CVE-2010-3178

CVE-2010-3178 affects Mozilla Firefox (before 3.5.14 and 3.6.x before 3.6.11), Thunderbird (before 3.0.9 and 3.1.x before 3.1.5), and SeaMonkey (before 2.0.9). The issue arises from improper handling of certain modal calls made by javascript: URLs when opening a new window and performing cross-do...

CVE-2012-0455

CVE-2012-0455 affects Mozilla browsers: drag-and-drop restrictions on javascript: URLs can enable user-assisted XSS. Affected products include Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x b...

CVE-2013-1694

CVE-2013-1694 affects Mozilla Firefox <= 21.x (before 22.0), Firefox ESR < 17.0.7, Thunderbird < 17.0.7, and Thunderbird ESR

CVE-2013-1732

CVE-2013-1732 is a buffer overflow in Mozilla's nsFloatManager::GetFlowArea that affects Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21. This allows remote attackers to execute arbitrary code via crafted ...

CVE-2016-5297

CVE-2016-5297 is an argument length checking error in JavaScript that can trigger integer overflows, affecting Mozilla Thunderbird <45.5, Firefox ESR <45.5, and Firefox

CVE-2017-5400

The CVE-2017-5400 entry describes a exploit scenario arising from a JIT-spray targeting asm.js combined with a heap spray that bypasses ASLR and DEP, potentially causing memory corruption. Connected IBM advisories confirm affected product: IBM Storwize V7000 Unified (codes 1.5.1.0–1.5.2.5) with F...

CVE-2023-6862

CVE-2023-6862 is a use-after-free in nsDNSService::Init affecting Firefox ESR and Thunderbird before version 115.6.0. The issue manifests rarely during startup and is reported with high impact in CVSS 3.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Connected advisories confirm mitigations via upgradin...

CVE-2025-3029

CVE-2025-3029 describes a URL spoofing vulnerability caused by crafted URLs with specific Unicode characters that can mask the true origin of a page. The advisory text in connected sources confirms affected products include Firefox (versions before 137 and ESR before 128.9) and Thunderbird (versi...

CVE-2010-1211

CVE-2010-1211 affects Mozilla Firefox 3.5.x before 3.5.11, and 3.6.x before 3.6.7; Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1; SeaMonkey before 2.0.6. The Mozilla browser engine vulnerabilities allow memory corruption leading to memory corruption, DoS, or possibly arbitrary code execut...

CVE-2012-1972

CVE-2012-1972 is a use-after-free in the nsHTMLEditor::CollapseAdjacentTextNodes function in Mozilla Firefox, with remote code execution/denial of service via heap memory corruption. Affected products/versions include Firefox prior to 15.0, Firefox ESR 10.x prior to 10.0.7, and Thunderbird prior ...

CVE-2012-3990

CVE-2012-3990 is a use-after-free vulnerability in the IME State Manager implementation of Mozilla Firefox and related Mozilla products. Affected versions include Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before...

CVE-2013-0775

CVE-2013-0775 is a use-after-free vulnerability in Firefox’s image handling. Specifically, it concerns nsImageLoadingContent::OnStopContainer and affects Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. ...

CVE-2013-1693

CVE-2013-1693 affects Mozilla Firefox (SVG filter implementation) and related Mozilla products. Affected: Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7. Impact: remote attackers could read pixel values and possibly bypass Sa...

CVE-2014-1482

CVE-2014-1482 affects Mozilla Firefox and related Mozilla products. The issue is that RasterImage.cpp does not prevent access to discarded image data, enabling remote attackers to run arbitrary code or cause a denial of service via crafted image data (Goo Create demonstrated). Affected versions i...

CVE-2018-5145

CVE-2018-5145 concerns memory safety bugs in Mozilla Firefox ESR 52.6 that could lead to memory corruption and potential arbitrary code execution. The vulnerability affects Firefox ESR versions before 52.7 and Thunderbird versions before 52.7. Several distributions document fixes in Thunderbird a...

CVE-2022-40958

CVE-2022-40958 : The vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox

CVE-2023-25746

CVE-2023-25746 corresponds to memory-safety bugs in Firefox ESR 102.7 and related components. The connected sources confirm this affects Firefox ESR before 102.8 and Thunderbird before 102.8, with the underlying issue described as memory corruptionthat could be exploited to run arbitrary code. Th...

CVE-2024-0755

CVE-2024-0755 appears in multiple connected advisories as a memory-safety vulnerability affecting Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6, with memory corruption that could allow arbitrary code execution. Affected versions are Firefox < 122, Firefox ESR < 115.7, and Thunderbird

CVE-2011-0080

CVE-2011-0080 corresponds to multiple memory‑corruption/browser engine vulnerabilities in Mozilla Firefox 3.5.x before 3.5.19, Firefox 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14. The MiracleLinux advisories (AXSA:2011-198/203) enumerate these as a set of memory‑sa...

