CVE-2011-0072

CVE-2011-0072 refers to an unspecified vulnerability in the browser engine affecting Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14, allowing remote attackers to cause memory corruption and application crashes or possibly execut...

CVE-2012-0452

Technical details about CVE-2012-0452 are not publicly provided in the connected documents. The initial description lists the vulnerability and affected products, but no further technical specifics or patch information are included here. Monitor for updates.

CVE-2012-1974

CVE-2012-1974 is a use-after-free vulnerability in gfxTextRun::CanBreakLineBefore affecting Mozilla Firefox (and related apps like Thunderbird/SeaMonkey) prior to version 15.0, with remote code execution or a denial of service via unspecified vectors. The connected Nessus entries confirm the CVE ...

CVE-2013-0763

CVE-2013-0763 is a use-after-free vulnerability in Mozilla Firefox (pre-18.0) and Firefox ESR 17.x (pre-17.0.1), Thunderbird (pre-17.0.2/ESR 17.x pre-17.0.1), and SeaMonkey (pre-2.15). It is triggered via Mesa driver interactions and a resized WebGL canvas, potentially allowing remote attackers t...

CVE-2006-1742

CVE-2006-1742 affects Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0. The issue stems from improper handling of temporary variables that are not garbage collected, which could allow remote attackers to access freed memo...

CVE-2006-3801

CVE-2006-3801 affects Mozilla Firefox 1.5 (pre-1.5.0.5) and SeaMonkey (pre-1.0.3). The vulnerability arises from a JavaScript reference to a frame or window that isn’t properly cleared when content is destroyed, leaving a pointer to a deleted object. This can enable remote attackers to execute ar...

CVE-2008-0414

Mozilla Firefox <=2.0.0.11/SeaMonkey

CVE-2010-0174

CVE-2010-0174 covers multiple Mozilla packages with several browser-engine vulnerabilities that could allow memory corruption, DoS, or potentially arbitrary code execution. Affected products and versions, as documented, include Mozilla Firefox up to 3.0.18/3.0.x (pre-3.0.19), Firefox 3.5.x before...

CVE-2010-3767

CVE-2010-3767 describes an integer overflow in the NewIdArray function of Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11. An attacker could cause memory corruption or arbitrary code execution by supplying a JavaScript array with a very large number of elements,...

CVE-2010-3768

CVE-2010-3768 affects Mozilla Firefox (before 3.5.16 and 3.6.x before 3.6.13), Thunderbird (before 3.0.11 and 3.1.x before 3.1.7), and SeaMonkey (before 2.0.11). The issue stems from improper validation of downloadable fonts in the OS font implementation, enabling remote code execution via vector...

CVE-2006-6497

CVE-2006-6497 affects Mozilla Firefox 2.x (before 2.0.0.1) and Firefox 1.5.x (before 1.5.0.9), SeaMonkey before 1.0.7, and Thunderbird before 1.5.0.9. The issue, along with related flaws (CVE-2006-6498, CVE-2006-6499, CVE-2006-6501–CVE-2006-6505), enables memory corruption and crashes and can pot...

CVE-2007-5334

The CVE-2007-5334 entry affects Mozilla Firefox up to version 2.0.0.8 and SeaMonkey up to 1.1.5, per mfsa2007-33. The vulnerability arises from the hidechrome attribute in XUL documents, allowing a window chrome to be hidden and enabling phishing/spoofing against display of the window titlebar. C...

CVE-2008-2798

CVE-2008-2798 and related CVEs affected Mozilla Firefox (before 2.0.0.15), SeaMonkey (before 1.1.10), and Thunderbird (before 2.0.0.14), with issues in the layout/JavaScript processing that could crash the application and potentially allow arbitrary code execution via crafted content. The base vu...

CVE-2009-3985

CVE-2009-3985 affects Mozilla Firefox prior to 3.0.16 and 3.5.x prior to 3.5.6, and SeaMonkey prior to 2.0.1. The issue allows remote attackers to cause spoofing by setting document.location to the vulnerable URL and then writing arbitrary script/HTML to the associated blank document, enabling co...

CVE-2011-0057

CVE-2011-0057 is a use-after-free vulnerability in the Web Workers implementation of Mozilla Firefox. Affected products and versions: Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12. The issue arises from a use-after-free in interactions between a JavaScript Worker and ...

CVE-2012-3957

Affected components: Mozilla Firefox before 15.0 (and Firefox ESR 10.x before 10.0.7), Thunderbird before 15.0 (and Thunderbird ESR 10.x before 10.0.7), SeaMonkey before 2.12.** Vulnerability and root cause: Heap-based buffer overflow in nsBlockFrame::MarkLineDirty, enabling remote code execution...

CVE-2013-1736

CVE-2013-1736 affects Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21. The vulnerability is due to improper establishment of parent-child relationships of range-request nodes in nsGfxScrollFrameInn...

