CVE-2018-5129

The CVE-2018-5129 entry relates to a memory-safety/IPC validation issue where a lack of parameter validation on IPC messages can cause an out-of-bounds write, potentially enabling sandbox escape. Affected products include Mozilla Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox

CVE-2023-29535

CVE-2023-29535: The vulnerability arises from a garbage collector compaction issue in Firefox/related products where a weak map could be accessed before proper tracing, leading to memory corruption and a potentially exploitable crash. Affected software per documents includes Firefox (and derivati...

CVE-2015-2734

CVE-2015-2734 details (mode C): The vulnerability affects Mozilla Firefox (Direct3D 9 implementation) in Windows builds prior to 39.0, Firefox ESR 31.x prior to 31.8 and 38.x prior to 38.1, and Thunderbird prior to 38.1. The underlying issue is reading data from uninitialized memory locations in ...

CVE-2023-25742

CVE-2023-25742 : When importing a SPKI RSA public key as ECDSA P-256, the key is handled incorrectly, causing the tab to crash. Affected products per provided docs: Firefox < 110, Thunderbird < 102.8, and Firefox ESR

CVE-2023-28163

CVE-2023-28163 is a Windows-specific Firefox/Thunderbird vulnerability where the Save As dialog incorrectly resolves environment variables in suggested filenames, causing context exposure to the current user. Affected products are Firefox on Windows (Firefox < 111 and ESR < 102.9) and Thund...

CVE-2023-6860

CVE-2023-6860: The VideoBridge channel allowed a content process to access textures from remote decoders, creating a potential sandbox escape in Firefox ESR <115.6, Thunderbird <115.6, and Firefox

CVE-2017-7753

CVE-2017-7753 is an out-of-bounds read in the rendering path when applying style rules to pseudo-elements (e.g., ::first-line) using cached style data. Affected products/versions include Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox

CVE-2006-1733

CVE-2006-1733 affects Mozilla Firefox and Thunderbird 1.x before 1.5, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0. The flaw is in the compilation scope handling of privileged built‑in XBL bindings, enabling a remote attacker to run arbitrary code via (1) valueOf.call or (2) valueOf.appl...

CVE-2012-4186

CVE-2012-4186 : Heap-based buffer overflow in Mozilla Firefox’s nsWaveReader::DecodeAudioData. Affected products include Firefox before 16.0 (and Firefox ESR 10.x before 10.0.8), Thunderbird before 16.0, and SeaMonkey before 2.13. Vectors are unspecified in the provided docs, but exploitation wou...

CVE-2015-2724

CVE-2015-2724 involves memory safety bugs in the Mozilla Firefox browser engine (affecting Firefox up to version 39.0, ESR lines older than 31.8/38.1, and Thunderbird before 38.1). The issues allow remote attackers to cause a denial of service via memory corruption or potentially execute arbitrar...

CVE-2017-5433

CVE-2017-5433 is a use-after-free in SMIL animation functions. Affected software includes Mozilla Firefox builds before 53 and Thunderbird before 52.1 ESR; the underlying issue arises when pointers to animation elements in an array are dropped from the animation controller while still in use, lea...

CVE-2022-2226

CVE-2022-2226 describes a vulnerability in Mozilla Thunderbird where an OpenPGP signature includes the signature date, which may differ from the email display date. If the dates don’t match, Thunderbird could still accept the signature; a replay attack (resenting an old email later) could mislead...

CVE-2022-45406

CVE-2022-45406 describes a memory-safety flaw in JavaScript: when an out-of-memory condition occurs during creation of a global, a JavaScript realm can be deleted while references linger in a BaseShape, leading to a use-after-free and potentially exploitable crash. Affected products include Firef...

CVE-2023-28164

CWE- style note: CVE-2023-28164 affects Firefox <111, Firefox ESR <102.9, and Thunderbird

CVE-2024-0742

The CVE-2024-0742 entry is confirmed with concrete details in connected docs: an incorrect timestamp used to prevent input after page load can cause browser prompts and dialogs to be activated or dismissed unintentionally. Affected products are Firefox < 122, Firefox ESR < 115.7, and Thunde...

CVE-2014-1505

CVE-2014-1505 affects Mozilla Firefox (and related Mozilla components) where SVG filter operations in feDisplacementMap could leak displacement-correlation data and potentially bypass Same Origin Policy via a timing attack, enabling partial information disclosure from a different domain. Affected...

