CVE-2007-0996

The CVE-2007-0996 issue affects Mozilla Firefox versions before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8. The root cause is that child frames inherit the default charset from the parent window, enabling cross-site scripting (XSS) when using certain character sets (demonstrated ...

CVE-2009-0777

CVE-2009-0777 affects Mozilla Firefox (before 3.0.7), Mozilla Thunderbird (before 2.0.0.21), and SeaMonkey (before 1.1.15). The issue arises when decoding invisible characters displayed in the location bar, causing an incorrect address to be shown. This can enable remote attackers to spoof URLs a...

CVE-2012-0472

CVE-2012-0472 is present in the MiracleLinux AXSA:2012-874:05 advisory, which mentions Mozilla Firefox 4.x–11.0 (and related products like Thunderbird/SeaMonkey in affected lines) and links the issue to the cairo-dwrite font rendering code. The description in the initial document (and mirrored in...

CVE-2012-0474

CVE-2012-0474 describes a cross-site scripting (XSS) vulnerability in the docshell of Mozilla Firefox 4.x–11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0–11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9. The issue is a Universal XSS (UXSS) flaw that lets remote attackers i...

CVE-2012-1938

CVE-2012-1938 affects Mozilla's browser engine and is described in the MiracleLinux AXSA:2012-857 advisory as multiple vulnerabilities in Firefox (and related components) that could allow memory corruption and remote code execution. Specifically, it impacts Mozilla Firefox before 13.0, Thunderbir...

CVE-2012-3989

CVE-2012-3989 affects Mozilla Firefox (and related Mozilla products) prior to version 16.0, Thunderbird prior to 16.0, and SeaMonkey prior to 2.13. The vulnerability is a crash caused by an invalid cast when using the instanceof operator on certain JavaScript objects, which could allow remote att...

CVE-2013-0774

CVE-2013-0774 affects Mozilla Firefox

CVE-2013-0794

CVE-2013-0794 affects Mozilla Firefox (pre-20.0) and SeaMonkey (pre-2.17) where origin spoofing of tab-modal dialogs enables phishing via crafted sites. Root cause: tab-modal dialogs did not enforce origin checks, allowing a remote site to spoof the dialog origin. Impact: potential credential/phi...

CVE-2013-1711

CVE-2013-1711 affects Mozilla Firefox (before 23.0) and SeaMonkey (before 2.20); the XrayWrapper implementation fails to properly address an XBL scope bypass caused by non-native arguments in XBL function calls. This bypass can enable remote XSS through access to an unprivileged object, as docume...

CVE-2013-6671

CVE-2013-6671 affects Mozilla Firefox before 26.0 (and corresponding ESR/Thunderbird/SeaMonkey releases listed) where nsGfxScrollFrameInner::IsLTR can be abused by crafted JavaScript used with ordered list elements to trigger remote code execution. The vulnerability is a browser-engine issue that...

CVE-2013-6673

Technical details about CVE-2013-6673 are not publicly available in the provided connected documents; monitor for updates.

CVE-2014-1504

CVE-2014-1504 affects Mozilla Firefox (pre-28.0) and SeaMonkey (pre-2.25). The session-restore feature does not honor the CSP of data: URLs, enabling remote XSS via a crafted document opened after a browser restart. The impact stated is cross-site scripting with partial integrity/complete confide...

CVE-2011-0073

CVE-2011-0073 affects Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14. The issue arises from improper use of nsTreeRange data structures, leading to a dangling pointer which allows remote code execution via unspecified vectors. The OpenVAS/MiracleLinux entries r...

CVE-2011-3658

The CVE-2011-3658 issue affects Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5, where the SVG implementation mishandles DOMAttrModified interactions, leading to out-of-bounds memory access when removing SVG elements. This can enable a remote attacker to cause a denial of service or poten...

CVE-2012-0447

CVE-2012-0447 affects Mozilla Firefox 4.x–9.0, Mozilla Thunderbird 5.0–9.0, and SeaMonkey

CVE-2012-1955

The CVE applies to Mozilla Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11. It enables remote attackers to spoof the address bar using navigation history (history.forward/history.back). Root cause is likely a fl...

CVE-2014-1500

CVE-2014-1500 affects Mozilla Firefox prior to 28.0 and SeaMonkey prior to 2.25. The issue allows remote attackers to cause resource exhaustion and application hang via onbeforeunload events that trigger background JavaScript execution. Exploitation details are not provided in the available docum...