CVE-2006-1730

CVE-2006-1730 is a heap-based buffer overflow vulnerability caused by an integer overflow in the CSS letter-spacing handling, allowing remote code execution. Affected products and versions include Mozilla Firefox and Thunderbird 1.x before 1.5.0.2, and 1.0.x before 1.0.8; Mozilla Suite before 1.7...

CVE-2006-1739

CVE-2006-1739 is a memory-corruption flaw in the CSS border rendering path used by Mozilla Firefox/Thunderbird/SeaMonkey. The issue could crash the browser or potentially allow arbitrary code execution via crafted CSS (out-of-bounds writes/buffer overflow). Affected products include Firefox/Thund...

CVE-2006-4571

CVE-2006-4571 is evidenced in multiple Firefox/Thunderbird/SeaMonkey advisories as causing crashes and memory corruption, with potential for remote code execution. Affected: Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, SeaMonkey before 1.0.5. The issue is associated with JavaScript executi...

CVE-2006-5464

CVE-2006-5464 affects Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6. The issue, tied to the layout/processing path, allows remote attackers to cause a denial of service (crash) via unspecified vectors. Public advisories (Oracle/Linux/OpenVAS records) corroborate t...

CVE-2008-0304

CVE-2008-0304 is a heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.12 and SeaMonkey before 1.1.8, allowing remote code execution via a crafted external-body MIME type in an email. The root cause is an incorrect memory allocation during message preview, enabling an attacker to run a...

CVE-2008-5021

The CVE-2008-5021 vulnerability affects Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13. It is caused by modifying properties of a file input element while it is still initializing, followed by using blur to access un...

CVE-2008-5506

CVE-2008-5506 affects Mozilla components (e.g., Firefox/Thunderbird/SeaMonkey) where an XMLHttpRequest to an attacker-controlled resource that performs a 302 redirect to a different domain can bypass same-origin policy, allowing reading of the redirected response. This can enable a remote attacke...

CVE-2009-1836

CVE-2009-1836: The vulnerability arises from how Mozilla Firefox (pre-3.0.11), Thunderbird (pre-2.0.0.22), and SeaMonkey (pre-1.1.17) use the HTTP Host header to determine the document context in a non-200 CONNECT response from a proxy. This can enable a man-in-the-middle attacker to modify the C...

CVE-2010-0160

CVE-2010-0160 affects Mozilla Firefox 3.0.x prior to 3.0.18, Firefox 3.5.x prior to 3.5.8, and SeaMonkey prior to 2.0.3. The issue arises in Web Worker handling of array data types in posted messages, causing heap memory corruption and browser crash; remote attackers could potentially execute arb...

CVE-2011-2990

The CVE-2011-2990 vulnerability affects Mozilla Firefox 4.x–5 and SeaMonkey 2.x (before 2.3) where Content Security Policy (CSP) violation reports do not strip proxy-authorization credentials from the request headers, enabling potential leakage of credentials when a CSP report is read. The issue ...

CVE-2012-4208

CVE-2012-4208 affects Mozilla Firefox ≤ prior to 17.0, Thunderbird ≤ prior to 17.0, and SeaMonkey ≤ 2.13/2.14. The XrayWrapper did not consider compartment during property filtering, allowing remote sites to bypass chrome-only restrictions on reading DOM object properties. Impact per description:...

CVE-2013-0759

CVE-2013-0759 affects Mozilla Firefox (and related Mozilla components) prior to version 18.0, Firefox ESR prior to 10.0.12 and 17.0.2, Thunderbird prior to 17.0.2 and ESR prior to 10.0.12/17.0.2, and SeaMonkey prior to 2.15. The vulnerability allows remote attackers to spoof the address bar by ex...

CVE-2006-2781

CVE-2006-2781 describes a double-free vulnerability in nsVCard.cpp that affects Mozilla Thunderbird prior to 1.5.0.4 and SeaMonkey prior to 1.0.2 . An attacker could craft a VCard containing invalid base64 characters to trigger a vulnerability, potentially causing a denial of service (hang) and, ...

CVE-2006-3811

CVE-2006-3811 is a memory corruption crash vulnerability within Mozilla Firefox components (notably the Firefox 1.5.x line around the 1.5.0.5 release) and related Mozilla projects (SeaMonkey/Thunderbird in affected bundles). The issue manifests as crashes and is described as memory corruption tha...

CVE-2010-1202

CVE-2010-1202 affects Mozilla Firefox 3.5.x before 3.5.10, Firefox 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5. It is part of a set of vulnerabilities in the JavaScript engine/browser engine where memory corruption may lead to a crash or, potentially, arbitrary code e...

CVE-2011-3661

CVE-2011-3661 affects Mozilla’s YARR library used by Firefox 4.x–8.0, Thunderbird 5.0–8.0, and SeaMonkey before 2.6. A crafted JavaScript input could crash the application or, possibly, allow code execution. Connected updates indicate fixes were applied in SeaMonkey 2.6 and related Firefox/Thunde...

