CVE-2012-4192

CVE-2012-4192 affects Mozilla Firefox 16.0, Thunderbird 16.0, and SeaMonkey 2.13 (and related ESR/derivatives) where a crafted page can bypass the Same Origin Policy and read the properties of the Location object (window.location). The root cause is described as a security check not being applied...

CVE-2013-1725

CVE-2013-1725 affects Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21. The issue is that initialization of JavaScript objects with compartments may not occur, allowing remote attackers to execute a...

CVE-2014-1587

CVE-2014-1587 affects Mozilla Firefox before 34.0, Firefox ESR before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31. It stems from memory safety bugs in the browser engine that can be exploited remotely to cause memory corruption, denial of service, or possibly arbitrary code execution...

CVE-2015-0813

CVE-2015-0813 is a use-after-free in Mozilla Firefox (AppendElements) triggered when processing MP3 files via the Fluendo MP3 plugin for GStreamer on Linux. This can allow remote code execution or a heap-based denial of service. Affected: Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thu...

CVE-2018-5178

CVE-2018-5178: A buffer overflow during UTF-8 to Unicode string conversion in JavaScript can occur when a vulnerable legacy extension is used. Affected products include Thunderbird ESR and Firefox ESR up to version 52.8 (ESR branches); Thunderbrid/Firefox ESR

CVE-2022-3032

Thunderbird has a vulnerability where receiving an HTML email containing an iframe with a srcdoc attribute does not block remote objects in the nested document; the network is accessed and items like images/videos are loaded and displayed. Affected versions are Thunderbird < 102.2.1 and Thunde...

CVE-2025-1936

CVE-2025-1936 is a Firefox/Thunderbird vulnerability where jar: URLs used to retrieve local ZIP contents could misclassify content due to a null-termination issue in the archive, potentially enabling disguised code in a web extension. Affected: Firefox before 136, Firefox ESR before 128.8, Thunde...

CVE-2013-0747

Technical details for CVE-2013-0747 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2014-1557

CVE-2014-1557 : In Mozilla Firefox (and related Mozilla products), the ConvolveHorizontally function in Skia mishandles discarding image data during scaling, allowing remote code execution via a crafted high‑quality image. Affected versions include Firefox before 31.0, Firefox ESR 24.x before 24....

CVE-2016-9066

CVE-2016-9066 is a Mozilla Firefox-related issue. IBM notes it as a buffer/ memory-safety problem in Firefox shipped with IBM SONAS; root cause described as a buffer overflow due to an integer overflow in nsScriptLoadHandler. Affected products include Thunderbird <45.5, Firefox ESR <45.5, a...

CVE-2017-5430

CVE-2017-5430 refers to memory-safety bugs reported in Firefox 52/52 ESR and Thunderbird 52 that could, with enough effort, be exploited to run arbitrary code. Affected products include Firefox (versions < 53), Firefox ESR (< 52.1), and Thunderbird (

CVE-2018-12374

Mozilla Thunderbird before 52.9.1 is affected by multiple issues (CVE-2018-5188, CVE-2018-12359 through CVE-2018-12374) including information disclosure and memory safety bugs. The specific CVE-2018-12374 vulnerability allows plaintext of decrypted emails to leak when a user submits an embedded f...

CVE-2018-12391

CVE-2018-12391 affects Firefox for Android: during HTTP Live Stream playback, audio data can be accessed across origins due to a flaw in the underlying Android service. The vulnerability is addressed by treating all HLS streams as cross-origin and opaque. Affected products/versions include Firefo...

CVE-2026-2447

CVE-2026-2447 describes a heap buffer overflow in libvpx that affects components used by Firefox and Thunderbird. The Initial Description notes fixes in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2. Connected documents corroborate the sa...

CVE-2007-0009

CVE-2007-0009 describes a stack-based buffer overflow in the SSLv2 handling of the Mozilla Network Security Services (NSS) library, caused by improper handling of the Client Master Key length values. This can enable remote attackers to execute arbitrary code in the context of the affected process...

CVE-2009-0776

CVE-2009-0776 affects Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15. Root cause: nsIRDFService allows a cross-domain redirect to bypass the same-origin policy, enabling reading XML data from a different domain. Impact per sources: remote read access to cro...

CVE-2010-2768

CVE-2010-2768 affects Mozilla Firefox (before 3.5.12 and 3.6.x before 3.6.9), Thunderbird (before 3.0.7 and 3.1.x before 3.1.3), and SeaMonkey (before 2.0.7). Root cause: Object tag type attribute not properly restricted when setting a document charset, enabling UTF-7 encoded payloads to bypass X...

CVE-2010-3169

CVE-2010-3169 affects Mozilla's browser engine across multiple products: Firefox ≤ 3.5.11 (and 3.6.x prior to 3.6.9), Thunderbird ≤ 3.0.6 (and 3.1.x prior to 3.1.3), and SeaMonkey ≤ 2.0.6 (prior to 2.0.7). The issue is described as memory safety vulnerabilities in the browser engine that could al...

