CVE-2014-1568

CVE-2014-1568 covers NSS (and libraries using NSS) where ASN.1 parsing of DigestInfo in X.509 certificates is faulty, enabling remote attackers to forge RSA signatures via crafted certs. Affected NSS/products include NSS itself and Mozilla stack components (Firefox, Thunderbird, SeaMonkey) and Ch...

CVE-2010-0178

CVE-2010-0178 affects Mozilla Firefox up to 3.0.19, Firefox 3.5.x up to 3.5.9, Firefox 3.6.x up to 3.6.2, and SeaMonkey up to 2.0.3 (before 2.0.4). The vulnerability allows an applet to convert a mouse click into a drag‑and‑drop, enabling remote JavaScript execution with Chrome privileges by firs...

CVE-2010-3765

CVE-2010-3765 is a remote code execution/memory corruption vulnerability in Mozilla’s browser stack (Firefox, SeaMonkey, Thunderbird) triggered when JavaScript runs. Technical root cause involves DOM/frame construction logic, including nsCSSFrameConstructor::ContentAppended, the appendChild path,...

CVE-2010-3177

CVE-2010-3177 affects Mozilla Firefox (before 3.5.14 and before 3.6.11) and SeaMonkey (before 2.0.9). The issue is a cross-site scripting (XSS) vulnerability in the Gopher parser that allows remote attackers to inject arbitrary script or HTML via the name of a file or directory on a Gopher server...

CVE-2011-0084

CVE-2011-0084 affects Mozilla Firefox prior to 3.6.20 and 4.x–5, Thunderbird 3.x prior to 3.1.12 and other versions before 6, SeaMonkey 2.x before 2.3, and possibly other Mozilla products. The underlying issue is in SVGTextElement.getCharNumAtPosition where SVG text is not handled correctly, allo...

CVE-2011-3000

Affected software: Mozilla Firefox before 3.6.23 and 4.x through 6; also affects Thunderbird before 7.0 and SeaMonkey before 2.4. Root cause: HTTP response handling flaw that allows HTTP response splitting when responses contain multiple Location, Content-Length, or Content-Disposition headers. I...

CVE-2012-0469

CVE-2012-0469 is a use-after-free in Mozilla Firefox/Thunderbird/SeaMonkey components involving the IndexedDB IDBKeyRange cycleCollection Trace path. Affects Firefox 4.x–11.0, ESR 10.x before 10.0.4, Thunderbird 5.0–11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9. Root cause: u...

CVE-2011-2371

CVE-2011-2371 is an integer overflow in Mozilla Firefox’s Array.reduceRight that could cause remote code execution when processing very large JavaScript arrays. Affected products include Firefox up to 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14. The issue...

CVE-2010-3176

CVE-2010-3176 affects Mozilla products including Firefox (3.5.x before 3.5.14 and 3.6.x before 3.6.11), Thunderbird (before 3.0.9 and before 3.1.5), and SeaMonkey (before 2.0.9). The issue is described as multiple unspecified vulnerabilities in the browser engine that could allow remote attackers...

CVE-2012-0441

The CVE-2012-0441 issue affects the NSS ASN.1 decoder QuickDER. The flaw allows a remote attacker to trigger a denial of service (application crash) via a zero-length item in ASN.1 structures (e.g., a zero-length basic constraint or a zero-length OCSP field). Affected software includes NSS-based ...

CVE-2010-2760

CVE-2010-2760 is a use-after-free in the XUL nsTreeSelection handling within Mozilla Firefox (pre-3.5.12 and 3.6.x prior to 3.6.9), Thunderbird (pre-3.0.7 and 3.1.x prior to 3.1.3), and SeaMonkey (pre-2.0.7). The root cause is a dangling pointer issue in the XUL tree selection leading to potentia...

CVE-2013-1710

CVE-2013-1710 affects Mozilla Firefox and related Mozilla-based products via a flaw in Certificate Request Message Format (CRMF) request generation that could allow remote JavaScript execution or cross-site scripting. Specifically, vulnerable components include Firefox before 23.0, Firefox ESR 17...

