CVE-2017-5449

CVE-2017-5449 affects Mozilla Firefox (and Thunderbird) components where a crash can be triggered during layout/manipulation of bidirectional Unicode text in concert with CSS animations. Public records in connected advisories indicate affected versions: Thunderbird < 52.1, Firefox ESR < 52....

CVE-2018-5127

The CVE-2018-5127 issue is a memory-safety buffer overflow in the SVG path handling (svg animatedPathSegList) triggered via script, allowing a potentially exploitable crash. Affected products and versions include Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox

CVE-2023-6857

CVE-2023-6857 describes a race condition when resolving symlinks in Firefox on Unix-based OSes, where the buffer passed to readlink may be too small. Affects Firefox and Thunderbird components (Firefox ESR <115.6, Firefox <121, Thunderbird

CVE-2024-0755

CVE-2024-0755 appears in multiple connected advisories as a memory-safety vulnerability affecting Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6, with memory corruption that could allow arbitrary code execution. Affected versions are Firefox < 122, Firefox ESR < 115.7, and Thunderbird

CVE-2026-2447

A heap buffer overflow vulnerability exists in the libvpx library, which provides the VP8 SDK for encoding and decoding video codecs. This vulnerability affects multiple applications and distributions, including Firefox , Firefox ESR , and Thunderbird . The flaw was addressed in the following ver...

CVE-2006-1737

CVE-2006-1737 is described as an integer overflow in JavaScript when processing a very large regular expression, affecting Mozilla Firefox/Thunderbird (and related Mozilla-suite components) prior to specified updates. Connected advisories corroborate a memory-currption/robustness issue in JavaScr...

CVE-2013-0750

CVE-2013-0750 is a high-severity vulnerability in Mozilla’s JavaScript engine where an integer overflow during string concatenation can lead to heap-based memory corruption and remote code execution. Affected products include Firefox prior to 18.0 (and ESR branches), Thunderbird prior to 17.0.2, ...

CVE-2017-7779

CVE-2017-7779 is a set of memory-safety issues reported in Mozilla Thunderbird and Mozilla Firefox components prior to Firefox 55 and Thunderbird 52.3. The Arch Linux ASA-201708-18 and related advisories describe multiple flaws (memory corruption, use-after-free, out-of-bounds reads, and other me...

CVE-2017-7818

Summary: CVE-2017-7818 is a use-after-free vulnerability in Thunderbird (and Firefox/ESR components) involving manipulation of ARIA element arrays via the DOM, leading to a potentially exploitable crash. The connected sources confirm the issue affects Thunderbird prior to 52.4.0 and related Mozil...

CVE-2018-12372

CVE-2018-12372 affects Mozilla Thunderbird. Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext in HTML reply/forward messages. Public documentation lists affected product: Thunderbird prior to 52.9. Root cause described across connected sources as leakage of S...

CVE-2006-1735

CVE-2006-1735 affects Mozilla Firefox and Thunderbird 1.x prior to 1.5 and 1.0.x prior to 1.0.8, Mozilla Suite prior to 1.7.13, and SeaMonkey prior to 1.0. The vulnerability arises from using an eval in an XBL method binding (XBL.method.eval) to create Javascript functions that are compiled with ...

CVE-2009-1307

CVE-2009-1307 is evidenced in connected documents as a vulnerability in the view-source: URI handling in Mozilla Firefox before 3.0.9 (also affecting Thunderbird and SeaMonkey) that breaks the Same Origin Policy. It enables remote attackers to bypass cross-domain restrictions and connect to arbit...

CVE-2006-3803

CVE-2006-3803 is a race-condition vulnerability in the JavaScript garbage collector that can be exploited to execute arbitrary code remotely. Affected products include Mozilla Firefox 1.5 prior to 1.5.0.5, Thunderbird prior to 1.5.0.5, and SeaMonkey prior to 1.0.3. The issue occurs when the garba...

CVE-2010-3179

CVE-2010-3179 : Stack-based buffer overflow in Firefox’s text rendering when a very long argument is passed to document.write. Affects Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9. Remediation per MFSA advisory:...

CVE-2014-1514

CVE-2014-1514 affects Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25. The issue arises from not validating the length of the destination array before a copy operation in TypedArrayObject, allowing remote attackers to execute arbitrary...

CVE-2017-5435

CVE-2017-5435 is a use-after-free in Firefox/Thunderbird during editor design-mode transaction processing, causing a potentially exploitable crash. Public details place affected products as Firefox/Firefox ESR and Thunderbird prior to certain fixed versions (e.g., Thunderbird < 52.1, Firefox E...

