a use-after-free in Mozilla Firefox's nsSMILAnimationController::DoSample that can lead to remote code execution or a denial of service (heap memory corruption). Affected products include Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunde...

CVE-2013-0773

CVE-2013-0773 corresponds to a vulnerability in the Chrome Object Wrapper (COW) and System Only Wrapper (SOW) security wrappers in Mozilla-based products. The issue allowed modifications to a prototype, enabling a non-specified remote site to access chrome objects or potentially execute JavaScrip...

CVE-2013-5614

Affected software: Mozilla Firefox <= 25.x/26.0 and SeaMonkey

CVE-2012-0460

CVE-2012-0460 affects Mozilla Firefox 4.x–10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0–10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8. The issue arises from insufficiently restricting write access to the window.fullScreen object, enabling remote pages to spoof the use...