1883 matches found
CVE-2009-0352
CVE-2009-0352 affects Mozilla Firefox 3.x <= 3.0.5, Mozilla Thunderbird <= 2.0.0.20, and SeaMonkey
CVE-2012-0459
CVE-2012-0459 affects Mozilla Firefox (4.x–10.0), Firefox ESR (10.x up to before 10.0.3), Thunderbird (5.0–10.0) and SeaMonkey (before 2.8). It is caused by remote exploitation via dynamic modification of a keyframe followed by access to the keyframe’s cssText, enabling denial of service (applica...
CVE-2013-0760
CVE-2013-0760 describes a buffer overflow in Mozilla Firefox’s CharDistributionAnalysis::HandleOneChar, allowing remote code execution via a crafted document. Affected products per the description: Firefox before 18.0, Thunderbird before 17.0.2, and SeaMonkey before 2.15. Root cause is a memory c...
CVE-2013-0776
CVE-2013-0776 affects Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. The flaw allows a man-in-the-middle attacker to spoof the address bar by using a proxy server that returns a 407 HTTP status...
CVE-2013-1674
CVE-2013-1674 is a use-after-free vulnerability in Mozilla Firefox (and related Thunderbird components) that can be triggered by an onresize event during video playback, allowing remote code execution. Affected products include Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderb...
CVE-2013-1676
CVE-2013-1676 affects Mozilla Firefox prior to 21.0, Firefox ESR 17.x prior to 17.0.6, Thunderbird prior to 17.0.6, and Thunderbird ESR 17.x prior to 17.0.6. The flaw is in SelectionIterator::GetNextSegment and is exploitable via unspecified vectors to trigger remote code execution or a denial of...
CVE-2013-1730
CVE-2013-1730 affects Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0/ESR 17.x before 17.0.9, and SeaMonkey before 2.21. A crafted web site can move XBL-backed nodes across documents, enabling remote code execution or a denial of service (JavaScript compartmen...
CVE-2017-7751
CVE-2017-7751 is a use-after-free vulnerability in Mozilla Firefox and Thunderbird associated with content viewer listeners, affecting Firefox versions before 54, ESR before 52.2, and Thunderbird before 52.2. The underlying issue is a memory safety flaw that can lead to a potentially exploitable ...
CVE-2018-18499
CVE-2018-18499 is a same-origin policy vulnerability in Mozilla Firefox and Thunderbird where a page using a meta http-equiv="refresh" redirects to another site and allows theft of cross-origin URL entries via performance.getEntries(). Affected: Firefox < 62, Firefox ESR < 60.2, Thunderbird
CVE-2023-37207
The provided connected documents confirm CVE-2023-37207 affects Firefox and Thunderbird (Firefox < 115, ESR < 102.13, Thunderbird
CVE-2009-0771
CVE-2009-0771 is a vulnerability described in the MiracleLinux AXSA-2009-348:01 advisory as affecting the Mozilla layout engine. The exposed products and versions include Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15. The issue allows remote attackers to cause a ...
CVE-2011-0069
CVE-2011-0069 affects Mozilla Firefox 3.5.x prior to 3.5.19, Firefox 3.6.x prior to 3.6.17, and Firefox 4.x prior to 4.0.1; Thunderbird prior to 3.1.10; and SeaMonkey prior to 2.0.14. The issue is an unspecified vulnerability in the browser engine that can cause memory corruption, leading to a de...
CVE-2012-4185
CVE-2012-4185 describes a buffer overflow in Mozilla Firefox’s nsCharTraits::length function that could allow remote code execution or a heap memory corruption in Firefox <16.0, ESR 10.x <10.0.8, Thunderbird <16.0/ESR 10.x <10.0.8, and SeaMonkey
CVE-2013-0791
The connected Nessus advisories confirm CVE-2013-0791 affects Mozilla NSS and upstream products via CERT_DecodeCertPackage, allowing remote doS through out-of-bounds reads and memory corruption when processing crafted certificates. Affected: NSS libraries and apps (Firefox before 20.0, ESR 17.x b...
CVE-2013-5604
CVE-2013-5604 affects the XSLT processor in Mozilla Firefox (and related Mozilla components) where txXPathNodeUtils::getBaseURI does not initialize data properly. This allows remote attackers to execute arbitrary code or cause a denial of service via crafted documents, including stack-based buffe...
CVE-2014-1576
CVE-2014-1576 is a heap-based buffer overflow in nsTransformedTextRun used when parsing CSS token sequences that trigger capitalization changes in Mozilla Firefox
CVE-2017-5451
CVE-2017-5451 describes an address bar spoofing vulnerability via the onblur event, enabling a script to affect text display and make the loaded site appear different from what’s in the address bar. The issue affects Mozilla products including Thunderbird < 52.1, Firefox ESR < 52.1, and Fir...
CVE-2018-5144
CVE-2018-5144 describes an integer overflow during Unicode text conversion caused by an unchecked length parameter. Affected products: Firefox ESR and Thunderbird (pre-52.7). Root cause: overflow during Unicode conversion. Impact: potential remote code execution or memory issues as implied by the...
CVE-2025-2817
The CVE-2025-2817 issue describes a vulnerability in Thunderbird’s update mechanism where a medium-integrity user process could interfere with the SYSTEM updater by manipulating file-locking, enabling privilege escalation via code injection into a user-privileged process. Affected products includ...
CVE-2007-3734
CVE-2007-3734 is a memory corruption vulnerability in the Mozilla browser engine affecting Mozilla Firefox and SeaMonkey components (and related Thunderbird components) prior to version 2.0.0.5. The issue could cause a remote crash via unspecified vectors, with some connected advisories noting po...
