CVE-2012-1962

CVE-2012-1962 is a use-after-free in Mozilla’s JSDependentString::undepend that affects Firefox 4.x–13.0, ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, and SeaMonkey before 2.11, enabling remote memory corruption and possibly arbitrary code execution. Connected advisories (e.g., MFSA2012-52 and r...

CVE-2012-3988

CVE-2012-3988 is a use-after-free vulnerability in Mozilla Firefox (pre-16.0), Firefox ESR (pre-10.0.8), Thunderbird (pre-16.0), Thunderbird ESR (pre-10.0.8), and SeaMonkey (pre-2.13). It can be triggered via mozRequestFullScreen with full-screen mode and navigation via history.back, potentially ...

CVE-2012-3989

CVE-2012-3989 affects Mozilla Firefox (and related Mozilla products) prior to version 16.0, Thunderbird prior to 16.0, and SeaMonkey prior to 2.13. The vulnerability is a crash caused by an invalid cast when using the instanceof operator on certain JavaScript objects, which could allow remote att...

CVE-2012-3995

CVE-2012-3995 affects Mozilla Firefox and related Mozilla applications. The vulnerability arises from the IsCSSWordSpacingSpace function in Firefox (and Firefox ESR 10.x, Thunderbird, SeaMonkey as listed) where an out-of-bounds read could be exploited to run arbitrary code or trigger a denial-of-...

CVE-2013-0762

CVE-2013-0762 is a use-after-free in imgRequest::OnStopFrame affecting Mozilla Firefox prior to 18.0 (and ESR 10.x before 10.0.12, ESR 17.x before 17.0.1), Thunderbird prior to 17.0.2, and SeaMonkey prior to 2.15. It can allow remote code execution or a denial of service via heap memory corruptio...

CVE-2014-1504

CVE-2014-1504 affects Mozilla Firefox (pre-28.0) and SeaMonkey (pre-2.25). The session-restore feature does not honor the CSP of data: URLs, enabling remote XSS via a crafted document opened after a browser restart. The impact stated is cross-site scripting with partial integrity/complete confide...

CVE-2014-1526

Summary : CVE-2014-1526 affects Mozilla Firefox up to 29.0 (and SeaMonkey up to 2.26). The XrayWrapper implementation could be abused by a user via a crafted site visited in a debugger to bypass access restrictions, causing unwrapping operations and calls to DOM methods on unwrapped objects. This...

CVE-2006-3677

A memory corruption vulnerability exists in Mozilla Firefox (before 1.5.0.5) and SeaMonkey (before 1.0.3) due to insufficient checks on user-supplied data when assigning values to objects. Specifically, when Java starts up, it may reference properties of the window.navigator object, triggering a ...

CVE-2008-1233

CVE-2008-1233 affects Mozilla Firefox <2.0.0.13, Thunderbird <2.0.0.13, and SeaMonkey

CVE-2008-5012

CVE-2008-5012 affects Mozilla Firefox 2.x, Thunderbird 2.x, and SeaMonkey 1.x (before versions 2.0.0.18 / 1.1.13) where processing a canvas element and an HTTP redirect can bypass the same-origin policy, allowing access to images not directly accessible to the attacker. Several connected sources ...

CVE-2009-3988

CVE-2009-3988 affects Mozilla Firefox 3.0.x (before 3.0.18), Firefox 3.5.x (before 3.5.8) and SeaMonkey before 2.0.3. The issue arises from not properly restricting read access to object properties in showModalDialog, allowing a crafted dialogArguments value to bypass the Same Origin Policy and e...

CVE-2012-0446

CVE-2012-0446 maps to multiple XSS flaws in Mozilla Firefox (4.x–9.0), Thunderbird (5.0–9.0), and SeaMonkey before 2.7, tied to improper XPConnect frame-script restrictions. Connected advisories confirm affected products and patches: openSUSE/SUSE updates reference Firefox ESR packages (e.g., fir...

CVE-2012-0472

CVE-2012-0472 is present in the MiracleLinux AXSA:2012-874:05 advisory, which mentions Mozilla Firefox 4.x–11.0 (and related products like Thunderbird/SeaMonkey in affected lines) and links the issue to the cairo-dwrite font rendering code. The description in the initial document (and mirrored in...

CVE-2012-1938

CVE-2012-1938 affects Mozilla's browser engine and is described in the MiracleLinux AXSA:2012-857 advisory as multiple vulnerabilities in Firefox (and related components) that could allow memory corruption and remote code execution. Specifically, it impacts Mozilla Firefox before 13.0, Thunderbir...

