1883 matches found
CVE-2014-1524
CVE-2014-1524 is reported in several Nessus entries tied to Mozilla Firefox components. Affected: Mozilla Firefox (before 29.0), Firefox ESR 24.x (before 24.5), Thunderbird (before 24.5), and SeaMonkey (before 2.26). Root cause: nsXBLProtoImpl::InstallImplementation does not reliably verify that ...
CVE-2014-1557
CVE-2014-1557 : In Mozilla Firefox (and related Mozilla products), the ConvolveHorizontally function in Skia mishandles discarding image data during scaling, allowing remote code execution via a crafted high‑quality image. Affected versions include Firefox before 31.0, Firefox ESR 24.x before 24....
CVE-2017-5430
CVE-2017-5430 refers to memory-safety bugs reported in Firefox 52/52 ESR and Thunderbird 52 that could, with enough effort, be exploited to run arbitrary code. Affected products include Firefox (versions < 53), Firefox ESR (< 52.1), and Thunderbird (
CVE-2018-5178
CVE-2018-5178: A buffer overflow during UTF-8 to Unicode string conversion in JavaScript can occur when a vulnerable legacy extension is used. Affected products include Thunderbird ESR and Firefox ESR up to version 52.8 (ESR branches); Thunderbrid/Firefox ESR
CVE-2010-0654
CVE-2010-0654 affects Mozilla family: Firefox 3.5.x up to 3.5.10 and 3.6.x up to 3.6.6, Thunderbird 3.0.x up to 3.0.5 and 3.1.x up to 3.1.0, and SeaMonkey before 2.0.6. The root cause is cross-origin loading of CSS stylesheets when the stylesheet download has an incorrect MIME type and the styles...
CVE-2010-2768
CVE-2010-2768 affects Mozilla Firefox (before 3.5.12 and 3.6.x before 3.6.9), Thunderbird (before 3.0.7 and 3.1.x before 3.1.3), and SeaMonkey (before 2.0.7). Root cause: Object tag type attribute not properly restricted when setting a document charset, enabling UTF-7 encoded payloads to bypass X...
CVE-2010-3173
CVE-2010-3173 affects Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9. Root cause: the SSL DHE (Diffie-Hellman Ephemeral) implementation does not properly enforce a safe minimum DH key length, enabling brute-force ...
CVE-2012-0442
CVE-2012-0442 covers multiple memory-safety vulnerabilities in the Mozilla browser engine affecting Firefox before 3.6.26 and 4.x–9.0, Thunderbird before 3.1.18 and 5.0–9.0, and SeaMonkey before 2.7. The issues can cause memory corruption, application crashes, or potentially remote code execution...
CVE-2012-0470
The CVE-2012-0470 issue affects Mozilla Firefox 4.x–11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0–11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9. It is a heap-based buffer overflow in nsSVGFEDiffuseLightingElement::LightPixel caused by the use of different number syste...
CVE-2013-1709
CVE-2013-1709 is a Firefox/XUL/SeaMonkey family XSS issue caused by improper handling of FRAME elements and history, allowing remote attackers to spoof a relative location in a previously visited document. Affected products are Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderb...
CVE-2013-1725
CVE-2013-1725 affects Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21. The issue is that initialization of JavaScript objects with compartments may not occur, allowing remote attackers to execute a...
CVE-2013-5590
CVE-2013-5590 affects Mozilla Firefox and related products (Firefox/ESR, Thunderbird, SeaMonkey). The Mozilla browser engine and associated components contain memory corruption/denial-of-service vulnerabilities that could lead to arbitrary code execution via unspecified vectors. Public advisories...
CVE-2013-5616
CVE-2013-5616 is a use-after-free in Mozilla Firefox before 26.0 (also affects ESR 24.x before 24.2, Thunderbird before 24.2, SeaMonkey before 2.23) triggered by nsEventListenerManager::HandleEventSubType. Exploitation could lead to remote code execution or a denial of service due to heap memory ...
CVE-2016-1964
CVE-2016-1964 is a use-after-free in Mozilla Firefox’s AtomicBaseIncDec during XML transformation handling. Affects Firefox before 45.0 and Firefox ESR 38.x before 38.7; impact includes remote code execution or heap-based denial of service when processing certain XML transformations. The issue ca...
CVE-2018-12374
Mozilla Thunderbird before 52.9.1 is affected by multiple issues (CVE-2018-5188, CVE-2018-12359 through CVE-2018-12374) including information disclosure and memory safety bugs. The specific CVE-2018-12374 vulnerability allows plaintext of decrypted emails to leak when a user submits an embedded f...
CVE-2018-12391
CVE-2018-12391 affects Firefox for Android: during HTTP Live Stream playback, audio data can be accessed across origins due to a flaw in the underlying Android service. The vulnerability is addressed by treating all HLS streams as cross-origin and opaque. Affected products/versions include Firefo...