CVE-2014-1589

CVE-2014-1589 affects Mozilla Firefox (before 34.0) and SeaMonkey (before 2.31). The issue is an incorrect primary namespace in stylesheets, which allows remote attackers to bypass access restrictions via an XBL binding. Public references in the provided documents confirm the vulnerability and re...

CVE-2006-4340

CVE-2006-4340 is a cryptographic flaw in Mozilla NSS prior to 3.11.3 (used in Firefox ≤1.5.0.7, Thunderbird ≤1.5.0.7, SeaMonkey ≤1.0.5) where RSA with exponent 3 can produce signature forgery due to improper handling of extra data in PKCS #1 v1.5 verification. This enables remote attackers to for...

CVE-2007-3845

CVE-2007-3845 affects Mozilla Firefox (before 2.0.0.6), Thunderbird (before 1.5.0.13 and 2.x before 2.0.0.6), and SeaMonkey (before 1.1.4). The issue allows remote code execution via a vector tied to launching a file handling program based on the file extension at the end of the URI, a variant of...

CVE-2008-1233

CVE-2008-1233 affects Mozilla Firefox <2.0.0.13, Thunderbird <2.0.0.13, and SeaMonkey

CVE-2008-5018

CVE-2008-5018 affects Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13. Root cause: insufficient class checking in the Date class in the JavaScript engine, enabling remote crash (DoS). Remediation from the initial desc...

CVE-2009-3373

CVE-2009-3373 is a heap-based buffer overflow in the GIF image parser affecting Mozilla Firefox versions before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0. The issue allows remote attackers to execute arbitrary code via unspecified vectors. The connected MiracleLinux advisory lists C...

CVE-2011-0051

CVE-2011-0051 affects Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12. The issue arises from not properly handling certain recursive eval calls, which can force a user to respond positively to a dialog question (e.g., granting privileges). This is a remote-facin...

CVE-2012-1937

CVE-2012-1937 affects Mozilla Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The vulnerability arises from multiple unspecified memory-safety/behavioral issues in the browser engine that could cause memory cor...

CVE-2013-0762

CVE-2013-0762 is a use-after-free in imgRequest::OnStopFrame affecting Mozilla Firefox prior to 18.0 (and ESR 10.x before 10.0.12, ESR 17.x before 17.0.1), Thunderbird prior to 17.0.2, and SeaMonkey prior to 2.15. It can allow remote code execution or a denial of service via heap memory corruptio...

CVE-2014-1485

CVE-2014-1485 affects Mozilla Firefox (prior to 27.0) and SeaMonkey (prior to 2.24). The CSP implementation in these browsers evaluates style-src directives for XSLT processing rather than script-src, potentially allowing remote attackers to execute arbitrary XSLT code through insufficient style-...

CVE-2014-1498

CVE-2014-1498 : The vulnerability affects Mozilla Firefox before 28.0 and SeaMonkey before 2.25, where crypto.generateCRMFRequest fails to validate a specific key type. This can cause remote crashes/DoS via vectors that trigger generation of a key that supports the Elliptic Curve ec-dual-use algo...

CVE-2014-1526

Summary : CVE-2014-1526 affects Mozilla Firefox up to 29.0 (and SeaMonkey up to 2.26). The XrayWrapper implementation could be abused by a user via a crafted site visited in a debugger to bypass access restrictions, causing unwrapping operations and calls to DOM methods on unwrapped objects. This...

CVE-2014-8642

Mozilla Firefox < 35.0 and SeaMonkey

CVE-2009-1571

CVE-2009-1571 describes a use-after-free vulnerability in the HTML parser affecting Mozilla Firefox 3.0.x (before 3.0.18) and 3.5.x (before 3.5.8), Thunderbird before 3.0.2, and SeaMonkey before 2.0.3. The issue allows remote attackers to execute arbitrary code by triggering access to freed objec...

CVE-2009-3372

CVE-2009-3372 affects Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0. It allows remote attackers to execute arbitrary code via a crafted regular expression in a Proxy Auto-configuration (PAC) file. The linked MiracleLinux advisory AXSA:2009-419:04 lists this CVE am...

CVE-2010-0181

CVE-2010-0181 details (useful for triage): Affects Mozilla Firefox before 3.5.9 and 3.6.x before 3.6.2, and SeaMonkey before 2.0.4. The vulnerability occurs when an IMG element’s SRC attribute redirects to a mailto: URL, which can cause the external mail handler to launch. This could be exploited...