CVE-2013-0774

CVE-2013-0774 affects Mozilla Firefox

CVE-2007-0981

CVE-2007-0981 affects Mozilla-based browsers (Firefox up to 1.5.0.10 and 2.x up to 2.0.0.2; SeaMonkey up to 1.0.8). The root cause is a handling flaw when location.hostname is modified via a URI containing a null byte, interacting with DNS resolver code, which can bypass the same-origin policy an...

CVE-2009-3372

CVE-2009-3372 affects Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0. It allows remote attackers to execute arbitrary code via a crafted regular expression in a Proxy Auto-configuration (PAC) file. The linked MiracleLinux advisory AXSA:2009-419:04 lists this CVE am...

CVE-2011-0073

CVE-2011-0073 affects Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14. The issue arises from improper use of nsTreeRange data structures, leading to a dangling pointer which allows remote code execution via unspecified vectors. The OpenVAS/MiracleLinux entries r...

CVE-2012-0447

CVE-2012-0447 affects Mozilla Firefox 4.x–9.0, Mozilla Thunderbird 5.0–9.0, and SeaMonkey

CVE-2012-1944

CVE-2012-1944 affects Mozilla Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The underlying issue is CSP not blocking inline event handlers, enabling potential cross-site scripting via crafted HTML documents. ...

CVE-2012-1945

CVE-2012-1945 affects Mozilla Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The issue occurs when an HTML document loads a shortcut file (.lnk) inside an IFRAME, demonstrated by a network share on Windows or ...

CVE-2012-3976

CVE-2012-3976 affects Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, and SeaMonkey before 2.12. The issue arises from improper handling of onLocationChange events when navigating between https sites, allowing remote attackers to spoof the X.509 certificate information in the address...

CVE-2007-0996

The CVE-2007-0996 issue affects Mozilla Firefox versions before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8. The root cause is that child frames inherit the default charset from the parent window, enabling cross-site scripting (XSS) when using certain character sets (demonstrated ...

CVE-2009-0777

CVE-2009-0777 affects Mozilla Firefox (before 3.0.7), Mozilla Thunderbird (before 2.0.0.21), and SeaMonkey (before 1.1.15). The issue arises when decoding invisible characters displayed in the location bar, causing an incorrect address to be shown. This can enable remote attackers to spoof URLs a...

CVE-2012-0463

The CVE-2012-0463 issue affects Mozilla Firefox browser engine in Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR before 10.0.3, and SeaMonkey before 2.8. The flaw is in the nsWindow implementation not val...

CVE-2013-0794

CVE-2013-0794 affects Mozilla Firefox (pre-20.0) and SeaMonkey (pre-2.17) where origin spoofing of tab-modal dialogs enables phishing via crafted sites. Root cause: tab-modal dialogs did not enforce origin checks, allowing a remote site to spoof the dialog origin. Impact: potential credential/phi...

CVE-2008-0418

CVE-2008-0418 is a directory-traversal flaw in Chrome URL handling that could allow remote attackers to read local files (Javascript, images, stylesheets) and potentially exfiltrate session data. Affected: Mozilla Firefox <= 2.0.0.11/12, Thunderbird <= 2.0.0.11/12, SeaMonkey

CVE-2008-5018

CVE-2008-5018 affects Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13. Root cause: insufficient class checking in the Date class in the JavaScript engine, enabling remote crash (DoS). Remediation from the initial desc...

CVE-2009-3373

CVE-2009-3373 is a heap-based buffer overflow in the GIF image parser affecting Mozilla Firefox versions before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0. The issue allows remote attackers to execute arbitrary code via unspecified vectors. The connected MiracleLinux advisory lists C...

CVE-2010-0181

CVE-2010-0181 details (useful for triage): Affects Mozilla Firefox before 3.5.9 and 3.6.x before 3.6.2, and SeaMonkey before 2.0.4. The vulnerability occurs when an IMG element’s SRC attribute redirects to a mailto: URL, which can cause the external mail handler to launch. This could be exploited...

CVE-2012-3964

CVE-2012-3964 is a use-after-free in gfxTextRun::GetUserData in Mozilla Firefox before 15.0 (and similar affected components in Thunderbird/SeaMonkey) that allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. Public/conne...

CVE-2012-4187

CVE-2012-4187 is listed in the MiracleLinux/Miracle Linux AXSA advisory as affecting Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13. The vulnerability is described as an issue with managing a cert...

