CVE-2012-0447

CVE-2012-0447 affects Mozilla Firefox 4.x–9.0, Mozilla Thunderbird 5.0–9.0, and SeaMonkey

CVE-2012-1946

CVE-2012-1946 is a Use-after-free in Mozilla’s browser engine (nsINode::ReplaceOrInsertBefore) affecting Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0 and ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The connected docs confirm this is a remote code-execution risk vi...

CVE-2012-1949

CVE-2012-1949 affects Mozilla Firefox (4.x–13.0), Mozilla Thunderbird (5.0–13.0), and SeaMonkey (pre-2.11). The description cites multiple browser-engine vulnerabilities that allow remote attackers to trigger memory corruption, leading to a crash or possibly arbitrary code execution via unknown v...

CVE-2012-4205

CVE-2012-4205 affects Mozilla Firefox (prior to 17.0), Mozilla Thunderbird (prior to 17.0), and SeaMonkey (prior to 2.14). The root cause, per the description, is that XMLHttpRequest objects created in sandboxes are assigned the system principal rather than the sandbox principal, enabling CSRF ag...

CVE-2013-0751

CVE-2013-0751 affects Mozilla Firefox on Android (before 18.0) and SeaMonkey (before 2.15). The root cause is that a touch event on an HTML document can be observed across multiple IFRAMEs, enabling information leakage and potentially cross-site scripting (XSS). The issue is noted in the Firefox/...

CVE-2014-1522

Technical details for CVE-2014-1522 are not publicly provided in the connected documents. No specifics on affected products, versions, root cause, impact, or fixes are available; monitor for updates.

CVE-2014-1591

CVE-2014-1591 affects Mozilla Firefox 33.0 and SeaMonkey before 2.31, where CSP violation reports may leak path information. The issue allows a remote attacker to obtain sensitive data via a site receiving a CSP violation report after a redirect. The connected updates document that this CSP leak ...

CVE-2007-3845

CVE-2007-3845 affects Mozilla Firefox (before 2.0.0.6), Thunderbird (before 1.5.0.13 and 2.x before 2.0.0.6), and SeaMonkey (before 1.1.4). The issue allows remote code execution via a vector tied to launching a file handling program based on the file extension at the end of the URI, a variant of...

CVE-2008-2803

CVE-2008-2803 affects Mozilla Firefox <= 2.0.0.14/2.0.0.15? and SeaMonkey

CVE-2008-4069

The XBM decoder flaw CVE-2008-4069 affects Mozilla Firefox up to 2.0.0.16/17 and SeaMonkey up to 1.1.x, where processing a crafted XBM image could read uninitialized memory and reveal sensitive data. Remediation per connected advisories: upgrade Firefox to 2.0.0.17 or newer and SeaMonkey to 1.1.1...

CVE-2010-3776

CVE-2010-3776 affects Mozilla Firefox before 3.5.16 and Firefox 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11. The issue is described as memory safety/memory corruption in the browser engine, allowing a remote attacker to cause a denial of serv...

CVE-2011-0070

Summary of CVE-2011-0070 (as per provided documents) Affected products/versions: Mozilla Firefox up to 3.5.18 (3.5.x before 3.5.19), Firefox 3.6.x before 3.6.17, Firefox 4.x before 4.0.1; Mozilla Thunderbird before 3.1.10; SeaMonkey before 2.0.14. Root cause/impact (from description): Unspecified...

CVE-2012-3961

CVE-2012-3961 is a use-after-free in the RangeData implementation affecting Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0/ESR 10.x before 10.0.7, and SeaMonkey before 2.12. Exploitation could allow remote code execution or a denial of service via heap memory...

CVE-2012-4209

Mode C: The CVE-2012-4209 issue affects Mozilla-based components used in MiracleLinux 4 (firefox-10.0.11-1.0.1.AXS4, xulrunner-10.0.11-1.0.1.AXS4) and is described as allowing cross-site scripting by abusing top frame name and location access. Affected products include Mozilla Firefox and Firefox...

CVE-2013-0792

Technical details for CVE-2013-0792 (affected product/version, root cause, impact, fixes) are not provided in the connected documents. The sources only reference the CVE in advisories/listings. Monitor for updates.

CVE-2007-0780

CVE-2007-0780 is a cross-site scripting vulnerability in Firefox 1.5.x up to 1.5.0.9 and Firefox 2.x up to 2.0.0.x, and SeaMonkey up to 1.0.7, where the requesting URI is used to identify child windows. This enables remote XSS when a blocked popup originating from a javascript: URI is opened acro...

