CVE-2013-6629

The CVE-2013-6629 issue affects libjpeg 6b and libjpeg-turbo up to 1.3.0, used by Chrome prior to 31.0.1650.48, Ghostscript, and other products. The vulnerability arises in get_sos() in jdmarker.c, which does not properly validate certain duplications of component data after SOS JPEG markers, all...

CVE-2014-1491

CVE-2014-1491 describes an issue in the Mozilla NSS library where public DH values were not properly restricted, enabling remote attackers to bypass cryptographic protections in ticket handling when NSS was used (e.g., in Firefox/Thunderbird/SeaMonkey). The vulnerability affects NSS

CVE-2024-1547

CVE-2024-1547 affects Mozilla Firefox (stable and ESR) and Thunderbird prior to certain patched versions. Affected: Firefox < 123, Firefox ESR < 115.8, Thunderbird

CVE-2024-1550

CVE-2024-1550 involves a vulnerability where a malicious webpage could combine exiting fullscreen mode with requestPointerLock to reposition the user’s mouse, potentially causing confusion and unintended permission grants. Affected products include Firefox versions before 123, Firefox ESR before ...

CVE-2024-1551

The vulnerability CVE-2024-1551 allows an attacker to inject Set-Cookie response headers that are incorrectly honored by the browser during multipart HTTP responses . This occurs if an attacker can control the Content-Type response header and part of the response body. The issue impacts Firefox &...

CVE-2024-1546

A vulnerability exists in Firefox (versions < 123, ESR < 115.8) and Thunderbird (versions

CVE-2024-1548

The Firefox browser and Thunderbird email client are vulnerable to a flaw where a website can use a dropdown select input element to obscure a fullscreen notification . This vulnerability could lead to user confusion and potential spoofing attacks . The affected versions include Firefox < 123 ...

CVE-2024-1549

This vulnerability affects Firefox versions less than 123, Firefox ESR less than 115.8, and Thunderbird less than 115.8. The issue occurs when a website sets a large custom cursor , which can overlap with the permission dialog . This overlap may result in user confusion, potentially leading to th...

CVE-2023-5388

The NSS library is susceptible to a timing side-channel attack during RSA decryption , which could allow an attacker to recover private data. This vulnerability affects Firefox < 124 , Firefox ESR < 115.9 , and Thunderbird

CVE-2024-4367

CVE-2024-4367 concerns a missing type check when handling fonts in PDF.js, allowing arbitrary JavaScript execution within the PDF.js context. Affected products listed in connected docs include Firefox before 126, Firefox ESR before 115.11, and Thunderbird before 115.11. The root cause is limited ...

CVE-2024-3863

Technical details about CVE-2024-3863 are not provided in the supplied documents. Public information is limited to the vulnerability description and affected products; monitor for updates from authoritative sources for affected versions, impact, and fixes.

CVE-2024-1553

Memory safety bugs exist in Firefox , Firefox ESR , and Thunderbird software. These vulnerabilities involve memory corruption and could potentially be exploited to execute arbitrary code with sufficient effort. Affected versions include Firefox < 123 , Firefox ESR < 115.8 , and Thunderbird

CVE-2024-2616

The CVE-2024-2616 entry describes a vulnerability in ICU handling for out-of-memory conditions that causes a crash instead of continued operation. Affected products include Firefox ESR and Thunderbird versions prior to 115.9. The change is intended to harden against exploitation, with the impact ...

CVE-2024-2611

This vulnerability affects Firefox versions prior to 124, Firefox ESR prior to 115.9, and Thunderbird prior to 115.9. The root cause is a missing delay when the pointer lock mechanism is utilized, which could allow a malicious webpage to deceive a user into granting permissions. No specific explo...

CVE-2024-1552

CVE-2024-1552 involves incorrect code generation on 32-bit ARM devices, potentially causing undefined behavior. Public references show affected Mozilla products including Firefox (pre-123 and ESR 115.8, and Firefox ESR 115.8) and Thunderbird 115.8.x line, with multiple advisories (CentOS, Debian ...

CVE-2024-2609

A clickjacking vulnerability exists in Firefox , Firefox ESR , and Thunderbird because the permission prompt input delay can expire while the window is out of focus. This condition allows malicious websites to trick users into performing unintended actions. The issue affects Firefox < 124 , Fi...