CVE-2022-45414

CVE-2022-45414 is a Thunderbird HTML-email parsing vulnerability. When a user quotes an HTML message containing a VIDEO tag with a POSTER attribute or an OBJECT tag with a DATA attribute, Thunderbird could perform a network request to the remote URL and display an image loaded from the POSTER in ...

CVE-2012-1970

CVE-2012-1970 affects Mozilla Firefox before 15.0, Thunderbird before 15.0, ESR 10.x before 10.0.7, and SeaMonkey before 2.12. The issue stems from multiple unspecified vulnerabilities in the browser engine that can allow remote attackers to cause memory corruption and application crashes or pote...

CVE-2013-1701

CVE-2013-1701 is part of multiple Mozilla browser engine vulnerabilities fixed in Firefox (before 23.0), ESR 17.x (before 17.0.8), Thunderbird (before 17.0.8), and SeaMonkey (before 2.20). The MiracleLinux advisories and IBM/Red Hat entries confirm remediation via upgrading to patched versions (F...

CVE-2014-1477

CVE-2014-1477 affects Mozilla Firefox before 27.0 (and related ESR/Thunderbird/SeaMonkey versions) where the browser engine contains multiple unspecified vulnerabilities that could lead to memory corruption, application crashes, or possibly arbitrary code execution via unknown vectors. Exploitati...

CVE-2016-10196

CVE-2016-10196 : A stack-based buffer overflow in libevent’s evutil_parse_sockaddr_port (evutil.c) before 2.1.6-beta allows a crafted long string in ip_as_string to cause a denial-of-service (segmentation fault). Affected software is libevent prior to 2.1.6-beta; the description notes the fix in ...

CVE-2017-5410

CVE-2017-5410 is a memory corruption bug during JavaScript garbage collection (incremental sweeping) that affects Firefox and Thunderbird prior to version 52. Upgrading to Firefox/Thunderbird 52.0 or later (as reflected in multiple advisories) is the remediation. Exploitation details are not prov...

CVE-2017-5466

CVE-2017-5466 describes an origin-confusion bug triggered when a page loaded from an original site via a hyperlink redirects to a data:text/html URL, causing the reloaded page to have an incorrect origin. This enables a cross-site scripting (XSS) risk. Affected products include Mozilla Thunderbir...

CVE-2018-5187

CVE-2018-5187 corresponds to memory safety bugs reported in Firefox 60/Firefox ESR 60 and affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox

CVE-2022-40960

CVE-2022-40960: Concurrent use of the URL parser with non-UTF-8 data is not thread-safe, causing a use-after-free and potentially exploitable crash. Affected products include Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox

CVE-2025-4087

A vulnerability exists in Thunderbird and Firefox where XPath parsing lacks sufficient null checks during attribute access. This flaw can trigger undefined behavior, potentially leading to out-of-bounds read access and memory corruption . The issue affects Firefox versions < 138, Firefox ESR &...

CVE-2011-2374

CVE-2011-2374 is described as a set of multiple unspecified vulnerabilities in the Mozilla Firefox browser engine (affecting Firefox <3.6.18 and 4.x up to 4.0.1, and Thunderbird

CVE-2014-1509

CVE-2014-1509 is a buffer overflow in cairo's _cairo_truetype_index_to_ucs4 function that affects Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25. The vulnerability can allow remote code execution via a crafted extension that renders f...

CVE-2014-1518

CVE-2014-1518 affects Mozilla Firefox and related browsers (Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, SeaMonkey before 2.26). Reported impact per the connected advisories: remote memory corruption and application crash, with potential arbitrary code execution via...

CVE-2015-0816

CVE-2015-0816 describes a privilege-escalation bypass in Mozilla Firefox and Thunderbird where resource: URLs could bypass Same Origin Policy to run arbitrary code with chrome privileges when combined with a separate SOP violation. Affected: Firefox up to 37.0 (ESR up to 31.x before 31.6) and Thu...

CVE-2017-5442

CVE-2017-5442 is a use-after-free in Firefox/Thunderbird during DOM style changes, causing potentially exploitable crashes. Affected products/versions in the provided documents include Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox

CVE-2017-7823

The CVE-2017-7823 entry describes a CSP sandbox issue where the sandbox did not create a unique origin, causing documents to behave as if allow-same-origin were always specified and enabling potential XSS. Affected products are Mozilla Thunderbird < 52.4, Firefox < 56, and Firefox ESR

CVE-2023-0616

CVE-2023-0616 affects Thunderbird

CVE-2023-29531

Technical details about CVE-2023-29531 (affected product, root cause, impact, or fix) are not provided in the connected documents. Monitor for updates from Mozilla and security advisories.