CVE-2011-0074

CVE-2011-0074 is described as an unspecified vulnerability in the Mozilla Firefox browser engine for Firefox 3.5.x (pre-3.5.19) and 3.6.x (pre-3.6.17), Thunderbird up to 3.1.10, and SeaMonkey up to 2.0.14. The issue allows remote attackers to cause memory corruption and application crash or possi...

CVE-2012-0452

Technical details about CVE-2012-0452 are not publicly provided in the connected documents. The initial description lists the vulnerability and affected products, but no further technical specifics or patch information are included here. Monitor for updates.

CVE-2012-1960

The CVE-2012-1960 entry affects Mozilla Firefox 4.x–13.0, Thunderbird 5.0–13.0, and SeaMonkey before 2.11. The qcms_transform_data_rgb_out_lut_sse2 function in the QCMS implementation may trigger an out-of-bounds read via a crafted color profile, allowing remote attackers to obtain sensitive info...

CVE-2012-4191

Technical details about CVE-2012-4191 (affected products, root cause, impact, or fixes) are not provided in the connected documents. Please monitor for updates.

CVE-2014-1511

CVE-2014-1511 affects Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25. The issue is described as a remote bypass of the popup blocker via unspecified vectors. Public security advisories in 2014 consolidate Firefox/Thunderbird/SeaMonkey...

CVE-2014-8640

CVE-2014-8640 affects Mozilla Firefox (before 35.0) and SeaMonkey (before 2.32) where the Web Audio API’s mozilla::dom::AudioParamTimeline::AudioNodeInputValue does not properly restrict timeline operations, enabling a remote attacker to trigger a denial of service via uninitialized-memory read a...

CVE-2006-3809

CVE-2006-3809: Firefox <=1.5.0.4/Thunderbird <=1.5.0.4/SeaMonkey

CVE-2008-5014

CVE-2008-5014 affects Mozilla firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13. Root cause: modifying window.proto .proto can lock a non-native object, triggering an OBJ_IS_NATIVE assertion. Impact: remote attacker could crash...

CVE-2009-1832

CVE-2009-1832 affects Mozilla Firefox (before 3.0.11), Mozilla Thunderbird (before 2.0.0.22), and SeaMonkey (before 1.1.17). The issue allows remote attackers to trigger memory corruption and/or potentially execute arbitrary code via a vulnerability described as “double frame construction.” Explo...

CVE-2009-3988

CVE-2009-3988 affects Mozilla Firefox 3.0.x (before 3.0.18), Firefox 3.5.x (before 3.5.8) and SeaMonkey before 2.0.3. The issue arises from not properly restricting read access to object properties in showModalDialog, allowing a crafted dialogArguments value to bypass the Same Origin Policy and e...

CVE-2012-0463

The CVE-2012-0463 issue affects Mozilla Firefox browser engine in Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR before 10.0.3, and SeaMonkey before 2.8. The flaw is in the nsWindow implementation not val...

CVE-2012-1973

CVE-2012-1973 is a use-after-free vulnerability in Mozilla Firefox family components. The issue arises in nsObjectLoadingContent::LoadObject, affecting Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. Expl...

CVE-2012-3975

Technical details about CVE-2012-3975 (affected product, root cause, impact, remediation) are not provided in the connected documents. Monitor for updates.

CVE-2012-4187

CVE-2012-4187 is listed in the MiracleLinux/Miracle Linux AXSA advisory as affecting Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13. The vulnerability is described as an issue with managing a cert...

CVE-2013-0769

CVE-2013-0769 refers to multiple unspecified vulnerabilities in the Mozilla browser engine that could cause memory corruption and application crashes, potentially enabling remote code execution. Affected products and versions cited in connected docs include Mozilla Firefox before 18.0, Firefox ES...

CVE-2006-0748

CVE-2006-0748 affects Mozilla Firefox/Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1. The vulnerability arises from an invalid and non-sensical ordering of table-related tags that results in a negative array index, enabling remote ar...

CVE-2006-1742

CVE-2006-1742 affects Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0. The issue stems from improper handling of temporary variables that are not garbage collected, which could allow remote attackers to access freed memo...

CVE-2008-0414

Mozilla Firefox <=2.0.0.11/SeaMonkey

CVE-2008-5511

Affected software: Mozilla Firefox (3.x before 3.0.5; 2.x before 2.0.0.19), Mozilla Thunderbird (2.x before 2.0.0.19), and SeaMonkey (1.x before 1.1.14). Root cause: vulnerability in XBL bindings allowing an XSS payload via an unloaded document, combined with bypass of the same-origin policy (CVE...

