CVE-2010-2754

CVE-2010-2754 affects Mozilla Firefox 3.5.x before 3.5.11, Firefox 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6. It relates to the window.onerror path and may allow a remote attacker to obtain sensitive information about script parameters v...

CVE-2010-3166

CVE-2010-3166 concerns a heap-based buffer overflow in Mozilla code (nsTextFrameUtils::TransformText) that could allow remote code execution via a bidirectional text run. Affected products/versions: Firefox before 3.5.12 and 3.6.x before 3.6.9; Thunderbird before 3.0.7 and 3.1.x before 3.1.3; Sea...

CVE-2011-2986

CVE-2011-2986 affects Mozilla Firefox 4.x–5, Thunderbird before 6, and SeaMonkey 2.x before 2.3 on Windows when using Direct2D. The issue allows cross‑origin data theft by inserting image data from a different domain into a canvas, potentially bypassing the Same Origin Policy. Root cause, as stat...

CVE-2013-0752

Technical details for CVE-2013-0752 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2006-1728

CVE-2006-1728 affects multiple Mozilla-based products (Firefox and Thunderbird 1.x < 1.5.0.2; Mozilla Suite < 1.7.13; SeaMonkey

CVE-2008-0415

CVE-2008-0415 affects Mozilla Firefox < 2.0.0.12, Thunderbird < 2.0.0.12, and SeaMonkey

CVE-2012-0460

CVE-2012-0460 affects Mozilla Firefox 4.x–10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0–10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8. The issue arises from insufficiently restricting write access to the window.fullScreen object, enabling remote pages to spoof the use...

CVE-2012-4213

The CVE-2012-4213 issue is a concrete use-after-free vulnerability in Mozilla codepath: nsEditor::FindNextLeafNode affects Firefox and related products. Affected components per the initial description are Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14, with remote...

CVE-2013-5614

Affected software: Mozilla Firefox <= 25.x/26.0 and SeaMonkey

CVE-2013-5619

CVE-2013-5619 describes a vulnerability in Mozilla’s SpiderMonkey JavaScript engine where the binary-search implementation could overflow, potentially enabling a remote attacker to cause a denial of service via crafted JavaScript. The initial Mozilla/OpenSUSE/IBM advisories confirm this is a Java...

CVE-2009-3388

CVE-2009-3388 affects Mozilla Firefox 3.5.x prior to 3.5.6 and SeaMonkey prior to 2.0.1, with the underlying issue described as memory safety problems. Public disclosures in multiple advisories indicate that the vulnerability involves memory-safety issues in the liboggplay library (memory safety ...

CVE-2011-3663

CVE-2011-3663 affects Mozilla Firefox 4.x–8.0, Thunderbird 5.0–8.0, and SeaMonkey before 2.6. It allows remote attackers to capture keystrokes entered on a web page via SVG animation accessKey events, even when JavaScript is disabled. The description in the provided documents states the affected ...

CVE-2012-1963

CVE-2012-1963 is a real vulnerability described in multiple sources. It affects Mozilla Firefox 4.x–13.0, Firefox ESR 10.x prior to 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x prior to 10.0.6, and SeaMonkey before 2.11. The issue is that the Content Security Policy (CSP) blocked-uri string...

CVE-2013-1720

The CVE-2013-1720 issue affects Mozilla Firefox (pre-24.0), Thunderbird (pre-24.0), and SeaMonkey (pre-2.21) where the nsHtml5TreeBuilder::resetTheInsertionMode logic fails to correctly maintain the insertion-mode stack for template elements. This misstate allows a remote attacker to trigger use ...

CVE-2013-5603

The vulnerability CVE-2013-5603 affects Mozilla Firefox before 25.0 (and related ESR/Thunderbird/SeaMonkey releases) via a use-after-free in nsContentUtils::ContentIsHostIncludingDescendantOf, enabling remote code execution or heap memory corruption through HTML document templates. Impact is remo...

CVE-2013-5607

CVE-2013-5607 describes an integer overflow in Mozilla NSPR’s PL_ArenaAllocate, exploited via crafted X.509 certificates to trigger a crash (possible other impact) in affected Firefox/SeaMonkey builds. Affected products include Firefox before 25.0.1, Firefox ESR 17.x before 17.0.11, Firefox 24.x ...

CVE-2013-6672

CVE-2013-6672: Firefox (Linux) and SeaMonkey are affected by a Linux clipboard information disclosure via middle-click paste. The initial entry specifies Firefox < 26.0 and SeaMonkey

CVE-2015-0797

CVE-2015-0797 affects GStreamer up to 1.4.4 (GStreamer 1.4.x) when used by Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux. The flaw is a buffer over-read in H.264 video data processing in the GStreamer pipeline (m4v files) that can cause a denial o...