CVE-2022-3032
Thunderbird has a vulnerability where receiving an HTML email containing an iframe with a srcdoc attribute does not block remote objects in the nested document; the network is accessed and items like images/videos are loaded and displayed. Affected versions are Thunderbird < 102.2.1 and Thunde...
CVE-2025-1015
CVE-2025-1015 affects Thunderbird where the Address Book URI fields contain unsanitized links. An attacker could craft an address book that exports a field with a malicious payload; when another user imports the address book and clicks the link, Thunderbird could load a web page inside the applic...
CVE-2006-0297
CVE-2006-0297 involves integer overflow vulnerabilities in Mozilla-based products. Affects Mozilla Firefox 1.5, Thunderbird 1.5, and SeaMonkey before 1.0 when JavaScript is enabled in mail. The issues stem from three vulnerable code paths: (1) EscapeAttributeValue in jsxml.c (E4X), (2) nsSVGCairo...
CVE-2009-1306
CVE-2009-1306 affects Mozilla Firefox (before 3.0.9), Thunderbird, and SeaMonkey due to an improper handling of the Content-Disposition header in inner jar: URIs. The inner URI’s Content-Disposition: attachment can enable remote XSS and possibly other attacks when a malicious .jar is uploaded. Co...
CVE-2012-1951
CVE-2012-1951 is an actual security issue described in the connected MiracleLinux AXSA:2012-874 advisory as a Use-after-free in Mozilla Firefox 4.x–13.0 (and Firefox ESR 10.x before 10.0.6) affecting nsSMILTimeValueSpec::IsEventBased, with Thunderbird 5.0–13.0 and SeaMonkey before 2.11 also impli...
CVE-2012-3966
CVE-2012-3966 affects Mozilla Firefox and related Mozilla products (Firefox before 15.0, Firefox ESR before 10.0.7, Thunderbird before 15.0, SeaMonkey before 2.12). The vulnerability arises from a negative height value in a BMP image inside a .ICO file, related to improper handling of the transpa...
CVE-2012-3978
CVE-2012-3978 affects Mozilla Firefox (and related Mozilla components) where nsLocation::CheckURL does not properly follow the location object security model, enabling remote attackers to bypass content-loading restrictions via chrome code vectors. MiracleLinux advisories list this as part of mul...
CVE-2013-0755
CVE-2013-0755 refers to a use-after-free in the mozVibrate implementation of the Vibrate library in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. The vulnerability allows remote code execution...
CVE-2013-1735
CVE-2013-1735 : A use-after-free in Mozilla's ScrollbarActivity in Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code via image-document scrolling vectors. Ex...
CVE-2013-5613
Mode C: Detailed vulnerability note for CVE-2013-5613. Affected product/variant: Mozilla Firefox components shipped in MiracleLinux 3 (firefox-24.4.0-1.0.1.AXS3) per AXSA:2014-233:01. Root cause: Use-after-free in PresShell::DispatchSynthMouseMove, linked to RestyleManager::GetHoverGeneration, en...
CVE-2014-1487
CVE-2014-1487 affects Mozilla Firefox (Web workers) and related Mozilla suite components. The issue allows remote attackers to bypass Same Origin Policy and obtain sensitive authentication data via error-message handling in Web workers, affecting Firefox versions before 27.0 (and ESR 24.x before ...
CVE-2014-1581
CVE-2014-1581 is a use-after-free in DirectionalityUtils.cpp that affects Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2. The vulnerability allows a remote attacker to execute arbitrary code via text handling during directionality resolution and layout...
CVE-2025-1936
CVE-2025-1936 is a Firefox/Thunderbird vulnerability where jar: URLs used to retrieve local ZIP contents could misclassify content due to a null-termination issue in the archive, potentially enabling disguised code in a web extension. Affected: Firefox before 136, Firefox ESR before 128.8, Thunde...
CVE-2009-0775
CVE-2009-0775 is a Mozilla Firefox/Thunderbird/SeaMonkey vulnerability described in the MiracleLinux AXSA advisory as a Double free in cloned XUL DOM elements linked as parent/child that are mishandled during garbage collection. A remote attacker could potentially execute arbitrary code by crafti...
CVE-2010-2767
CVE-2010-2767 is a dangling-pointer vulnerability in Mozilla’s navigator.plugins handling. The issue occurs when the DOM plugin array is destroyed but a pointer to it remains, potentially allowing a remote attacker to crash the browser or execute arbitrary code. Affected products and versions (pe...
CVE-2010-2769
CVE-2010-2769 is a cross-site scripting (XSS) vulnerability affecting Mozilla Firefox (before 3.5.12 and 3.6.x before 3.6.9), Thunderbird (before 3.0.7 and 3.1.x before 3.1.3), and SeaMonkey (before 2.0.7). The issue arises when a selection is added to a document with designMode enabled, allowing...