CVE-2016-9897

CVE-2016-9897 affects Mozilla Firefox (versions < 50.1) and Firefox ESR (< 45.6) and Thunderbird (

CVE-2013-1718

CVE-2013-1718 is a remote memory-safety vulnerability in the Mozilla Firefox/Thunderbird/SeaMonkey browser engine. The issue affects Firefox up to version 24.0, Firefox ESR 17.x up to 17.0.9, Thunderbird up to 24.0, Thunderbird ESR 17.x up to 17.0.9, and SeaMonkey up to 2.21, and can lead to memo...

CVE-2017-5459

CVE-2017-5459 is a buffer overflow in the WebGL component triggerable by web content. Affected products include Mozilla Firefox (non-ESR) <53 and Thunderbird/Firefox ESR variants listed in the description (Thunderbird <52.1, Firefox ESR <45.9, Firefox ESR <52.1, Firefox

CVE-2018-5127

The CVE-2018-5127 issue is a memory-safety buffer overflow in the SVG path handling (svg animatedPathSegList) triggered via script, allowing a potentially exploitable crash. Affected products and versions include Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox

CVE-2023-29533

CVE-2023-29533 affects Firefox (pre-112, ESR pre-102.10, Android-focused builds pre-112) and Thunderbird (

CVE-2012-1952

CVE-2012-1952 is a memory-safety/typical bad-cast flaw in Mozilla’s nsTableFrame::InsertFrames that occurs when processing mixed row-group and column-group frames. Affected products include Mozilla Firefox 4.x–13.0, Firefox ESR 10.x prior to 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x prio...

CVE-2013-0754

CVE-2013-0754 is a use-after-free in the ListenerManager of Mozilla Firefox (and related Firefox ESR, Thunderbird, SeaMonkey). According to the description, triggering garbage collection after memory allocation for listener objects can allow a remote attacker to execute arbitrary code. Affected p...

CVE-2013-0788

CVE-2013-0788 concerns multiple unspecified vulnerabilities in the Mozilla Firefox browser engine that can cause memory corruption, a crash, or possibly arbitrary code execution. Affected products include Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ...

CVE-2015-0822

CVE-2015-0822 affects Mozilla Firefox (before 36.0) and Thunderbird (before 31.5). The flaw is in the Form Autocompletion feature, where crafted JavaScript can cause a remote attacker to read arbitrary local files. Public entries in multiple advisories confirm affected products and versions (Fire...

CVE-2017-5429

CVE-2017-5429 involves memory safety bugs in Mozilla Firefox (52 and ESR 45.8/52) and Thunderbird 52. Some bugs show memory corruption and could be exploited to run arbitrary code. Affected: Thunderbird < 52.1; Firefox ESR < 45.9, < 52.1; Firefox

CVE-2022-38473

Concrete details for CVE-2022-38473: A cross-origin iframe referencing an XSLT document could inherit the parent domain’s permissions (e.g., microphone or camera) in Thunderbird and Firefox products. Affected: Thunderbird versions earlier than 102.2 and 91.13, Firefox ESR earlier than 91.13 and 1...

CVE-2022-45405

CVE-2022-45405 is a memory-safety use-after-free in the InputStream implementation caused by freeing arbitrary nsIInputStream on a different thread. Documents confirm impact on Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox

CVE-2023-50762

CVE-2023-50762 affects Thunderbird≤115.5 (specifically Thunderbird

CVE-2023-6206

CVE-2023-6206 is described across connected sources as a clickjacking-related issue tied to the fullscreen transition in Mozilla Firefox and Thunderbird. The vulnerability affects Firefox versions older than 120, Firefox ESR older than 115.5.0, and Thunderbird older than 115.5.0. The issue is dis...

CVE-2013-5609

CVE-2013-5609 is a set of memory-corruption/denial-of-service vulnerabilities in the Mozilla Firefox browser engine, affecting Firefox (including ESR 24.x) and related products prior to versions around 26.0 (per the referenced MiracleLinux AXSA advisories). The issues could allow remote attackers...

CVE-2014-1508

CVE-2014-1508 affects Mozilla Firefox family components (libxul) where libxul.so!gfxContext::Polygon can leak memory, cause out-of-bounds reads, or crash, with potential Same Origin Policy bypass via MathML polygon rendering. Affected: Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbir...

CVE-2014-1564

CVE-2014-1564 affects Mozilla Firefox (and Firefox ESR 31.x) before version 32.0 and Thunderbird before 31.1. The issue is a memory initialization flaw in the GIF rendering path, causing an information leak from the process memory via crafted GIFs and interactions with a CANVAS element. Impact is...

CVE-2017-5446

Technical details about CVE-2017-5446 are not publicly available in the provided connected documents. Monitor for updates from vendors and security advisories to confirm affected products, impact, and fixes.