CVE-2024-2614

CVE-2024-2614 is a documented memory-safety issue in Mozilla Firefox and Thunderbird. The core description states memory-safety bugs in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8, with evidence of memory corruption and a potential to be exploited to run arbitrary code. Affected product...

CVE-2023-29542

Technical details for CVE-2023-29542 are not publicly disclosed in the provided documents. No affected products, root cause, or mitigation are specified here. Monitor for updates from the sources to obtain concrete information.

CVE-2024-6604

Memory safety bugs affect Firefox , Firefox ESR , and Thunderbird applications. The vulnerabilities, which include evidence of memory corruption , could potentially be exploited to execute arbitrary code with sufficient effort. Affected versions include Firefox < 128 , Firefox ESR < 115.13 ...

CVE-2023-4863

CVE-2023-4863 describes a heap buffer overflow in libwebp used by Google Chrome prior to 116.0.5845.187 and in libwebp 1.3.2. A remote attacker can cause an out-of-bounds memory write by presenting a crafted HTML page. The vulnerability is exploitable over the network and requires user interactio...

CVE-2022-26485

CVE-2022-26485 is a Mozilla/firefox-family use-after-free vulnerability triggered by removing an XSLT parameter during processing. Affected products include Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus

CVE-2023-29532

CVE-2023-29532 describes a local, Windows-only vulnerability where an attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service to a malicious SMB server. The update can be replaced after the signature check but before use because the service...

CVE-2022-26486

CVE-2022-26486 describes a use-after-free in the WebGPU IPC framework leading to a sandbox escape. Affected products and versions (per connected docs): Firefox < 97.0.2; Firefox ESR < 91.6.1; Firefox for Android < 97.3.0; Thunderbird < 91.6.2; Focus

CVE-2023-0767

CVE-2023-0767 describes a vulnerability where an attacker could construct a PKCS#12 cert bundle in a way that mishandles Safe Bag attributes, enabling arbitrary memory writes. Affected software: Firefox < 110, Thunderbird < 102.8, and Firefox ESR

CVE-2019-11708

CVE-2019-11708 is a sandbox-escape vulnerability in Mozilla Firefox ESR and Thunderbird caused by insufficient vetting of parameters in the Prompt:Open IPC message between child and parent processes, allowing a compromised child to cause the non-sandboxed parent to open web content and potentiall...

CVE-2015-4000

CVE-2015-4000 is the Logjam vulnerability: when a server enables DHE_EXPORT ciphers and the client does not, the TLS handshake may downgrade to 512‑bit export‑grade DH, allowing a MITM to decrypt traffic. Public details describe the issue in TLS as a downgrade attack on Diffie–Hellman key exchang...

CVE-2019-17026

CVE-2019-17026 describes a type-confusion vulnerability in the IonMonkey JIT used by Mozilla products. The issue stems from incorrect alias information when storing array elements, enabling a type confusion that could be exploited for arbitrary code execution. Affected products include Firefox ES...

CVE-2020-6819

CVE-2020-6819 is a use-after-free caused by a race condition in the nsDocShell destructor identified in Mozilla Firefox and Thunderbird. The flaw affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR

CVE-2019-11707

CVE-2019-11707 is a type confusion vulnerability in Mozilla Firefox/Thunderbird caused by issues in Array.pop when manipulating JavaScript objects, leading to an exploitable crash. It affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird

CVE-2013-1690

CVE-2013-1690 affects Mozilla Firefox prior to 22.0, Firefox ESR 17.x prior to 17.0.7, Thunderbird prior to 17.0.7, and Thunderbird ESR 17.x prior to 17.0.7. Root cause is improper handling of onreadystatechange events with page reload, enabling a crafted web page to cause a denial-of-service (cr...

CVE-2020-6820

CVE-2020-6820 describes a race condition in handling a ReadableStream that can cause a use-after-free, affecting Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR

CVE-2024-3302

The Firefox browser and Thunderbird email client are vulnerable to a Denial of Service (DoS) condition. The root cause is a lack of limits on the number of HTTP/2 CONTINUATION frames processed, which allows a remote server to trigger an Out of Memory (OOM) condition. This affects Firefox versions...