CVE-2012-0451

CVE-2012-0451 affects Mozilla Firefox 4.x–10.0 (and ESR 10.x before 10.0.3), Thunderbird 5.0–10.0, and SeaMonkey before 2.8. The issue is a CRLF injection via crafted HTTP headers that can bypass CSP restrictions and potentially enable XSS. Remediation in the connected documents points to applyin...

CVE-2012-1962

CVE-2012-1962 is a use-after-free in Mozilla’s JSDependentString::undepend that affects Firefox 4.x–13.0, ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, and SeaMonkey before 2.11, enabling remote memory corruption and possibly arbitrary code execution. Connected advisories (e.g., MFSA2012-52 and r...

CVE-2012-3984

CVE-2012-3984 affects Mozilla Firefox (<16.0), Mozilla Thunderbird (<16.0), and SeaMonkey (

CVE-2013-1723

CVE-2013-1723 affects Mozilla Firefox (before 24.0), Thunderbird (before 24.0) and SeaMonkey (before 2.21). The NativeKey widget processes key messages after destruction by a dispatched event listener, enabling a denial of service (application crash) via incorrect event usage after widget-memory ...

CVE-2013-1728

Affected software: Mozilla Firefox (before 24.0), Thunderbird (before 24.0), and SeaMonkey (before 2.21). Root cause: IonMonkey memory not properly initialized when Valgrind mode is used, enabling potential leakage of sensitive data. Impact: remote attackers could obtain sensitive information via...

CVE-2007-0775

CVE-2007-0775 involves multiple unspecified vulnerabilities in the layout engine of Mozilla Firefox (pre-1.5.0.10 and pre-2.0.0.2), Thunderbird (pre-1.5.0.10), and SeaMonkey (pre-1.0.8). The issues can cause a denial of service (crash) and potentially allow arbitrary code execution via certain ve...

CVE-2012-3995

CVE-2012-3995 affects Mozilla Firefox and related Mozilla applications. The vulnerability arises from the IsCSSWordSpacingSpace function in Firefox (and Firefox ESR 10.x, Thunderbird, SeaMonkey as listed) where an out-of-bounds read could be exploited to run arbitrary code or trigger a denial-of-...

CVE-2012-5841

CVE-2012-5841 affects Mozilla Firefox (before 17.0), Firefox ESR (10.x before 10.0.11), Thunderbird (before 17.0), Thunderbird ESR (before 10.0.11) and SeaMonkey (before 2.14). The issue arises from cross-origin wrappers with a filtering behavior that fails to restrict write actions, enabling rem...

CVE-2013-0756

CVE-2013-0756 corresponds to a use-after-free in Mozilla Firefox’s obj_toSource path that can be triggered by a crafted web page referencing JavaScript Proxy objects, allowing remote code execution via standard web-visit attack vectors. Affected products include Firefox (pre-18.0), Firefox ESR 17...

CVE-2013-0765

CVE-2013-0765 affects Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16. Root cause: a WebIDL object can be wrapped again, bypassing intended access restrictions. Impact is described as a bypass of access controls via unspecified vectors. Remediation from connected...

CVE-2013-1705

CVE-2013-1705 is a heap-based buffer underflow in the cryptojs_interpret_key_gen_type function affecting Mozilla Firefox before 23.0 and SeaMonkey before 2.20, enabling remote code execution or crash via a crafted CRMF request. Affected products are Firefox (<23.0) and SeaMonkey (

CVE-2013-1724

CVE-2013-1724 is a use-after-free in Mozilla Firefox (and related Mozilla products) where mozilla::dom::HTMLFormElement::IsDefaultSubmitElement can be triggered by a destroyed SELECT element. Affected software includes Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21. The v...

CVE-2013-1738

CVE-2013-1738 describes a use-after-free in Mozilla’s JS_GetGlobalForScopeChain, enabling remote code execution via mismanaged garbage collection in default compartments during frame-chain restoration. Affected products from the provided data include Mozilla Firefox (before 24.0), Thunderbird (be...

CVE-2014-1589

CVE-2014-1589 affects Mozilla Firefox (before 34.0) and SeaMonkey (before 2.31). The issue is an incorrect primary namespace in stylesheets, which allows remote attackers to bypass access restrictions via an XBL binding. Public references in the provided documents confirm the vulnerability and re...

CVE-2012-1955

The CVE applies to Mozilla Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11. It enables remote attackers to spoof the address bar using navigation history (history.forward/history.back). Root cause is likely a fl...