CVE-2007-1095

This CVE (CVE-2007-1095) concerns Mozilla Firefox < 2.0.0.8 and SeaMonkey

CVE-2008-5503

CVE-2008-5503 affects Mozilla Firefox 2.x up to 2.0.0.19, Mozilla Thunderbird 2.x up to 2.0.0.19, and SeaMonkey 1.x up to 1.1.14. The vulnerability arises from the loadBindingDocument function failing to enforce same-domain policy checks, enabling remote attackers to read or access data from othe...

CVE-2011-3660

CVE-2011-3660 concernsMozilla Firefox 4.x–8.0, Thunderbird 5.0–8.0, and SeaMonkey before 2.6, where multiple vulnerabilities in the browser engine enable remote denial of service or possibly arbitrary code execution via vectors that trigger a compartment mismatch in nsDOMMessageEvent::GetData and...

CVE-2012-3970

CVE-2012-3970 is a Use-After-Free in Mozilla Firefox’s nsTArray_base::Length function. Affects Firefox < 15.0, Firefox ESR < 10.0.7, Thunderbird < 15.0 (and ESR 10.x < 10.0.7), and SeaMonkey

CVE-2012-4204

The CVE-2012-4204 entry describes a memory-corruption/remote-code-execution vulnerability in Mozilla Firefox’s JavaScript engine (str_unescape) affecting Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14, exploitable via unspecified vectors. Connected documents indicate rela...

CVE-2013-0779

CVE-2013-0779 affects Mozilla Firefox (before 19.0), Thunderbird (before 17.0.3), and SeaMonkey (before 2.16). The issue is in nsCodingStateMachine::NextState, allowing remote attackers to execute arbitrary code or cause a denial of service via an out-of-bounds read. The connected OpenVAS/Nessus ...

CVE-2006-3806

CVE-2006-3806 refers to multiple integer overflows in the JavaScript engine affecting Mozilla Firefox (pre-1.5.0.5), Thunderbird (pre-1.5.0.5), and SeaMonkey (pre-1.0.3). The primary issues involve long strings in Object/Array/String.toSource and related string function arguments, with the potent...

CVE-2006-3810

CVE-2006-3810 is an XSS vulnerability in Mozilla Firefox 1.5 before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 that can be exploited via the XPCNativeWrapper(window).Function construct to inject arbitrary web script/HTML. The issue is triggered by cross-site scripting when a ...

CVE-2007-0776

Technical details for CVE-2007-0776 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2010-3769

CVE-2010-3769 affects Mozilla Firefox (pre-3.5.16 and pre-3.6.13 on Windows), Thunderbird (pre-3.0.11 and pre-3.1.7), and SeaMonkey (pre-2.0.11) due to a flaw in line-breaking when handling very long strings. The root cause is a buffer over-read triggered by a crafted document.write call, enablin...

CVE-2011-0066

CVE-2011-0066 is a use-after-free vulnerability affecting Mozilla Firefox prior to 3.5.19 and 3.6.x prior to 3.6.17, and SeaMonkey prior to 2.0.14. The issue allows remote attackers to execute arbitrary code via vectors related to OBJECT’s mObserverList (memory corruption risk). The MiracleLinux ...

CVE-2011-0075

CVE-2011-0075 is an unspecified vulnerability in the Mozilla Firefox browser engine affecting Firefox 3.5.x before 3.5.19, Firefox 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14. The issue can cause a denial of service via memory corruption and application crash, with...

CVE-2006-3802

CVE-2006-3802 affects Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3. The issue is that remote attackers can hijack native DOM methods from objects in another domain to conduct cross-site scripting (XSS) attacks using DOM methods of the top-level object. Th...

CVE-2008-5507

CVE-2008-5507 affects Mozilla products: Firefox 2.x before 2.0.0.19, Firefox 3.x before 3.0.5, SeaMonkey 1.x before 1.1.14, and Thunderbird 2.x before 2.0.0.19. Root cause: bypass of the same-origin policy via a JavaScript URL that redirects to a target resource, triggering an error if the target...

CVE-2010-0179

CVE-2010-0179 affects Mozilla Firefox (pre-3.0.19 and pre-3.5.8 in the 3.x line) and SeaMonkey (pre-2.0.3), where the Firebug add-on’s XMLHttpRequestSpy module can improperly interact with chrome-privileged objects. This leads to arbitrary JavaScript execution via a crafted HTTP response due to t...

CVE-2011-0056

CVE-2011-0056: Buffer overflow in the JavaScript engine of Mozilla Firefox (before 3.5.17) and Firefox 3.6.x (before 3.6.14), and SeaMonkey before 2.0.12. The issue arises from an atom map handling of a large number of string values and exception timing, potentially allowing remote code execution...

CVE-2011-2362

CVE-2011-2362 affects Mozilla Firefox (before 3.6.18), Thunderbird (before 3.1.11), and SeaMonkey (through 2.0.14): they do not distinguish cookies for two domain names that differ only by a trailing dot, allowing remote servers to bypass the Same Origin Policy via Set-Cookie headers. The issue s...