CVE-2024-3854

This vulnerability exists in Firefox (versions < 125, ESR < 115.10) and Thunderbird (versions

CVE-2024-3852

The GetBoundName function in the JIT compiler could return the wrong version of an object when JIT optimizations are applied. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird

CVE-2013-1675

CVE-2013-1675 affects Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, and Thunderbird before 17.0.6. The issue arises from improper initialization of nsDOMSVGZoomEvent data structures (mPreviousScale and mNewScale), enabling a remote attacker to disclose memory-resident data via a cr...

CVE-2024-3861

A potential use-after-free vulnerability exists in Firefox and Thunderbird due to an AlignedBuffer self-move operation. If an AlignedBuffer is assigned to itself, the subsequent self-move can result in an incorrect reference count. This issue affects Firefox < 125 , Firefox ESR < 115.10 , a...

CVE-2024-3857

The Mozilla browser Firefox (versions < 125, ESR < 115.10) and Thunderbird (version

CVE-2024-3859

Mozilla Firefox , Firefox ESR , and Thunderbird are vulnerable to an integer overflow leading to an out-of-bounds-read within the OpenType sanitizer on 32-bit versions. This flaw can be triggered by processing a malformed OpenType font , potentially allowing a remote intruder to gain unauthorized...

CVE-2023-5217

CVE-2023-5217 is a heap buffer overflow in VP8 encoding in libvpx (affecting Google Chrome before 117.0.5938.132 and libvpx 1.13.1). A crafted HTML page could remotely trigger heap corruption. Multiple connected sources confirm the vulnerability in libvpx/WebP contexts; Apple’s advisory notes CVE...

CVE-2023-34416

CVE-2023-34416 involves memory-safety bugs in Mozilla Firefox and Thunderbird. The vulnerability affects Firefox 113 and Firefox ESR 102.11, with possible memory corruption that could be exploited to execute arbitrary code; affected list includes Firefox < 114, ESR < 102.12, and Thunderbird

CVE-2023-23599

CVE-2023-23599 affects Firefox <109, Firefox ESR <102.7, and Thunderbird

CVE-2013-2566

CVE-2013-2566 involves RC4 biases in TLS/SSL allowing plaintext-recovery via large volumes of sessions with the same plaintext. Multiple connected sources confirm this issue affecting products such as F5 BIG-IP (various modules) and IBM Proventia/SiteProtector family. Affected in some BIG-IP rele...

CVE-2024-9680

CVE-2024-9680 is a use-after-free in the Animation timelines that enables code execution in the content process. Affected Mozilla products include Firefox and Thunderbird with the following vulnerable versions: Firefox < 131.0.2; Firefox ESR < 128.3.1; Firefox ESR < 115.16.1; Thunderbird...

CVE-2019-7317

CVE-2019-7317 is a use-after-free involving png_image_free in libpng. A connected document ties this to the FLTK package, affecting versions less than 1.3.8-1, and states that upgrading to a later FLTK version resolves the issue. If applying this advisory, upgrade FLTK to 1.3.8-1 or newer for rem...

CVE-2022-29917

CVE-2022-29917 involves memory-safety bugs in Firefox 99 and Firefox ESR 91.8 (Mozilla Fuzzing Team). Some bugs showed memory corruption and, with enough effort, could be exploited to run arbitrary code. affected products include Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox

CVE-2022-0566

Mozilla Thunderbird contains a vulnerability CVE-2022-0566: processing a crafted email message can trigger an out-of-bounds write of one byte. Affected product: Thunderbird (client). Root cause: an out-of-bounds write when handling certain messages. Impact as stated: potential compromise via malf...

CVE-2016-9079

CVE-2016-9079 is a use-after-free vulnerability in Mozilla Firefox/Thunderbird SVG Animation. Affected: Firefox < 50.0.2, Firefox ESR < 45.5.1, Thunderbird

CVE-2022-29914

CVE-2022-29914 describes a memory-safety/logic issue in Firefox/Thunderbird where reusing existing popups could cover the fullscreen notification UI, enabling browser spoofing attacks. Affected products include Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox

CVE-2022-1529

This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird

CVE-2022-1802

This vulnerability is caused by prototype pollution within the Top-Level Await implementation in JavaScript. An attacker who manages to corrupt the methods of an Array object could achieve the execution of attacker-controlled JavaScript code in a privileged context . Affected products include Fir...