CVE-2012-0442

CVE-2012-0442 covers multiple memory-safety vulnerabilities in the Mozilla browser engine affecting Firefox before 3.6.26 and 4.x–9.0, Thunderbird before 3.1.18 and 5.0–9.0, and SeaMonkey before 2.7. The issues can cause memory corruption, application crashes, or potentially remote code execution...

CVE-2012-1951

CVE-2012-1951 is an actual security issue described in the connected MiracleLinux AXSA:2012-874 advisory as a Use-after-free in Mozilla Firefox 4.x–13.0 (and Firefox ESR 10.x before 10.0.6) affecting nsSMILTimeValueSpec::IsEventBased, with Thunderbird 5.0–13.0 and SeaMonkey before 2.11 also impli...

CVE-2013-1709

CVE-2013-1709 is a Firefox/XUL/SeaMonkey family XSS issue caused by improper handling of FRAME elements and history, allowing remote attackers to spoof a relative location in a previously visited document. Affected products are Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderb...

CVE-2013-5590

CVE-2013-5590 affects Mozilla Firefox and related products (Firefox/ESR, Thunderbird, SeaMonkey). The Mozilla browser engine and associated components contain memory corruption/denial-of-service vulnerabilities that could lead to arbitrary code execution via unspecified vectors. Public advisories...

CVE-2014-1555

CVE-2014-1555 is a use-after-free in Mozilla Firefox (nsDocLoader::OnProgress) that can allow remote code execution via FireOnStateChange events. Affected: Firefox before 31.0, Firefox ESR before 24.7, and Thunderbird before 24.7. Root cause: use-after-free in nsDocLoader::OnProgress. Impact: arb...

CVE-2023-50761

Affected software: Mozilla Thunderbird. Issue: S/MIME signature may be accepted despite mismatching signature creation date with message date/time, enabling impression of a different send date. Root cause: Thunderbird

CVE-2023-6864

CVE-2023-6864 affects Mozilla Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. The issue is described as memory safety bugs with evidence of memory corruption; with sufficient effort these could be exploited to execute arbitrary code. Impact is high (CVE base score 8.8; confidentiality, int...

CVE-2010-3173

CVE-2010-3173 affects Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9. Root cause: the SSL DHE (Diffie-Hellman Ephemeral) implementation does not properly enforce a safe minimum DH key length, enabling brute-force ...

CVE-2012-0470

The CVE-2012-0470 issue affects Mozilla Firefox 4.x–11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0–11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9. It is a heap-based buffer overflow in nsSVGFEDiffuseLightingElement::LightPixel caused by the use of different number syste...

CVE-2012-3969

CVE-2012-3969 is an integer overflow in the nsSVGFEMorphologyElement::Filter function of Mozilla Firefox (and related Mozilla apps) prior to version 15.0, Firefox ESR 10.x prior to 10.0.7, and corresponding Thunderbird/SeaMonkey builds. Assigned impact is a heap-based buffer overflow that enables...

CVE-2012-3980

CVE-2012-3980 affects Mozilla Firefox (and related Thunderbird components) prior to version 15.0 (Firefox desktop and ESR 10.xs before 10.0.7) with a vulnerability in the web console. The issue allows user-assisted remote attackers to execute arbitrary JavaScript with chrome privileges via a craf...

CVE-2012-3986

CVE-2012-3986 affects Mozilla Firefox prior to 16.0 (and Firefox ESR 10.x prior to 10.0.8), Thunderbird prior to 16.0, and SeaMonkey before 2.13. The root cause is that certain DOMWindowUtils (nsDOMWindowUtils) methods were not protected by security checks, allowing remote JavaScript to bypass in...

CVE-2013-5613

Mode C: Detailed vulnerability note for CVE-2013-5613. Affected product/variant: Mozilla Firefox components shipped in MiracleLinux 3 (firefox-24.4.0-1.0.1.AXS3) per AXSA:2014-233:01. Root cause: Use-after-free in PresShell::DispatchSynthMouseMove, linked to RestyleManager::GetHoverGeneration, en...

CVE-2013-5616

CVE-2013-5616 is a use-after-free in Mozilla Firefox before 26.0 (also affects ESR 24.x before 24.2, Thunderbird before 24.2, SeaMonkey before 2.23) triggered by nsEventListenerManager::HandleEventSubType. Exploitation could lead to remote code execution or a denial of service due to heap memory ...

CVE-2016-1964

CVE-2016-1964 is a use-after-free in Mozilla Firefox’s AtomicBaseIncDec during XML transformation handling. Affects Firefox before 45.0 and Firefox ESR 38.x before 38.7; impact includes remote code execution or heap-based denial of service when processing certain XML transformations. The issue ca...