CVE-2011-0078

CVE-2011-0078 is an unspecified vulnerability in the browser engine affecting Mozilla Firefox 3.5.x prior to 3.5.19, Firefox 3.6.x prior to 3.6.17, Thunderbird prior to 3.1.10, and SeaMonkey prior to 2.0.14. The issue can cause a denial of service through memory corruption and may allow arbitrary...

CVE-2011-0085

CVE-2011-0085 is a use-after-free in the nsXULCommandDispatcher of Mozilla Firefox prior to 3.6.18, Thunderbird prior to 3.1.11, and SeaMonkey up to 2.0.14. The flaw allows remote attackers to execute arbitrary code by crafting an XUL document that dequeues the current command updater, enabling c...

CVE-2012-1954

CVE-2012-1954 is a use-after-free in Mozilla Firefox’s nsDocument::AdoptNode, affecting Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, and SeaMonkey before 2.11. Exploitation can cause a denial of service (heap memory corruption) or possibly remote code execution via vect...

CVE-2012-3985

CVE-2012-3985 is a vulnerability in Mozilla Firefox, Thunderbird, and SeaMonkey where the HTML5 Same Origin Policy could be violated, allowing initial-origin access after document.domain is set and potentially enabling cross-site scripting (XSS). Affected versions are Firefox/Thunderbird/SeaMonke...

CVE-2013-0770

CVE-2013-0770 affects Mozilla Firefox (pre-18.0), Thunderbird (pre-17.0.2), and SeaMonkey (pre-2.15). The issue is described as multiple unspecified vulnerabilities in the browser engine that can cause memory corruption and application crashes, with potential for arbitrary code execution via unkn...

CVE-2006-1728

CVE-2006-1728 affects multiple Mozilla-based products (Firefox and Thunderbird 1.x < 1.5.0.2; Mozilla Suite < 1.7.13; SeaMonkey

CVE-2006-1739

CVE-2006-1739 is a memory-corruption flaw in the CSS border rendering path used by Mozilla Firefox/Thunderbird/SeaMonkey. The issue could crash the browser or potentially allow arbitrary code execution via crafted CSS (out-of-bounds writes/buffer overflow). Affected products include Firefox/Thund...

CVE-2006-5464

CVE-2006-5464 affects Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6. The issue, tied to the layout/processing path, allows remote attackers to cause a denial of service (crash) via unspecified vectors. Public advisories (Oracle/Linux/OpenVAS records) corroborate t...

CVE-2008-0016

The CVE-2008-0016 issue is a stack-based buffer overflow in the UTF-8 URL parser that affects Mozilla Firefox prior to 2.0.0.17 and SeaMonkey prior to 1.1.12, enabling remote code execution via a crafted URL. Connected advisories confirm the vulnerability and list affected Mozilla products; explo...

CVE-2008-0416

CVE-2008-0416 describes multiple XSS vulnerabilities in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8. The issue allows remote attackers to inject arbitrary web script or HTML via certain character encodings, specifically: (1) a backspace character treat...

CVE-2010-3772

Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, contain a vulnerability where a DIV inside a XUL tree's treechildren causes index calculations to be incorrect, enabling arbitrary code execution via crafted content. MiracleLinux AXSA:2010-507:08 lists CVE-2010-3...

CVE-2012-1974

CVE-2012-1974 is a use-after-free vulnerability in gfxTextRun::CanBreakLineBefore affecting Mozilla Firefox (and related apps like Thunderbird/SeaMonkey) prior to version 15.0, with remote code execution or a denial of service via unspecified vectors. The connected Nessus entries confirm the CVE ...

CVE-2013-0782

CVE-2013-0782 is a heap-based buffer overflow in Mozilla’s nsSaveAsCharset::DoCharsetConversion that affects Firefox before 19.0, ESR 17.x before 17.0.3, Thunderbird before 17.0.3, and SeaMonkey before 2.16. The connected documents confirm this vulnerability and show affected components include F...

CVE-2006-1730

CVE-2006-1730 is a heap-based buffer overflow vulnerability caused by an integer overflow in the CSS letter-spacing handling, allowing remote code execution. Affected products and versions include Mozilla Firefox and Thunderbird 1.x before 1.5.0.2, and 1.0.x before 1.0.8; Mozilla Suite before 1.7...

CVE-2012-1975

CVE-2012-1975 is a Use-after-free vulnerability in PresShell::CompleteMove affecting Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. It potentially allows remote code execution or a denial of serv...