CVE-2012-3985

CVE-2012-3985 is a vulnerability in Mozilla Firefox, Thunderbird, and SeaMonkey where the HTML5 Same Origin Policy could be violated, allowing initial-origin access after document.domain is set and potentially enabling cross-site scripting (XSS). Affected versions are Firefox/Thunderbird/SeaMonke...

CVE-2013-0763

CVE-2013-0763 is a use-after-free vulnerability in Mozilla Firefox (pre-18.0) and Firefox ESR 17.x (pre-17.0.1), Thunderbird (pre-17.0.2/ESR 17.x pre-17.0.1), and SeaMonkey (pre-2.15). It is triggered via Mesa driver interactions and a resized WebGL canvas, potentially allowing remote attackers t...

CVE-2006-1730

CVE-2006-1730 is a heap-based buffer overflow vulnerability caused by an integer overflow in the CSS letter-spacing handling, allowing remote code execution. Affected products and versions include Mozilla Firefox and Thunderbird 1.x before 1.5.0.2, and 1.0.x before 1.0.8; Mozilla Suite before 1.7...

CVE-2006-3811

CVE-2006-3811 is a memory corruption crash vulnerability within Mozilla Firefox components (notably the Firefox 1.5.x line around the 1.5.0.5 release) and related Mozilla projects (SeaMonkey/Thunderbird in affected bundles). The issue manifests as crashes and is described as memory corruption tha...

CVE-2006-5464

CVE-2006-5464 affects Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6. The issue, tied to the layout/processing path, allows remote attackers to cause a denial of service (crash) via unspecified vectors. Public advisories (Oracle/Linux/OpenVAS records) corroborate t...

CVE-2009-3985

CVE-2009-3985 affects Mozilla Firefox prior to 3.0.16 and 3.5.x prior to 3.5.6, and SeaMonkey prior to 2.0.1. The issue allows remote attackers to cause spoofing by setting document.location to the vulnerable URL and then writing arbitrary script/HTML to the associated blank document, enabling co...

CVE-2011-0057

CVE-2011-0057 is a use-after-free vulnerability in the Web Workers implementation of Mozilla Firefox. Affected products and versions: Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12. The issue arises from a use-after-free in interactions between a JavaScript Worker and ...

CVE-2006-1739

CVE-2006-1739 is a memory-corruption flaw in the CSS border rendering path used by Mozilla Firefox/Thunderbird/SeaMonkey. The issue could crash the browser or potentially allow arbitrary code execution via crafted CSS (out-of-bounds writes/buffer overflow). Affected products include Firefox/Thund...

CVE-2008-5506

CVE-2008-5506 affects Mozilla components (e.g., Firefox/Thunderbird/SeaMonkey) where an XMLHttpRequest to an attacker-controlled resource that performs a 302 redirect to a different domain can bypass same-origin policy, allowing reading of the redirected response. This can enable a remote attacke...

CVE-2010-3767

CVE-2010-3767 describes an integer overflow in the NewIdArray function of Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11. An attacker could cause memory corruption or arbitrary code execution by supplying a JavaScript array with a very large number of elements,...

CVE-2011-0067

CVE-2011-0067 affects Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14. It stems from improper autocompletion for forms, allowing a Java applet to spoof interaction with autocomplete controls to read form history entries. Mitigation in the connected documents sho...

CVE-2012-3957

Affected components: Mozilla Firefox before 15.0 (and Firefox ESR 10.x before 10.0.7), Thunderbird before 15.0 (and Thunderbird ESR 10.x before 10.0.7), SeaMonkey before 2.12.** Vulnerability and root cause: Heap-based buffer overflow in nsBlockFrame::MarkLineDirty, enabling remote code execution...

CVE-2012-4208

CVE-2012-4208 affects Mozilla Firefox ≤ prior to 17.0, Thunderbird ≤ prior to 17.0, and SeaMonkey ≤ 2.13/2.14. The XrayWrapper did not consider compartment during property filtering, allowing remote sites to bypass chrome-only restrictions on reading DOM object properties. Impact per description:...

CVE-2013-0782

CVE-2013-0782 is a heap-based buffer overflow in Mozilla’s nsSaveAsCharset::DoCharsetConversion that affects Firefox before 19.0, ESR 17.x before 17.0.3, Thunderbird before 17.0.3, and SeaMonkey before 2.16. The connected documents confirm this vulnerability and show affected components include F...

CVE-2006-2781

CVE-2006-2781 describes a double-free vulnerability in nsVCard.cpp that affects Mozilla Thunderbird prior to 1.5.0.4 and SeaMonkey prior to 1.0.2 . An attacker could craft a VCard containing invalid base64 characters to trigger a vulnerability, potentially causing a denial of service (hang) and, ...

CVE-2006-3801

CVE-2006-3801 affects Mozilla Firefox 1.5 (pre-1.5.0.5) and SeaMonkey (pre-1.0.3). The vulnerability arises from a JavaScript reference to a frame or window that isn’t properly cleared when content is destroyed, leaving a pointer to a deleted object. This can enable remote attackers to execute ar...