CVE-2013-1718

CVE-2013-1718 is a remote memory-safety vulnerability in the Mozilla Firefox/Thunderbird/SeaMonkey browser engine. The issue affects Firefox up to version 24.0, Firefox ESR 17.x up to 17.0.9, Thunderbird up to 24.0, Thunderbird ESR 17.x up to 17.0.9, and SeaMonkey up to 2.21, and can lead to memo...

CVE-2013-0788

CVE-2013-0788 concerns multiple unspecified vulnerabilities in the Mozilla Firefox browser engine that can cause memory corruption, a crash, or possibly arbitrary code execution. Affected products include Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ...

CVE-2012-1952

CVE-2012-1952 is a memory-safety/typical bad-cast flaw in Mozilla’s nsTableFrame::InsertFrames that occurs when processing mixed row-group and column-group frames. Affected products include Mozilla Firefox 4.x–13.0, Firefox ESR 10.x prior to 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x prio...

CVE-2012-3993

CVE-2012-3993 affects Mozilla Firefox (pre-16.0), Firefox ESR (pre-10.0.8), Thunderbird (pre-16.0), Thunderbird ESR (pre-10.0.8), and SeaMonkey (pre-2.13). The Chrome Object Wrapper (COW) implementation can mishandle InstallTrigger failures, enabling remote JavaScript execution with chrome privil...

CVE-2010-3179

CVE-2010-3179 : Stack-based buffer overflow in Firefox’s text rendering when a very long argument is passed to document.write. Affects Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9. Remediation per MFSA advisory:...

CVE-2011-2372

CVE-2011-2372 is described across connected advisories as a vulnerability in Mozilla Firefox and related Mozilla-based apps where merely holding Enter could trigger a download dialog, allowing user-assisted remote attackers to bypass access restrictions via a crafted site. Affected components inc...

CVE-2010-3182

CVE-2010-3182 impacts Mozilla Firefox (before 3.5.14 and 3.6.x before 3.6.11), Thunderbird (before 3.0.9 and 3.1.x before 3.1.5), and SeaMonkey (before 2.0.9) on Linux. Root cause: an application-launch script places a zero-length directory name in LD_LIBRARY_PATH, enabling a local user to load a...

CVE-2013-1701

CVE-2013-1701 is part of multiple Mozilla browser engine vulnerabilities fixed in Firefox (before 23.0), ESR 17.x (before 17.0.8), Thunderbird (before 17.0.8), and SeaMonkey (before 2.20). The MiracleLinux advisories and IBM/Red Hat entries confirm remediation via upgrading to patched versions (F...

CVE-2010-0182

The CVE-2010-0182 issue affects Mozilla Firefox (pre-3.5.9 and 3.6.x pre-3.6.2), Thunderbird (pre-3.0.4), and SeaMonkey (pre-2.0.4). The root cause is that XMLDocument::load did not perform the expected nsIContentPolicy checks when loading content via XML documents, allowing crafted content to by...

CVE-2010-3178

CVE-2010-3178 affects Mozilla Firefox (before 3.5.14 and 3.6.x before 3.6.11), Thunderbird (before 3.0.9 and 3.1.x before 3.1.5), and SeaMonkey (before 2.0.9). The issue arises from improper handling of certain modal calls made by javascript: URLs when opening a new window and performing cross-do...

CVE-2013-1732

CVE-2013-1732 is a buffer overflow in Mozilla's nsFloatManager::GetFlowArea that affects Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21. This allows remote attackers to execute arbitrary code via crafted ...

CVE-2010-1211

CVE-2010-1211 affects Mozilla Firefox 3.5.x before 3.5.11, and 3.6.x before 3.6.7; Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1; SeaMonkey before 2.0.6. The Mozilla browser engine vulnerabilities allow memory corruption leading to memory corruption, DoS, or possibly arbitrary code execut...