CVE-2013-0778

CVE-2013-0778 affects Mozilla Firefox (pre-19.0), Thunderbird (pre-17.0.3), and SeaMonkey (pre-2.16). The issue stems from use-after-free and out-of-bounds/read vulnerabilities in the browser components (notably flagged in MFSA 2013-28), enabling remote code execution or denial of service via uns...

CVE-2013-6673

Technical details about CVE-2013-6673 are not publicly available in the provided connected documents; monitor for updates.

CVE-2006-1727

CVE-2006-1727 affects Mozilla-derived browsers: Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1. The issue allows remote attackers to gain chrome privileges through multiple attack vectors related to the use of XBL...

CVE-2006-4340

CVE-2006-4340 is a cryptographic flaw in Mozilla NSS prior to 3.11.3 (used in Firefox ≤1.5.0.7, Thunderbird ≤1.5.0.7, SeaMonkey ≤1.0.5) where RSA with exponent 3 can produce signature forgery due to improper handling of extra data in PKCS #1 v1.5 verification. This enables remote attackers to for...

CVE-2010-1206

CVE-2010-1206 affects Mozilla Firefox and SeaMonkey. The startDocumentLoad function in Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, bypasses the Same Origin Policy under conditions involving an about:blank document and a currently loading document. This enables ...

CVE-2011-0051

CVE-2011-0051 affects Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12. The issue arises from not properly handling certain recursive eval calls, which can force a user to respond positively to a dialog question (e.g., granting privileges). This is a remote-facin...

CVE-2011-3658

The CVE-2011-3658 issue affects Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5, where the SVG implementation mishandles DOMAttrModified interactions, leading to out-of-bounds memory access when removing SVG elements. This can enable a remote attacker to cause a denial of service or poten...

CVE-2013-0767

CVE-2013-0767 affects Mozilla Firefox (and related Mozilla components) with the nsSVGPathElement::GetPathLengthScale path handling. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service via an out-of-bounds read, reported for Firefox before 18.0, ESR 10....

CVE-2013-1721

CVE-2013-1721 is an integer overflow in the drawLineLoop function of libGLESv2 in ANGLE, used by Firefox/SeaMonkey. Connected OpenSUSE advisories indicate this affects openSUSE Tumbleweed via firefox-esr-128.5.1-1.1, fixed by updating to a newer Firefox ESR package. The advisory confirms the fix ...

CVE-2013-6671

CVE-2013-6671 affects Mozilla Firefox before 26.0 (and corresponding ESR/Thunderbird/SeaMonkey releases listed) where nsGfxScrollFrameInner::IsLTR can be abused by crafted JavaScript used with ordered list elements to trigger remote code execution. The vulnerability is a browser-engine issue that...

CVE-2014-1500

CVE-2014-1500 affects Mozilla Firefox prior to 28.0 and SeaMonkey prior to 2.25. The issue allows remote attackers to cause resource exhaustion and application hang via onbeforeunload events that trigger background JavaScript execution. Exploitation details are not provided in the available docum...

CVE-2007-0777

CVE-2007-0777 affects Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, as well as Thunderbird before 1.5.0.10 and SeaMonkey before 1.0.8. The issue is a memory corruption vulnerability in the JavaScript engine that can be triggered by crafted JavaScript, resulting in a crash and possibly a...

CVE-2010-3772

Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, contain a vulnerability where a DIV inside a XUL tree's treechildren causes index calculations to be incorrect, enabling arbitrary code execution via crafted content. MiracleLinux AXSA:2010-507:08 lists CVE-2010-3...

CVE-2011-0077

CVE-2011-0077 corresponds to an unspecified vulnerability in the Mozilla family browser engine affecting Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14. The issue could lead to memory corruption and application crash, with possi...

CVE-2012-1937

CVE-2012-1937 affects Mozilla Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The vulnerability arises from multiple unspecified memory-safety/behavioral issues in the browser engine that could cause memory cor...

CVE-2012-1946

CVE-2012-1946 is a Use-after-free in Mozilla’s browser engine (nsINode::ReplaceOrInsertBefore) affecting Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0 and ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The connected docs confirm this is a remote code-execution risk vi...

CVE-2013-0792

Technical details for CVE-2013-0792 (affected product/version, root cause, impact, fixes) are not provided in the connected documents. The sources only reference the CVE in advisories/listings. Monitor for updates.

CVE-2013-1704

CVE-2013-1704 : A use-after-free in Mozilla’s DOM path occurs in nsINode::GetParentNode during a SetBody mutation event, enabling remote attackers to cause memory corruption and possibly execute arbitrary code or crash the app. The connected advisory MFSA2013-64 confirms the vulnerability in Fire...