CVE-2013-0795

CVE-2013-0795 affects Mozilla Firefox (before 20.0) and related Mozilla stack (ESR 17.x before 17.0.5, Thunderbird before 17.0.5, SeaMonkey before 2.17). The issue arises from the System Only Wrapper (SOW) allowing a crafted site to clone a protected node via cloneNode, bypassing the Same Origin ...

CVE-2014-1513

The CVE-2014-1513 issue affects Mozilla Firefox (and related Mozilla suite components) prior to version 28.0, and Firefox ESR 24.x prior to 24.4, with Firefox/SeaMonkey/Thunderbird affecting ArrayBuffer usage. Root cause: TypedArrayObject mishandles a zero-length transition during ArrayBuffer use...

CVE-2014-1531

CVE-2014-1531 is a use-after-free vulnerability in Mozilla Firefox’s image handling. The flaw occurs in nsGenericHTMLElement::GetWidthHeightForImage during an image-resize operation and can be triggered via an imgLoader object, allowing remote attackers to cause heap memory corruption and potenti...

CVE-2015-0831

CVE-2015-0831 describes a use-after-free in Mozilla Firefox (mozilla::dom::IndexedDB::IDBObjectStore::CreateIndex) that could allow remote code execution or denial of service via crafted IndexedDB index content. Affected products include Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thun...

CVE-2025-5269

CVE-2025-5269 is a memory-safety bug reported in Firefox ESR 128.10 and Thunderbird 128.10 that shows memory corruption and could potentially be exploited to run arbitrary code. Affected products: Firefox ESR < 128.11 and Thunderbird

CVE-2010-3170

CVE-2010-3170 affects Mozilla Firefox (3.5.x before 3.5.14; 3.6.x before 3.6.11), Thunderbird (before 3.0.9; before 3.1.x before 3.1.5), and SeaMonkey (before 2.0.9). Root cause: wildcard in the X.509 certificate subject Common Name enables MITM by spoofing SSL servers with a cert from a trusted ...

CVE-2011-2995

CVE-2011-2995 is a browser engine vulnerability affecting Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4. The issue allows remote attackers to cause memory corruption and application crashes or possibly execute arbitrary code via unknown vectors;...

CVE-2013-0800

CVE-2013-0800 : An integer signedness error in the pixman_fill_sse2 function (pixman-sse2.c) used by Cairo and shipped with Mozilla Firefox and related products allows a remote attacker to trigger an out-of-bounds write via crafted values (negative box boundary or negative box size). This affects...

CVE-2017-5454

CVE-2017-5454 describes a sandbox escape in Mozilla products where the file picker can be abused via relative paths to read local files. Affected are Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox

CVE-2023-37211

CVE-2023-37211 involves memory safety bugs in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some bugs show memory corruption and could potentially be exploited to run arbitrary code. Affected versions are Firefox < 115, Firefox ESR < 102.13, and Thunderbird

CVE-2023-6858

CVE-2023-6858 : Firefox was vulnerable to a heap buffer overflow in the nsTextFragment code path due to insufficient OOM handling. Affected products include Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox

CVE-2025-1933

CVE-2025-1933: On 64-bit CPUs, Firefox/Thunderbird JIT compilation of WASM i32 return values may read leftover memory and misclassify the value type. Affects Firefox (including ESR branches) and Thunderbird prior to 136/128.x. Remediation per sources: upgrade to Firefox 136 (and ESR 115.21 / 128....

CVE-2025-1938

CVE-2025-1938 affects Mozilla Firefox and Thunderbird on multiple release lines. The connected documents describe memory safety bugs in Firefox 135/Thunderbird 135 (and ESR 128.7), with some bugs showing memory corruption and the potential to exploit for arbitrary code execution if enough effort ...

CVE-2025-3030

CVE-2025-3030 : Memory safety bugs in Firefox 136/ESR 128.8 and Thunderbird 136/128.8 allow memory corruption; could enable arbitrary code execution if exploited. Affected products include Firefox < 137 and Thunderbird

CVE-2025-4093

CVE-2025-4093 involves a memory safety bug in Firefox ESR 128.9 and Thunderbird 128.9 that showed memory corruption with potential to enable arbitrary code execution. The vulnerability is fixed in Firefox ESR 128.10 and Thunderbird 128.10. The provided connected documents confirm affected product...

CVE-2012-1967

CVE-2012-1967 affects Mozilla Firefox 4.x–13.0, Firefox ESR 10.x prior to 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x prior to 10.0.6, and SeaMonkey prior to 2.11. Root cause: JavaScript sandbox may run javascript: URLs with insufficient context, allowing remote code execution with user pr...