CVE-2011-0080

CVE-2011-0080 corresponds to multiple memory‑corruption/browser engine vulnerabilities in Mozilla Firefox 3.5.x before 3.5.19, Firefox 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14. The MiracleLinux advisories (AXSA:2011-198/203) enumerate these as a set of memory‑sa...

CVE-2013-0795

CVE-2013-0795 affects Mozilla Firefox (before 20.0) and related Mozilla stack (ESR 17.x before 17.0.5, Thunderbird before 17.0.5, SeaMonkey before 2.17). The issue arises from the System Only Wrapper (SOW) allowing a crafted site to clone a protected node via cloneNode, bypassing the Same Origin ...

CVE-2010-0177

CVE-2010-0177 affects Mozilla Firefox before 3.0.19, 3.5.x before 3.5.9, and 3.6.x before 3.6.2, and SeaMonkey before 2.0.4. The vulnerability frees the contents of the window.navigator.plugins array while a reference to an element remains active, enabling remote code execution or a crash via a d...

CVE-2010-3170

CVE-2010-3170 affects Mozilla Firefox (3.5.x before 3.5.14; 3.6.x before 3.6.11), Thunderbird (before 3.0.9; before 3.1.x before 3.1.5), and SeaMonkey (before 2.0.9). Root cause: wildcard in the X.509 certificate subject Common Name enables MITM by spoofing SSL servers with a cert from a trusted ...

CVE-2011-2995

CVE-2011-2995 is a browser engine vulnerability affecting Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4. The issue allows remote attackers to cause memory corruption and application crashes or possibly execute arbitrary code via unknown vectors;...

CVE-2012-1967

CVE-2012-1967 affects Mozilla Firefox 4.x–13.0, Firefox ESR 10.x prior to 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x prior to 10.0.6, and SeaMonkey prior to 2.11. Root cause: JavaScript sandbox may run javascript: URLs with insufficient context, allowing remote code execution with user pr...

CVE-2009-3389

CVE-2009-3389 is an integer overflow in libtheora (Theora video library) that affects Mozilla Firefox <3.5.6 and SeaMonkey

CVE-2010-2764

CVE-2010-2764 affects Mozilla Firefox (before 3.5.12 and before 3.6.9), Thunderbird (before 3.0.7 and before 3.1.3), and SeaMonkey (before 2.0.7). The flaw: read access to XMLHttpRequest.statusText is not properly restricted, enabling remote attackers to determine the existence of intranet web se...

CVE-2011-2373

CVE-2011-2373 concerns a use-after-free in Mozilla Firefox (prior to 3.6.18 and 4.x up to 4.0.1), Thunderbird (before 3.1.11), and SeaMonkey (through 2.0.14). The vulnerability occurs when JavaScript is disabled and an attacker provides a crafted XUL document, enabling remote code execution. The ...

CVE-2012-0467

CVE-2012-0467 is reflected in multiple Nessus/MiracleLinux advisories for Mozilla Firefox 4.x–11.0, Firefox ESR 10.x (before 10.0.4), Thunderbird 5.0–11.0, Thunderbird ESR 10.x (before 10.0.4), and SeaMonkey before 2.9. The Connected documents describe a set of memory-safety and control-flow vuln...

CVE-2013-1713

CVE-2013-1713 affects Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20. It arises from an incorrect URI comparison during enforcement of the Same Origin Policy, enabling remote attackers to perfor...

CVE-2010-3180

The CVE-2010-3180 use-after-free affects Mozilla products: Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9. The issue arises in the nsBarProp function when accessing the locationbar property of a closed window, enabling re...

CVE-2010-1199

CVE-2010-1199 : Integer overflow in the XSLT node sorting implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5 allows remote attackers to execute arbitrary code via a large text value for a node. Affected products are t...

