2028 matches found
CVE-2021-43534
The CVE-2021-43534 entry concerns memory safety bugs in Mozilla Firefox 93 and Firefox ESR 91.2, with potential for memory corruption and possible arbitrary code execution. Affected products are Firefox < 94, Thunderbird < 91.3, and Firefox ESR
CVE-2021-43535
CVE-2021-43535 is a memory-safety vulnerability in Mozilla browsers where an HTTP2 session object could be released on a different thread, causing use-after-free, memory corruption, and a potentially exploitable crash. The consolidated information across sources indicates the issue affects Firefo...
CVE-2022-36319
CVE-2022-36319 involves a mouse position spoofing issue caused by combining CSS overflow and transform properties, affecting Firefox ESR and Thunderbird prior to certain fixed versions. Affected are Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and Thun...
CVE-2022-38478
CVE-2022-38478 refers to memory-safety bugs reported by the Mozilla Fuzzing Team affecting Firefox 103, Firefox ESR 102.1, and Firefox ESR 91.12, with potential for memory corruption and, with sufficient effort, arbitrary code execution. Affected products include Thunderbird (versions older than ...
CVE-2023-25728
The CVE-2023-25728 entry describes a CSP-Report-Only header issue where an attacker could leak a child iframe’s unredacted URI during a redirect, affecting Firefox < 110, Thunderbird < 102.8, and Firefox ESR
CVE-2023-25737
CVE-2023-25737 describes an invalid downcast from nsTextNode to SVGElement that could lead to undefined behavior. The vulnerability is observed in Mozilla Firefox (versions before 110), Thunderbird (versions before 102.8), and Firefox ESR (versions before 102.8). Connected advisories consistently...
CVE-2023-28162
CVE-2023-28162 affects Firefox <111, Firefox ESR <102.9, and Thunderbird
CVE-2023-6204
CVE-2023-6204 describes an out-of-bounds read that can leak memory data into images created on the canvas element. The issue affects Firefox versions older than 120, Firefox ESR older than 115.5.0, and Thunderbird older than 115.5.0. The available connected advisories corroborate the vulnerabilit...
CVE-2020-15646
This CVE describes a credential theft flaw in Thunderbird: if an attacker can intercept Thunderbird’s initial automatic account setup via Microsoft Exchange autodiscovery and reply with crafted data, Thunderbird may send a username and password over HTTPS to the attacker-controlled server. Affect...
CVE-2011-2371
CVE-2011-2371 is an integer overflow in Mozilla Firefox’s Array.reduceRight that could cause remote code execution when processing very large JavaScript arrays. Affected products include Firefox up to 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14. The issue...
CVE-2018-5168
CVE-2018-5168 is a vulnerability in Thunderbird and Firefox where an attacker can bypass permission checks by manipulating the baseURI of the theme element, enabling a user interaction-free installation of a theme that could contain offensive images. Affected products and versions per the records...
CVE-2022-3034
CVE-2022-3034 describes a vulnerability in Mozilla Thunderbird where receiving an HTML email that requests loading an iframe from a remote location causes the browser to fetch the remote document, even though Thunderbird does not display it. The issue affects Thunderbird versions prior to 102.2.1...
CVE-2023-1945
CVE-2023-1945 is a vulnerability in Mozilla code paths related to the Safe Browsing API. The initial data from the Safe Browsing API could lead to memory corruption and a potentially exploitable crash. Affected products per the connected data: Thunderbird and Firefox ESR, affected when using vers...
CVE-2023-25732
CVE-2023-25732 involves an out-of-bounds memory write caused by incorrect calculation of the input size when encoding data from inputStream in xpcom. The vulnerability affects Firefox before 110, Thunderbird before 102.8, and Firefox ESR before 102.8. Connected advisories corroborate the issue an...