CVE-2014-1486

CVE-2014-1486 is a use-after-free in Mozilla Firefox’s imgRequestProxy function (affecting Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24). The vulnerability enables remote code execution via image data with unspecified Content-Type values. Mirac...

CVE-2014-1512

The provided connected documents confirm multiple Firefox-related CVEs (e.g., CVE-2014-1512 among others) affecting Mozilla Firefox before 28.0, ESR 24.x before 24.4, and related Mozilla products. The primary issue is memory-safety/use-after-free vulnerabilities in the browser engine (notably in ...

CVE-2015-2713

CVE-2015-2713 is a use-after-free in Mozilla Firefox (SetBreaks) affecting Firefox before 38.0, Firefox ESR before 31.7, and Thunderbird before 31.7. An attacker could craft a document with specific CSS tokens for vertical text to cause heap memory corruption, enabling remote code execution or a ...

CVE-2023-25738

Mozilla Firefox on Windows is affected by CVE-2023-25738, due to unvalidated DEVMODEW members in the printer driver path that could lead to out-of-bounds access. The issue affects Firefox versions earlier than 110 (Thunderbird <102.8, Firefox ESR

CVE-2023-6859

CVE-2023-6859 is a memory-safety vulnerability described as a use-after-free affecting TLS socket creation under memory pressure. Affected products include Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox

CVE-2024-0749

CVE-2024-0749 is confirmed in the connected documents as a phishing dialog issue where an about: dialog could be repurposed to show phishing content with an incorrect origin in the address bar. Affected products are Mozilla Firefox and Thunderbird, with the vulnerability applying to Firefox versi...

CVE-2026-8090

CVE-2026-8090 describes a use-after-free in Firefox’s DOM: Networking component. The issue is fixed in Firefox 150.0.2, Firefox ESR 140.10.2, and Firefox ESR 115.35.2. The connected sources confirm the vulnerability class and the exact patched versions. The description does not specify affected c...

CVE-2009-1302

The CVE-2009-1302 entry affects Mozilla Firefox 3.x prior to 3.0.9, Thunderbird prior to 2.0.0.22, and SeaMonkey prior to 1.1.16. The vulnerability enables remote attackers to trigger a denial of service (application crash) and potentially memory corruption via multiple vectors, including nsAsync...

CVE-2010-2753

CVE-2010-2753 affects Mozilla Firefox (3.5.x before 3.5.11; 3.6.x before 3.6.7), Thunderbird (3.0.x before 3.0.6; 3.1.x before 3.1.1), and SeaMonkey before 2.0.6. Root cause: integer overflow in the XUL tree selection attribute can trigger a use-after-free when handling a large selection in a XUL...

CVE-2012-1976

CVE-2012-1976 refers to a Use-after-free in Mozilla Firefox’s nsHTMLSelectElement::SubmitNamesValues. Affected products include Firefox before 15.0, Firefox ESR before 10.0.7 (10.x), Thunderbird before 15.0, Thunderbird ESR before 10.0.7, and SeaMonkey before 2.12. Impact per the description is r...

CVE-2013-0748

CVE-2013-0748 affects Mozilla Firefox (before 18.0 and ESR 10.x before 10.0.12, and 17.x before 17.0.2), Thunderbird (before 17.0.2, ESR 10.x before 10.0.12 and 17.x before 17.0.2), and SeaMonkey (before 2.15). The flaw is in XBL.proto .toString, where calling toString on an XBL object can leak a...

CVE-2013-0787

CVE-2013-0787 is a Use-after-free in Mozilla Firefox’s editor component (nsEditor::IsPreformatted) that could allow remote code execution. Affected: Firefox <19.0.2, Firefox ESR <17.0.4, Thunderbird <17.0.4, Thunderbird ESR <17.0.4, and SeaMonkey

CVE-2013-0796

CVE-2013-0796 is a WebGL/Mesa driver interaction flaw in Mozilla Firefox (and related Mozilla apps like Thunderbird and SeaMonkey) on Linux that could allow remote code execution or DoS. The issue arises from how WebGL interacts with Mesa drivers, enabling exploitation via unspecified vectors. Pu...

CVE-2013-1687

CVE-2013-1687 affects Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7. The vulnerability arises from insufficient restriction of XBL user-defined functions in the SOW (System Only Wrapper) and COW (Chrome Object Wrappe...

CVE-2014-1497

CVE-2014-1497 affects mozilla::WaveReader::DecodeAudioData in Mozilla Firefox up to 28.0 (and ESR 24.x up to 24.4), Thunderbird up to 24.4, and SeaMonkey up to 2.25. A crafted WAV file can cause information disclosure from process heap memory and can trigger a denial of service via an out-of-boun...