CVE-2023-6858

CVE-2023-6858 : Firefox was vulnerable to a heap buffer overflow in the nsTextFragment code path due to insufficient OOM handling. Affected products include Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox

CVE-2025-1933

On 64-bit CPUs, the JIT compiler in Mozilla Firefox , Firefox ESR , and Thunderbird fails to properly handle WASM i32 return values , potentially causing them to pick up bits from leftover memory. This flaw can lead to these values being treated as different types, which may allow a remote attack...

CVE-2025-3029

The Mozilla Firefox browser and Thunderbird email client are vulnerable to a spoofing attack due to how they handle specific Unicode characters in a crafted URL. This flaw allows an attacker to conceal the true origin of a page. Affected versions include Firefox < 137 , Firefox ESR < 128.9 ...

CVE-2011-2372

CVE-2011-2372 is described across connected advisories as a vulnerability in Mozilla Firefox and related Mozilla-based apps where merely holding Enter could trigger a download dialog, allowing user-assisted remote attackers to bypass access restrictions via a crafted site. Affected components inc...

CVE-2014-1532

CVE-2014-1532 is a use-after-free in Mozilla Firefox’s host-resolution path. Affected products include Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26, where the vulnerability resides in libxul.so's nsHostResolver::ConditionallyRefreshRecord. ...

CVE-2018-5096

CVE-2018-5096 is a use-after-free vulnerability in editing events within form elements that can cause a crash. Documented impact is limited to Firefox ESR versions older than 52.6 and Thunderbird versions older than 52.6, with a fix included in version 52.6.0 for affected Mozilla products (Firefo...

CVE-2023-25734

CVE-2023-25734 affects Mozilla Firefox on Windows. It arises when a user opens a local Windows .url shortcut, allowing an attacker to supply a remote path that can trigger unexpected network requests and potentially leak NTLM credentials. Affected versions: Firefox before 110, Thunderbird before ...

CVE-2023-6205

The connected sources corroborate CVE-2023-6205: a use-after-free involving MessagePort Entangled leads to an exploitable crash in Firefox and Thunderbird. Affected products include Firefox versions prior to 120 and Thunderbird prior to 115.5.0 (and ESR 115.5.0 lineage). The root cause is use-aft...

CVE-2013-1684

CVE-2013-1684 is a use-after-free in the mozilla::dom::HTMLMediaElement::LookupMediaElementURITable function affecting Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7. It allows remote attackers to execute arbitrary co...

CVE-2013-1694

CVE-2013-1694 affects Mozilla Firefox <= 21.x (before 22.0), Firefox ESR < 17.0.7, Thunderbird < 17.0.7, and Thunderbird ESR

CVE-2014-1493

CVE-2014-1493 is a Mozilla Firefox/Thunderbird/SeaMonkey browser-engine vulnerability reported in multiple advisories. IBM Storwize V7000 Unified and IBM SONAS bulletins note these issues affect shipped Firefox and advise upgrading to version 1.4.3.3 (Storwize Unified) or 1.4.3.3 (SONAS) to apply...

CVE-2015-2708

CVE-2015-2708 affects Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7, with memory-safety issues in the browser engine that could allow remote attackers to cause memory corruption, crash the application, or potentially execute arbitrary code via unknown vect...

CVE-2016-1952

CVE-2016-1952 involves memory-safety vulnerabilities in the Firefox browser engine. Affected software: Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7. Root cause: memory-corruption/memory-safety bugs in the browser engine that can be triggered by parsing/processing malformed or craf...

CVE-2017-7803

CVE-2017-7803 affects Thunderbird and Firefox browsers with CSP in a page header containing a sandbox directive. The root cause is that when sandbox is present, other CSP directives are ignored, leading to incorrect CSP enforcement. Documents in connected sources specify affected products (Thunde...

CVE-2017-7830

CVE-2017-7830 involves a cross-origin information disclosure through the Resource Timing API that could reveal navigations loaded in iframes, constituting a same-origin policy violation. Public documentation in Debian and CVE databases tie this to WebKit-related handling in Safari/WebKit componen...

CVE-2025-1938

Memory safety bugs exist in Mozilla Firefox and Thunderbird (including ESR versions) that can lead to memory corruption. If successfully exploited with sufficient effort, these vulnerabilities could allow an attacker to execute arbitrary code . The issue affects Firefox < 136 , Firefox ESR &lt...