CVE-2010-2752

CVE-2010-2752 is an integer overflow in Mozilla’s CSS handling that affects Firefox 3.5.x (before 3.5.11), Firefox 3.6.x (before 3.6.7), Thunderbird 3.0.x (before 3.0.6), Thunderbird 3.1.x (before 3.1.1), and SeaMonkey before 2.0.6. The issue arises in an array class used to store CSS values, tie...

CVE-2013-1714

CVE-2013-1714 concerns Mozilla Firefox and related Mozilla components. The affected products are Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20. Root cause (per the connected MiracleLinux/Nessus entry):...

CVE-2013-1717

CVE-2013-1717: Local-filesystem access via Java applets not properly restricted in Mozilla Firefox (before 23.0; ESR 17.x before 17.0.8), SeaMonkey (before 2.20), and Thunderbird (before 17.0.8). This allows user‑assisted reading of arbitrary files through downloads to fixed/predictable paths. Co...

CVE-2013-1735

CVE-2013-1735 : A use-after-free in Mozilla's ScrollbarActivity in Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code via image-document scrolling vectors. Ex...

CVE-2010-0173

CVE-2010-0173 affects Mozilla Firefox before 3.5.9 and 3.6.x before 3.6.2, Thunderbird before 3.0.4, and SeaMonkey before 2.0.4. The issue is memory corruption in the browser engine that can cause denial of service or potentially allow remote code execution. Mitigation per connected docs: upgrade...

CVE-2010-0654

CVE-2010-0654 affects Mozilla family: Firefox 3.5.x up to 3.5.10 and 3.6.x up to 3.6.6, Thunderbird 3.0.x up to 3.0.5 and 3.1.x up to 3.1.0, and SeaMonkey before 2.0.6. The root cause is cross-origin loading of CSS stylesheets when the stylesheet download has an incorrect MIME type and the styles...

CVE-2013-1725

CVE-2013-1725 affects Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21. The issue is that initialization of JavaScript objects with compartments may not occur, allowing remote attackers to execute a...

CVE-2010-2768

CVE-2010-2768 affects Mozilla Firefox (before 3.5.12 and 3.6.x before 3.6.9), Thunderbird (before 3.0.7 and 3.1.x before 3.1.3), and SeaMonkey (before 2.0.7). Root cause: Object tag type attribute not properly restricted when setting a document charset, enabling UTF-7 encoded payloads to bypass X...

CVE-2010-3169

CVE-2010-3169 affects Mozilla's browser engine across multiple products: Firefox ≤ 3.5.11 (and 3.6.x prior to 3.6.9), Thunderbird ≤ 3.0.6 (and 3.1.x prior to 3.1.3), and SeaMonkey ≤ 2.0.6 (prior to 2.0.7). The issue is described as memory safety vulnerabilities in the browser engine that could al...

CVE-2012-1951

CVE-2012-1951 is an actual security issue described in the connected MiracleLinux AXSA:2012-874 advisory as a Use-after-free in Mozilla Firefox 4.x–13.0 (and Firefox ESR 10.x before 10.0.6) affecting nsSMILTimeValueSpec::IsEventBased, with Thunderbird 5.0–13.0 and SeaMonkey before 2.11 also impli...

CVE-2013-1709

CVE-2013-1709 is a Firefox/XUL/SeaMonkey family XSS issue caused by improper handling of FRAME elements and history, allowing remote attackers to spoof a relative location in a previously visited document. Affected products are Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderb...

CVE-2013-5590

CVE-2013-5590 affects Mozilla Firefox and related products (Firefox/ESR, Thunderbird, SeaMonkey). The Mozilla browser engine and associated components contain memory corruption/denial-of-service vulnerabilities that could lead to arbitrary code execution via unspecified vectors. Public advisories...

CVE-2010-1214

CVE-2010-1214 describes an integer overflow in plugin content handling that affects Mozilla Firefox 3.5.x (before 3.5.11) and Firefox 3.6.x (before 3.6.7), and SeaMonkey before 2.0.6. The vulnerability arises from an integer overflow when parsing plugin parameter elements, leading to memory corru...