CVE-2017-5373
Summary (CVE-2017-5373) Memory-safety bugs were reported in Firefox 50.1/ESR 45.6 and affect Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox
CVE-2017-7814
This CVE (CVE-2017-7814) affects Mozilla products (Firefox < 56, Firefox ESR < 52.4, Thunderbird
CVE-2017-5402
CVE-2017-5402 is a use-after-free in FontFace event handling that can crash Firefox/Thunderbird when a FontFace object is destroyed but events are fired. Affected products and versions include Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird
CVE-2018-12389
CVE-2018-12389 relates to memory safety bugs in Mozilla Firefox ESR 60.x affecting Firefox ESR < 60.3 and Thunderbird
CVE-2018-5154
CVE-2018-5154 is a use-after-free in the enumeration of attributes during SVG animations with clip paths, causing a potentially exploitable crash. Affected: Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, Firefox ESR
CVE-2023-29535
CVE-2023-29535: The vulnerability arises from a garbage collector compaction issue in Firefox/related products where a weak map could be accessed before proper tracing, leading to memory corruption and a potentially exploitable crash. Affected software per documents includes Firefox (and derivati...
CVE-2023-6208
CVE-2023-6208 is a Firefox/Thunderbird issue limited to X11: text selected via the Selection API is copied into the primary selection. Affected: Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird
CVE-2025-5268
Memory safety bugs exist in Firefox 138 , Thunderbird 138 , Firefox ESR 128.10 , and Thunderbird 128.10 . These flaws involve a lack of data cleaning at the management level, which can result in memory corruption. With sufficient effort, these vulnerabilities could be exploited by a remote attack...
CVE-2015-0801
CVE-2015-0801 describes a cross-domain bypass of Same Origin Policy in Mozilla Firefox (and derivatives) via anchor navigation to execute JavaScript with chrome privileges. The issue affects Firefox/Firefox ESR and Thunderbird (per initial entry and IBM/Debian advisories referencing these CVEs). ...
CVE-2017-5443
The CVE-2017-5443 entry describes an out-of-bounds write during BinHex decoding that affects Mozilla products: Thunderbird before 52.1, Firefox ESR before 52.1, and Firefox before 53. The impact is memory corruption with potential crashes and possible arbitrary code execution. Upstream fixes are ...
CVE-2022-38472
The CVE-2022-38472 issue is a cross-origin spoofing vulnerability where XSLT error handling could allow attacker‑controlled content to be displayed as a different origin in the address bar, potentially tricking users into submitting data to a spoofed site. Affected products/versions (as stated in...
CVE-2023-32215
CVE-2023-32215 refers to memory-safety bugs in Mozilla Firefox and Firefox ESR (112/ESR 102.10) with potential for arbitrary code execution. Affected are Firefox < 113, Firefox ESR < 102.11, and Thunderbird
CVE-2016-9904
CVE-2016-9904 describes a timing-attack vulnerability in JavaScript Map/Set usage that can leak information across websites. Affected products include Firefox versions before 50.1, Firefox ESR before 45.6, and Thunderbird before 45.6. The issue enables an attacker to determine if an atom is used ...
CVE-2017-5383
CVE-2017-5383 describes spoofing via specific Unicode glyphs used to alter the location bar content. The initial entry notes impact on Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox
CVE-2017-5405
CVE-2017-5405: In Mozilla Firefox/Thunderbird the vulnerability arises from how certain FTP response codes are handled, causing uninitialized port values to be used in FTP operations. Connected advisories confirm this CVE is fixed in Thunderbird/Firefox branches around version 52 and ESR 45.8 (e....
CVE-2017-7807
CVE-2017-7807 describes a domain URL hijack via AppCache fallback, resolved by requiring fallback files to be inside the manifest directory. Affected products include Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox
CVE-2023-6856
CVE-2023-6856 describes a heap-buffer-overflow in the WebGL DrawElementsInstanced path when run with the Mesa VM driver. Impacted products include Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox
CVE-2024-0750
CVE-2024-0750 affects Firefox (versions prior to 122) and Thunderbird (prior to 115.7), with the issue described as a bug in popup notifications delay calculation that could allow a user to be tricked into granting permissions. Connected advisories confirm the vulnerability and link it to Mozilla...
CVE-2014-1490
CVE-2014-1490 : A race condition in NSS libssl session ticket processing (use-after-free) could allow remote attackers to cause a denial of service or, per the description, potentially other impact via a resumption handshake. Affected: NSS up to 3.15.4 and, by extension, Mozilla products (Firefox...
CVE-2018-12361
CVE-2018-12361 is an integer overflow in the SwizzleData code during buffer-size calculation that can lead to a potentially exploitable crash when inputs aren’t sanitized. Affected products include Mozilla Thunderbird before 60 and Firefox family before 61 (Firefox ESR before 60.1). Public remedi...