CVE-2008-2798

CVE-2008-2798 and related CVEs affected Mozilla Firefox (before 2.0.0.15), SeaMonkey (before 1.1.10), and Thunderbird (before 2.0.0.14), with issues in the layout/JavaScript processing that could crash the application and potentially allow arbitrary code execution via crafted content. The base vu...

CVE-2008-5021

The CVE-2008-5021 vulnerability affects Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13. It is caused by modifying properties of a file input element while it is still initializing, followed by using blur to access un...

CVE-2012-1974

CVE-2012-1974 is a use-after-free vulnerability in gfxTextRun::CanBreakLineBefore affecting Mozilla Firefox (and related apps like Thunderbird/SeaMonkey) prior to version 15.0, with remote code execution or a denial of service via unspecified vectors. The connected Nessus entries confirm the CVE ...

CVE-2013-1736

CVE-2013-1736 affects Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21. The vulnerability is due to improper establishment of parent-child relationships of range-request nodes in nsGfxScrollFrameInn...

CVE-2006-4571

CVE-2006-4571 is evidenced in multiple Firefox/Thunderbird/SeaMonkey advisories as causing crashes and memory corruption, with potential for remote code execution. Affected: Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, SeaMonkey before 1.0.5. The issue is associated with JavaScript executi...

CVE-2007-0776

Technical details for CVE-2007-0776 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2010-0179

CVE-2010-0179 affects Mozilla Firefox (pre-3.0.19 and pre-3.5.8 in the 3.x line) and SeaMonkey (pre-2.0.3), where the Firebug add-on’s XMLHttpRequestSpy module can improperly interact with chrome-privileged objects. This leads to arbitrary JavaScript execution via a crafted HTTP response due to t...

CVE-2011-2362

CVE-2011-2362 affects Mozilla Firefox (before 3.6.18), Thunderbird (before 3.1.11), and SeaMonkey (through 2.0.14): they do not distinguish cookies for two domain names that differ only by a trailing dot, allowing remote servers to bypass the Same Origin Policy via Set-Cookie headers. The issue s...

CVE-2011-3661

CVE-2011-3661 affects Mozilla’s YARR library used by Firefox 4.x–8.0, Thunderbird 5.0–8.0, and SeaMonkey before 2.6. A crafted JavaScript input could crash the application or, possibly, allow code execution. Connected updates indicate fixes were applied in SeaMonkey 2.6 and related Firefox/Thunde...

CVE-2012-4204

The CVE-2012-4204 entry describes a memory-corruption/remote-code-execution vulnerability in Mozilla Firefox’s JavaScript engine (str_unescape) affecting Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14, exploitable via unspecified vectors. Connected documents indicate rela...

CVE-2006-6497

CVE-2006-6497 affects Mozilla Firefox 2.x (before 2.0.0.1) and Firefox 1.5.x (before 1.5.0.9), SeaMonkey before 1.0.7, and Thunderbird before 1.5.0.9. The issue, along with related flaws (CVE-2006-6498, CVE-2006-6499, CVE-2006-6501–CVE-2006-6505), enables memory corruption and crashes and can pot...

CVE-2007-1095

This CVE (CVE-2007-1095) concerns Mozilla Firefox < 2.0.0.8 and SeaMonkey

CVE-2009-1833

CVE-2009-1833 affects Mozilla Firefox <= 3.0.10 (before 3.0.11), Mozilla Thunderbird <= 2.0.0.21 (before 2.0.0.22), and SeaMonkey

CVE-2010-1202

CVE-2010-1202 affects Mozilla Firefox 3.5.x before 3.5.10, Firefox 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5. It is part of a set of vulnerabilities in the JavaScript engine/browser engine where memory corruption may lead to a crash or, potentially, arbitrary code e...

CVE-2011-2984

CVE-2011-2984 affects Mozilla Firefox prior to 3.6.20, SeaMonkey 2.x, and Thunderbird 3.x prior to 3.1.12. The issue is a tab-dropping handling bug that lets a remote attacker load a content area, register for drop events, and execute arbitrary JavaScript with chrome privileges. Public summaries ...

CVE-2012-0464

CVE-2012-0464 is a use-after-free vulnerability in the Mozilla Firefox browser engine. Affected products include Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, and SeaMonkey before 2.8. The issue can allow remote attacke...

CVE-2012-3970

CVE-2012-3970 is a Use-After-Free in Mozilla Firefox’s nsTArray_base::Length function. Affects Firefox < 15.0, Firefox ESR < 10.0.7, Thunderbird < 15.0 (and ESR 10.x < 10.0.7), and SeaMonkey

CVE-2013-0759

CVE-2013-0759 affects Mozilla Firefox (and related Mozilla components) prior to version 18.0, Firefox ESR prior to 10.0.12 and 17.0.2, Thunderbird prior to 17.0.2 and ESR prior to 10.0.12/17.0.2, and SeaMonkey prior to 2.15. The vulnerability allows remote attackers to spoof the address bar by ex...