CVE-2012-1961

CVE-2012-1961 affects Mozilla Firefox 4.x–13.0, Firefox ESR 10.x prior to 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x prior to 10.0.6, and SeaMonkey prior to 2.11. The issue is a UI security flaw in how duplicate values in the X-Frame-Options header are handled, which can enable remote att...

CVE-2012-3976

CVE-2012-3976 affects Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, and SeaMonkey before 2.12. The issue arises from improper handling of onLocationChange events when navigating between https sites, allowing remote attackers to spoof the X.509 certificate information in the address...

CVE-2012-5830

CVE-2012-5830 is a use-after-free vulnerability in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 on Mac OS X that allows remote attackers to execute arbitrary code via an HTML document. The con...

CVE-2014-1502

CVE-2014-1502 affects Mozilla Firefox (pre-28.0) and SeaMonkey (pre-2.25). The vulnerability arises in WebGL functions WebGL.compressedTexImage2D and WebGL.compressedTexSubImage2D, enabling remote attackers to bypass Same Origin Policy and render content from a different domain via unspecified ve...

CVE-2014-1525

CVE-2014-1525 affects Mozilla Firefox before 29.0 and SeaMonkey before 2.26, due to improper garbage collection in mozilla::dom::TextTrack::AddCue, enabling remote attackers to trigger a use-after-free and heap memory corruption via a crafted HTML5 Video element. Consequences include possible rem...

CVE-2006-1741

CVE-2006-1741 affects Mozilla Firefox (1.x up to 1.5, and 1.0.x up to 1.0.8), Mozilla Suite up to 1.7.13, and SeaMonkey up to 1.0, enabling remote attackers to inject arbitrary JavaScript into other sites. The root causes involve (1) using a modal alert to suspend an event handler during page loa...

CVE-2007-0996

The CVE-2007-0996 issue affects Mozilla Firefox versions before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8. The root cause is that child frames inherit the default charset from the parent window, enabling cross-site scripting (XSS) when using certain character sets (demonstrated ...

CVE-2008-0593

CVE-2008-0593 affects Gecko-based browsers, notably Firefox < 2.0.0.12 and SeaMonkey

CVE-2010-0169

Technical details about CVE-2010-0169 are not provided in the supplied documents. Please monitor official advisories and vendor patches for affected products and versions.

CVE-2010-1208

CVE-2010-1208 is a use-after-free in Firefox/SeaMonkey DOM attribute cloning: deleting an event attribute node with nonzero reference count could lead to remote code execution. Affected: Firefox 3.5.x before 3.5.11; 3.6.x before 3.6.7; SeaMonkey before 2.0.6. Remediation: upgrade to Firefox 3.5.1...

CVE-2011-2989

The CVE-2011-2989 entry describes a WebGL memory-corruption flaw in the browser engine affecting Firefox 4.x–5 , SeaMonkey 2.x before 2.3 , and Thunderbird before 6 , with potential for memory corruption, DoS, or arbitrary code execution via unspecified vectors. Connected documents confirm instan...

CVE-2011-2999

The CVE-2011-2999 issue affects Mozilla Firefox (pre-3.6.23 and 4.x–5), Thunderbird (pre-6.0), and SeaMonkey (pre-2.3) where a frame named location could shadow window.location, bypassing Same Origin Policy via a crafted site. This is a remote vulnerability with no explicit exploitation details i...

CVE-2011-3004

The CVE-2011-3004 issue affects Mozilla Firefox 4.x–6 and SeaMonkey before 2.4, where the JSSubScriptLoader fails to properly handle XPCNativeWrappers during loadSubScript calls. This weakens the add-on boundary, allowing a crafted web site to exploit unwrapping behavior and escalate privileges. ...

CVE-2012-1938

CVE-2012-1938 affects Mozilla's browser engine and is described in the MiracleLinux AXSA:2012-857 advisory as multiple vulnerabilities in Firefox (and related components) that could allow memory corruption and remote code execution. Specifically, it impacts Mozilla Firefox before 13.0, Thunderbir...

CVE-2013-0774

CVE-2013-0774 affects Mozilla Firefox

CVE-2013-1711

CVE-2013-1711 affects Mozilla Firefox (before 23.0) and SeaMonkey (before 2.20); the XrayWrapper implementation fails to properly address an XBL scope bypass caused by non-native arguments in XBL function calls. This bypass can enable remote XSS through access to an unprivileged object, as docume...

CVE-2013-5596

Affected software: Mozilla Firefox (before 25.0), Firefox ESR (before 24.1, 24.x line), Thunderbird (before 24.1), SeaMonkey (before 2.22). Vulnerability: cycle-collection (CC) in Firefox may misdetermine the thread for releasing an image object, enabling a remote attacker to trigger arbitrary co...