CVE-2017-7779

CVE-2017-7779 is a set of memory-safety issues reported in Mozilla Thunderbird and Mozilla Firefox components prior to Firefox 55 and Thunderbird 52.3. The Arch Linux ASA-201708-18 and related advisories describe multiple flaws (memory corruption, use-after-free, out-of-bounds reads, and other me...

CVE-2023-32213

CVE-2023-32213 affects Mozilla Firefox and Thunderbird. The flaw arises when reading a file, where an uninitialized value could be used as the read limit. Affected versions are Firefox <113, Firefox ESR <102.11, and Thunderbird

CVE-2024-0747

CVE-2024-0747 describes a CSP bypass: when a parent page loads a child in an iframe with unsafe-inline, the parent CSP could override the child CSP. Affected: Firefox before 122, Firefox ESR before 115.7, and Thunderbird before 115.7. Practical impact: potential bypass of content security policie...

CVE-2024-0751

CVE-2024-0751 : A malicious devtools extension could have been used to escalate privileges. Affected: Firefox < 122, Firefox ESR < 115.7, Thunderbird

CVE-2012-3993

CVE-2012-3993 affects Mozilla Firefox (pre-16.0), Firefox ESR (pre-10.0.8), Thunderbird (pre-16.0), Thunderbird ESR (pre-10.0.8), and SeaMonkey (pre-2.13). The Chrome Object Wrapper (COW) implementation can mishandle InstallTrigger failures, enabling remote JavaScript execution with chrome privil...

CVE-2017-7818

Summary: CVE-2017-7818 is a use-after-free vulnerability in Thunderbird (and Firefox/ESR components) involving manipulation of ARIA element arrays via the DOM, leading to a potentially exploitable crash. The connected sources confirm the issue affects Thunderbird prior to 52.4.0 and related Mozil...

CVE-2023-25730

CVE-2023-25730 describes a browser vulnerability where a background script calling document.documentElement.requestFullscreen and then blocking the main thread can force fullscreen mode indefinitely, potentially causing user confusion or spoofing. The connected documents confirm affected products...

CVE-2023-6212

CVE-2023-6212 parks memory safety bugs in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4, with evidence of memory corruption and potential to exploit for arbitrary code. The issue affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird

CVE-2024-0746

CVE-2024-0746 describes a crash triggered when a Linux user opens the print preview dialog in Mozilla components. Affected products include Firefox (versions before 122) and Firefox ESR (before 115.7) as well as Thunderbird (before 115.7). The issue is reported as a crash scenario in the print-pr...

CVE-2013-0750

CVE-2013-0750 is a high-severity vulnerability in Mozilla’s JavaScript engine where an integer overflow during string concatenation can lead to heap-based memory corruption and remote code execution. Affected products include Firefox prior to 18.0 (and ESR branches), Thunderbird prior to 17.0.2, ...

CVE-2017-5435

CVE-2017-5435 is a use-after-free in Firefox/Thunderbird during editor design-mode transaction processing, causing a potentially exploitable crash. Public details place affected products as Firefox/Firefox ESR and Thunderbird prior to certain fixed versions (e.g., Thunderbird < 52.1, Firefox E...

CVE-2017-5449

CVE-2017-5449 affects Mozilla Firefox (and Thunderbird) components where a crash can be triggered during layout/manipulation of bidirectional Unicode text in concert with CSS animations. Public records in connected advisories indicate affected versions: Thunderbird < 52.1, Firefox ESR < 52....

CVE-2017-5466

CVE-2017-5466 describes an origin-confusion bug triggered when a page loaded from an original site via a hyperlink redirects to a data:text/html URL, causing the reloaded page to have an incorrect origin. This enables a cross-site scripting (XSS) risk. Affected products include Mozilla Thunderbir...

CVE-2017-7823

The CVE-2017-7823 entry describes a CSP sandbox issue where the sandbox did not create a unique origin, causing documents to behave as if allow-same-origin were always specified and enabling potential XSS. Affected products are Mozilla Thunderbird < 52.4, Firefox < 56, and Firefox ESR

CVE-2023-32214

CVE-2023-32214 affects Mozilla Firefox and Thunderbird on Windows. The vulnerability involves protocol handlers ms-cxh and ms-cxh-full that could be leveraged to trigger a denial of service. Affected versions are Firefox < 113, Firefox ESR < 102.11, and Thunderbird

CVE-2006-1735

CVE-2006-1735 affects Mozilla Firefox and Thunderbird 1.x prior to 1.5 and 1.0.x prior to 1.0.8, Mozilla Suite prior to 1.7.13, and SeaMonkey prior to 1.0. The vulnerability arises from using an eval in an XBL method binding (XBL.method.eval) to create Javascript functions that are compiled with ...