CVE-2023-29548
CVE-2023-29548 concerns a wrong lowering instruction in the ARM64 Ion compiler that yields an incorrect optimization result. The vulnerability affects Firefox (<112), Focus for Android (<112), Firefox ESR (<102.10), Firefox for Android (<112), and Thunderbird (
CVE-2023-32206
CVE-2023-32206: An out-of-bounds read in the RLBox Expat driver could crash affected Mozilla components. Affected software includes Firefox <113, Firefox ESR <102.11, and Thunderbird
CVE-2024-7652
An error in the ECMA-262 specification regarding Async Generators can lead to a type confusion vulnerability within the JavaScript engine. This flaw could potentially result in memory corruption and cause an exploitable crash . The vulnerability impacts several versions of Firefox (less than 128)...
CVE-2022-38477
CVE-2022-38477 concerns memory safety bugs reported by Mozilla’s Fuzzing Team in Firefox 103 and Firefox ESR 102.1. The entry notes evidence of memory corruption and a presumption that, with sufficient effort, some bugs could be exploited to execute arbitrary code. Affected products explicitly li...
CVE-2023-29550
CVE-2023-29550 corresponds to memory-safety bugs in Mozilla Firefox 111 and Firefox ESR 102.9 (affecting Firefox < 112, Focus for Android < 112, ESR < 102.10, Firefox for Android < 112, Thunderbird
CVE-2023-5726
The CVE-2023-5726 issue is a macOS-only browser UI vulnerability where an obscured fullscreen notification could be exposed via the file-open dialog, potentially enabling spoofing or user confusion. Affected products/versions are Firefox older than 119, Firefox ESR older than 115.4, and Thunderbi...
CVE-2024-0753
CVE-2024-0753: Affects Firefox before 122, Firefox ESR before 115.7, and Thunderbird before 115.7. In certain HSTS configurations, a subdomain could bypass the upper-domain HSTS policy. Public documents from Astra Linux, Debian LTS, and Red Hat/ALAS advisories confirm this as a subdomain HSTS byp...
CVE-2024-1936
The Thunderbird email client (versions earlier than 115.8.1 ) is vulnerable to a flaw where the encrypted subject of an email message can be incorrectly and permanently assigned to another arbitrary email in the local cache . This could lead to a user accidentally leaking confidential subjects to...
CVE-2012-5829
CVE-2012-5829 is a heap-based buffer overflow in the nsWindow::OnExposeEvent function affecting Mozilla Firefox before 17.0, Firefox ESR before 10.0.11, Thunderbird before 17.0, Thunderbird ESR before 10.0.11, and SeaMonkey before 2.14. Connected documents confirm this vulnerability across multip...
CVE-2017-5447
CVE-2017-5447 is an out-of-bounds read in glyph widths processing during text layout that can cause a crash and potentially expose memory. Affected products include Mozilla Thunderbird (<52.1) and Mozilla Firefox/Firefox ESR (ESR <52.1; Firefox
CVE-2017-7791
CVE-2017-7791: A data: protocol-based modal alert spoofing vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox
CVE-2021-38505
The CVE describes a Windows 10 Cloud Clipboard issue where copied data could be recorded to the cloud if Cloud Clipboard is enabled. Affected products/versions identified are Firefox before 94, Thunderbird before 91.3, and Firefox ESR before 91.3 on Windows 10+. The root cause is that application...
CVE-2024-0742
The CVE-2024-0742 entry is confirmed with concrete details in connected docs: an incorrect timestamp used to prevent input after page load can cause browser prompts and dialogs to be activated or dismissed unintentionally. Affected products are Firefox < 122, Firefox ESR < 115.7, and Thunde...
CVE-2023-25729
CVE-2023-25729 involves a permissions prompt issue for external schemes that was only shown for ContentPrincipals, allowing extensions using ExpandedPrincipals to open them without user interaction. This could enable actions like downloading files or interacting with installed software. Affected:...
CVE-2023-32211
CVE-2023-32211 describes a type checking bug in Mozilla Firefox and Thunderbird that could lead to invalid code being compiled. The connected documents confirm the flaw affects Firefox versions prior to 113, Firefox ESR prior to 102.11, and Thunderbird prior to 102.11. Multiple security advisorie...