CVE-2010-3167
CVE-2010-3167 : The nsTreeContentView in Mozilla Firefox (before 3.5.12 and 3.6.x before 3.6.9), Thunderbird (before 3.0.7 and 3.1.x before 3.1.3), and SeaMonkey (before 2.0.7) contains a dangling-pointer vulnerability in XUL trees when removing nodes. This could allow remote attackers to execute...
CVE-2012-3960
CVE-2012-3960 is a use-after-free in mozSpellChecker::SetCurrentDictionary that affects Mozilla Firefox <15.0, Firefox ESR <10.0.7, Thunderbird <15.0 / ESR, and SeaMonkey
CVE-2014-1547
CVE-2014-1547 is observed in multiple Nessus/MiracleLinux advisories and related vendor bulletins. The vulnerability affects Mozilla Firefox and Thunderbird under Firefox before 31.0 (and ESR 24.x before 24.7) with memory-safety issues in the browser engine that can cause memory corruption and ap...
CVE-2023-6864
CVE-2023-6864 affects Mozilla Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. The issue is described as memory safety bugs with evidence of memory corruption; with sufficient effort these could be exploited to execute arbitrary code. Impact is high (CVE base score 8.8; confidentiality, int...
CVE-2010-3174
CVE-2010-3174 is a memory-safety/remote-code issue described in MFSA 2010-64 affecting the Mozilla browser engine. Public data ties the CVE to Firefox (and related Mozilla-based products) versions around the 3.x line; the initial entry notes Firefox 3.5.x before 3.5.14, Thunderbird before 3.0.9, ...
CVE-2013-0780
CVE-2013-0780 is a use-after-free vulnerability in Mozilla Firefox related to the nsOverflowContinuationTracker::Finish function. It affects Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. An attacker c...
CVE-2014-8638
CVE-2014-8638 affects Firefox up to 35.0 (ESR 31.x before 31.4), Thunderbird before 31.4, and SeaMonkey before 2.32. The navigator.sendBeacon implementation omits the CORS Origin header, allowing remote attackers to bypass intended CORS checks and conduct cross-site request forgery via a crafted ...
CVE-2015-2710
CVE-2015-2710 is a memory-safety vulnerability in Mozilla Firefox and Thunderbird where the SVGTextFrame handles crafted SVG/CSS data, causing a heap-based buffer overflow. A remote attacker could potentially execute arbitrary code by enticing a user to open specially crafted content. The issue a...
CVE-2009-3983
CVE-2009-3983 affects Mozilla Firefox before 3.0.16 and Firefox 3.5.x before 3.5.6, and SeaMonkey before 2.0.1. The issue allows remote attackers to replay NTLM credentials from a browser user, enabling authenticated requests to arbitrary applications. The vulnerability is described as a credenti...
CVE-2010-1585
CVE-2010-1585 affects Mozilla Firefox (ParanoidFragmentSink) where nsIScriptableUnescapeHTML.parseFragment fails to sanitize chrome HTML, enabling remote JavaScript execution via javascript: URIs in input to extensions. Affected products/versions: Firefox <3.5.17 and <3.6.14; SeaMonkey <...
CVE-2010-3183
CVE-2010-3183 affects Mozilla-based products (Firefox/Thunderbird/SeaMonkey/XULRunner) where the LookupGetterOrSetter function in the browser’s JavaScript engine mishandles calls to window.lookupGetter with no arguments. The root cause is an incorrect pointer handling that can dereference a dangl...
CVE-2011-2995
CVE-2011-2995 is a browser engine vulnerability affecting Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4. The issue allows remote attackers to cause memory corruption and application crashes or possibly execute arbitrary code via unknown vectors;...
CVE-2013-0768
Technical details for CVE-2013-0768 are not publicly available in the provided documents. Monitor for updates.
CVE-2013-1692
CVE-2013-1692 affects Mozilla Firefox (including ESR 17.x) before 22.0 and Thunderbird before 17.0.7. The vulnerability arises from not preventing body data in an XMLHttpRequest HEAD request, enabling CSRF via crafted sites. MiracleLinux/MiracleLinux AXSA advisories map this vulnerability to Fire...
CVE-2017-5467
CVE-2017-5467 affects Mozilla Firefox and Thunderbird, with memory corruption when drawing Skia content outside the clipping region. Affected: Firefox (<53) and Thunderbird (
CVE-2017-5472
CVE-2017-5472 is a use-after-free in Mozilla's frameloader during CSS layout regeneration, leading to potential crash. Concrete details in connected docs show impact on Firefox versions <54, Firefox ESR <52.2, and Thunderbird
CVE-2025-1935
CVE-2025-1935 is described in connected advisories as a UI/protocol-handler spoof affecting Firefox and Thunderbird before versions 136 (Firefox) / 128.8 (Firefox ESR) and before 136 (Thunderbird) / 128.8 (Thunderbird). The issue allows a malicious web page to coax a user into setting that site a...