CVE-2013-0779

CVE-2013-0779 affects Mozilla Firefox (before 19.0), Thunderbird (before 17.0.3), and SeaMonkey (before 2.16). The issue is in nsCodingStateMachine::NextState, allowing remote attackers to execute arbitrary code or cause a denial of service via an out-of-bounds read. The connected OpenVAS/Nessus ...

CVE-2014-1499

CVE-2014-1499 affects Mozilla Firefox prior to 28.0 and SeaMonkey prior to 2.25. The issue lets a remote attacker spoof the domain in the WebRTC camera or microphone permission prompts by triggering a navigation at a specific moment during prompt generation. This is caused by how the browser hand...

CVE-2006-3810

CVE-2006-3810 is an XSS vulnerability in Mozilla Firefox 1.5 before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 that can be exploited via the XPCNativeWrapper(window).Function construct to inject arbitrary web script/HTML. The issue is triggered by cross-site scripting when a ...

CVE-2007-5340

CVE-2007-5340 is part of multiple vulnerabilities in the Javascript engine of Mozilla Firefox (<2.0.0.8), Thunderbird (<2.0.0.8), and SeaMonkey (

CVE-2008-1380

CVE-2008-1380 is described in the provided materials as a vulnerability in the processing of malformed JavaScript content that could crash the SeaMonkey web browser and potentially allow arbitrary code execution when JavaScript is enabled. Red Hat Oracle Linux advisories (e.g., RHSA-2008-0223, EL...

CVE-2008-5503

CVE-2008-5503 affects Mozilla Firefox 2.x up to 2.0.0.19, Mozilla Thunderbird 2.x up to 2.0.0.19, and SeaMonkey 1.x up to 1.1.14. The vulnerability arises from the loadBindingDocument function failing to enforce same-domain policy checks, enabling remote attackers to read or access data from othe...

CVE-2008-5507

CVE-2008-5507 affects Mozilla products: Firefox 2.x before 2.0.0.19, Firefox 3.x before 3.0.5, SeaMonkey 1.x before 1.1.14, and Thunderbird 2.x before 2.0.0.19. Root cause: bypass of the same-origin policy via a JavaScript URL that redirects to a target resource, triggering an error if the target...

CVE-2010-3768

CVE-2010-3768 affects Mozilla Firefox (before 3.5.16 and 3.6.x before 3.6.13), Thunderbird (before 3.0.11 and 3.1.x before 3.1.7), and SeaMonkey (before 2.0.11). The issue stems from improper validation of downloadable fonts in the OS font implementation, enabling remote code execution via vector...

CVE-2006-3806

CVE-2006-3806 refers to multiple integer overflows in the JavaScript engine affecting Mozilla Firefox (pre-1.5.0.5), Thunderbird (pre-1.5.0.5), and SeaMonkey (pre-1.0.3). The primary issues involve long strings in Object/Array/String.toSource and related string function arguments, with the potent...

CVE-2007-4841

CVE-2007-4841 affects Mozilla Firefox (before 2.0.0.8), Mozilla Thunderbird (before 2.0.0.8), and SeaMonkey (before 1.1.5). The vulnerability permits remote command execution via (1) mailto, (2) nntp, (3) news, or (4) snews URIs that use invalid percent encoding, tied to improper file-type handli...

CVE-2007-5334

The CVE-2007-5334 entry affects Mozilla Firefox up to version 2.0.0.8 and SeaMonkey up to 1.1.5, per mfsa2007-33. The vulnerability arises from the hidechrome attribute in XUL documents, allowing a window chrome to be hidden and enabling phishing/spoofing against display of the window titlebar. C...

CVE-2009-1303

Affected products: Mozilla Firefox up to 3.0.8/3.0.9, Mozilla Thunderbird up to 2.0.0.21/22, and SeaMonkey up to 1.1.15/16. CVE-2009-1303 arises from nsSVGElement::BindToTree in the browser engine, allowing a remote attacker to trigger denial of service (application crash) and potentially memory ...

CVE-2010-3766

CVE-2010-3766 is a use-after-free vulnerability in Mozilla Firefox prior to 3.5.16 and in 3.6.x prior to 3.6.13, and SeaMonkey prior to 2.0.11. The flaw involves modification of an nsDOMAttribute node, which can cause an inconsistent DOM state and enable remote code execution. The affected produc...

CVE-2011-0066

CVE-2011-0066 is a use-after-free vulnerability affecting Mozilla Firefox prior to 3.5.19 and 3.6.x prior to 3.6.17, and SeaMonkey prior to 2.0.14. The issue allows remote attackers to execute arbitrary code via vectors related to OBJECT’s mObserverList (memory corruption risk). The MiracleLinux ...

CVE-2011-0075

CVE-2011-0075 is an unspecified vulnerability in the Mozilla Firefox browser engine affecting Firefox 3.5.x before 3.5.19, Firefox 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14. The issue can cause a denial of service via memory corruption and application crash, with...

CVE-2011-2988

CVE-2011-2988 describes a buffer overrun in an unspecified string class used by the WebGL shader implementation in Mozilla Firefox (4.x–5), SeaMonkey (2.x before 2.3), and Thunderbird before 6. The vulnerability can be triggered by a long shader source block, potentially allowing remote code exec...