CVE-2011-2986

CVE-2011-2986 affects Mozilla Firefox 4.x–5, Thunderbird before 6, and SeaMonkey 2.x before 2.3 on Windows when using Direct2D. The issue allows cross‑origin data theft by inserting image data from a different domain into a canvas, potentially bypassing the Same Origin Policy. Root cause, as stat...

CVE-2012-1944

CVE-2012-1944 affects Mozilla Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The underlying issue is CSP not blocking inline event handlers, enabling potential cross-site scripting via crafted HTML documents. ...

CVE-2012-4187

CVE-2012-4187 is listed in the MiracleLinux/Miracle Linux AXSA advisory as affecting Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13. The vulnerability is described as an issue with managing a cert...

CVE-2013-0792

Technical details for CVE-2013-0792 (affected product/version, root cause, impact, fixes) are not provided in the connected documents. The sources only reference the CVE in advisories/listings. Monitor for updates.

CVE-2013-1721

CVE-2013-1721 is an integer overflow in the drawLineLoop function of libGLESv2 in ANGLE, used by Firefox/SeaMonkey. Connected OpenSUSE advisories indicate this affects openSUSE Tumbleweed via firefox-esr-128.5.1-1.1, fixed by updating to a newer Firefox ESR package. The advisory confirms the fix ...

CVE-2014-8637

CVE-2014-8637 affects Mozilla Firefox <35.0 and SeaMonkey

CVE-2006-5462

CVE-2006-5462 affects the NSS library used by Mozilla Firefox (pre-3.11.3 NSS) and by Thunderbird/SeaMonkey in versions before the listed patched releases. The issue arises when using an RSA key with exponent 3 and corrupted/extra data in a PKCS#1 signature, enabling forgery of SSL/TLS and email ...

CVE-2007-0777

CVE-2007-0777 affects Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, as well as Thunderbird before 1.5.0.10 and SeaMonkey before 1.0.8. The issue is a memory corruption vulnerability in the JavaScript engine that can be triggered by crafted JavaScript, resulting in a crash and possibly a...

CVE-2008-4060

CVE-2008-4060 affects Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12). The flaw, exploitable via document.loadBindingDocument and XSLT processing, could allow remote attackers to execute arbitrary code with chrome privileges. Th...

CVE-2008-5012

CVE-2008-5012 affects Mozilla Firefox 2.x, Thunderbird 2.x, and SeaMonkey 1.x (before versions 2.0.0.18 / 1.1.13) where processing a canvas element and an HTTP redirect can bypass the same-origin policy, allowing access to images not directly accessible to the attacker. Several connected sources ...

CVE-2011-0053

CVE-2011-0053 : Multiple memory-safety vulnerabilities in the Mozilla Firefox/Thunderbird/SeaMonkey browser engine were reported. The issue allows remote attackers to cause memory corruption and application crashes, and possibly execute arbitrary code via unknown vectors. The advisory details ind...

CVE-2011-0077

CVE-2011-0077 corresponds to an unspecified vulnerability in the Mozilla family browser engine affecting Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14. The issue could lead to memory corruption and application crash, with possi...

CVE-2012-0475

The CVE-2012-0475 issue affects Mozilla Firefox 4.x–11.0, Thunderbird 5.0–11.0, and SeaMonkey before 2.9, caused by improper construction of Origin and Sec-WebSocket-Origin HTTP headers that could allow bypassing an IPv6 literal ACL via cross-site XMLHttpRequest or WebSocket on a nonstandard port...

CVE-2013-0766

CVE-2013-0766 is a use-after-free in the ~nsHTMLEditRules implementation affecting Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15. The vulnerabili...

CVE-2014-1591

CVE-2014-1591 affects Mozilla Firefox 33.0 and SeaMonkey before 2.31, where CSP violation reports may leak path information. The issue allows a remote attacker to obtain sensitive data via a site receiving a CSP violation report after a redirect. The connected updates document that this CSP leak ...

CVE-2008-2803

CVE-2008-2803 affects Mozilla Firefox <= 2.0.0.14/2.0.0.15? and SeaMonkey

CVE-2010-1206

CVE-2010-1206 affects Mozilla Firefox and SeaMonkey. The startDocumentLoad function in Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, bypasses the Same Origin Policy under conditions involving an about:blank document and a currently loading document. This enables ...