CVE-2009-0775

CVE-2009-0775 is a Mozilla Firefox/Thunderbird/SeaMonkey vulnerability described in the MiracleLinux AXSA advisory as a Double free in cloned XUL DOM elements linked as parent/child that are mishandled during garbage collection. A remote attacker could potentially execute arbitrary code by crafti...

CVE-2010-2762

CVE-2010-2762 affects Mozilla Firefox 3.6.x (prior to 3.6.9) and Thunderbird 3.1.x (prior to 3.1.3). The issue lies in the SafeJSObjectWrapper (SJOW) implementation: the XPCSafeJSObjectWrapper class does not properly restrict objects at the end of scope chains, enabling remote attackers to execut...

CVE-2012-3960

CVE-2012-3960 is a use-after-free in mozSpellChecker::SetCurrentDictionary that affects Mozilla Firefox <15.0, Firefox ESR <10.0.7, Thunderbird <15.0 / ESR, and SeaMonkey

CVE-2013-0780

CVE-2013-0780 is a use-after-free vulnerability in Mozilla Firefox related to the nsOverflowContinuationTracker::Finish function. It affects Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. An attacker c...

CVE-2013-0791

The connected Nessus advisories confirm CVE-2013-0791 affects Mozilla NSS and upstream products via CERT_DecodeCertPackage, allowing remote doS through out-of-bounds reads and memory corruption when processing crafted certificates. Affected: NSS libraries and apps (Firefox before 20.0, ESR 17.x b...

CVE-2014-1547

CVE-2014-1547 is observed in multiple Nessus/MiracleLinux advisories and related vendor bulletins. The vulnerability affects Mozilla Firefox and Thunderbird under Firefox before 31.0 (and ESR 24.x before 24.7) with memory-safety issues in the browser engine that can cause memory corruption and ap...

CVE-2014-1581

CVE-2014-1581 is a use-after-free in DirectionalityUtils.cpp that affects Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2. The vulnerability allows a remote attacker to execute arbitrary code via text handling during directionality resolution and layout...

CVE-2014-8638

CVE-2014-8638 affects Firefox up to 35.0 (ESR 31.x before 31.4), Thunderbird before 31.4, and SeaMonkey before 2.32. The navigator.sendBeacon implementation omits the CORS Origin header, allowing remote attackers to bypass intended CORS checks and conduct cross-site request forgery via a crafted ...

CVE-2016-1961

CVE-2016-1961 is a use-after-free in Mozilla Firefox’s HTMLDocument::SetBody (dom/html/nsHTMLDocument.cpp) that could crash the browser and allow remote code execution. Affected products are Firefox before 45.0 and Firefox ESR 38.x before 38.7. The vulnerability stems from mishandling of the root...

CVE-2006-0297

CVE-2006-0297 involves integer overflow vulnerabilities in Mozilla-based products. Affects Mozilla Firefox 1.5, Thunderbird 1.5, and SeaMonkey before 1.0 when JavaScript is enabled in mail. The issues stem from three vulnerable code paths: (1) EscapeAttributeValue in jsxml.c (E4X), (2) nsSVGCairo...

CVE-2009-0772

Mode C: CVE-2009-0772 affects Mozilla-based products via memory corruption triggered by nsCSSStyleSheet::GetOwnerNode, related to events and Garbage Collection. Affected software includes Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15. Outcome: remote deni...

CVE-2012-3966

CVE-2012-3966 affects Mozilla Firefox and related Mozilla products (Firefox before 15.0, Firefox ESR before 10.0.7, Thunderbird before 15.0, SeaMonkey before 2.12). The vulnerability arises from a negative height value in a BMP image inside a .ICO file, related to improper handling of the transpa...

CVE-2012-3978

CVE-2012-3978 affects Mozilla Firefox (and related Mozilla components) where nsLocation::CheckURL does not properly follow the location object security model, enabling remote attackers to bypass content-loading restrictions via chrome code vectors. MiracleLinux advisories list this as part of mul...

CVE-2013-0755

CVE-2013-0755 refers to a use-after-free in the mozVibrate implementation of the Vibrate library in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. The vulnerability allows remote code execution...

CVE-2013-0760

CVE-2013-0760 describes a buffer overflow in Mozilla Firefox’s CharDistributionAnalysis::HandleOneChar, allowing remote code execution via a crafted document. Affected products per the description: Firefox before 18.0, Thunderbird before 17.0.2, and SeaMonkey before 2.15. Root cause is a memory c...

CVE-2013-0768

Technical details for CVE-2013-0768 are not publicly available in the provided documents. Monitor for updates.

CVE-2015-2739

CVE-2015-2739 affects Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1. The issue is in ArrayBufferBuilder::append, which accesses unintended memory locations. The description notes unspecified impact and attack vectors; no explicit explo...