CVE-2010-1196
CVE-2010-1196 is a heap-based buffer overflow triggered by an integer overflow in nsGenericDOMDataNode::SetTextInternal. Affected products include Mozilla Firefox 3.5.x before 3.5.10, Firefox 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5, allowing remote code execution ...
CVE-2011-1187
CVE-2011-1187 affects Google Chrome prior to 10.0.648.127, allowing remote attackers to bypass the Same Origin Policy via an unspecified error-message leak vector. The vulnerability targets the browser’s SOP checks, enabling cross-origin access that should be restricted. Public sources within the...
CVE-2011-3659
CVE-2011-3659 is a use-after-free in Mozilla Firefox (before 3.6.26 and 4.x through 9.0), Thunderbird (before 3.1.18 and 5.0 through 9.0), and SeaMonkey (before 2.7). The root cause is premature notification of AttributeChildRemoved that affects access to removed nsDOMAttribute child nodes, enabl...
CVE-2012-0445
Vulnerability summary: Mozilla Firefox 4.x–9.0, Thunderbird 5.0–9.0, and SeaMonkey
CVE-2012-0449
CVE-2012-0449 affects Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7. Description: remote attackers can cause memory corruption and application crash, or possibly execute arbitrary code via a malformed XSLT stylesheet emb...
CVE-2013-0749
CVE-2013-0749 describes multiple unspecified vulnerabilities in the Mozilla Firefox browser engine (before 18.0) and related products (Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2 and ESR 17.x before 17.0.1, SeaMonkey before 2.15). The description states that remote attackers could c...
CVE-2013-0793
CVE-2013-0793 affects Mozilla Firefox family (Firefox, Firefox ESR, Thunderbird, SeaMonkey) and related XUL/XPCOM runtimes where the address bar could be manipulated during history navigation, enabling cross-site scripting (XSS) or phishing by timing navigation. Affected products in scope include...
CVE-2013-1722
CVE-2013-1722 describes a use-after-free in nsAnimationManager::BuildAnimations within the Mozilla Firefox animation system. The vulnerability affects Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.2...
CVE-2014-1590
CVE-2014-1590 affects Mozilla Firefox (before 34.0), Firefox ESR (31.x before 31.3), Thunderbird (before 31.3), and SeaMonkey (before 2.31). The issue is a denial of service caused by an error when passing a crafted JavaScript object to XMLHttpRequest.prototype.send. Remediation is to upgrade to ...
CVE-2014-8634
CVE-2014-8634 affects Mozilla Firefox (and related Mozilla products) with memory-safety and implementation issues in the browser engine that could allow remote code execution or a crash. Public disclosures across multiple advisories confirm additional related CVEs (e.g., 8638, 8639, 8641, etc.) a...
CVE-2015-0827
CVE-2015-0827 : A heap-based buffer overflow in mozilla::gfx::CopyRect within Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 could allow a remote attacker to read from uninitialized memory via a malformed SVG graphic, leading to possible information disclos...
CVE-2015-2739
CVE-2015-2739 affects Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1. The issue is in ArrayBufferBuilder::append, which accesses unintended memory locations. The description notes unspecified impact and attack vectors; no explicit explo...
CVE-2017-5419
CVE-2017-5419 is a denial-of-service vulnerability affecting Mozilla Firefox and Thunderbird prior to version 52. The issue arises when a malicious page repeatedly triggers a modal authentication prompt, causing the browser UI to become unresponsive. Public references describe this as a DOS condi...
CVE-2018-5145
CVE-2018-5145 concerns memory safety bugs in Mozilla Firefox ESR 52.6 that could lead to memory corruption and potential arbitrary code execution. The vulnerability affects Firefox ESR versions before 52.7 and Thunderbird versions before 52.7. Several distributions document fixes in Thunderbird a...
CVE-2009-1302
The CVE-2009-1302 entry affects Mozilla Firefox 3.x prior to 3.0.9, Thunderbird prior to 2.0.0.22, and SeaMonkey prior to 1.1.16. The vulnerability enables remote attackers to trigger a denial of service (application crash) and potentially memory corruption via multiple vectors, including nsAsync...
CVE-2010-1200
CVE-2010-1200 is reported across multiple advisories as part of Mozilla Firefox family vulnerabilities. Affected products include Firefox 3.5.x before 3.5.10, Firefox 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5. The issue is described as multiple unspecified vulnerabi...
CVE-2010-1213
The CVE-2010-1213 vulnerability affects Mozilla Firefox (3.5.x before 3.5.11; 3.6.x before 3.6.7), Thunderbird (3.0.x before 3.0.6; 3.1.x before 3.1.1), and SeaMonkey before 2.0.6. The importScripts Web Worker method does not verify that content is valid JavaScript, allowing remote attackers to b...
CVE-2012-0461
CVE-2012-0461 is a set of memory-safety vulnerabilities in Mozilla’s browser engine affecting Firefox (pre-3.6.28; 4.x–10.0; ESR 10.x before 10.0.3), Thunderbird (before 3.1.20 and 5.0–10.0.3), and SeaMonkey (before 2.8). The issues allow denial of service or possible arbitrary code execution via...
CVE-2012-3982
CVE-2012-3982 affects Mozilla Firefox before 16.0, Firefox ESR before 10.0.8, Thunderbird before 16.0, Thunderbird ESR before 10.0.8, and SeaMonkey before 2.13. The description notes multiple unspecified vulnerabilities in the browser engine that can cause memory corruption and application crashe...
CVE-2012-3991
CVE-2012-3991 affects Mozilla Firefox and related Mozilla products: Firefox and Firefox ESR before the 16.0 line, Thunderbird before 16.0, and SeaMonkey before 2.13 did not properly restrict JSAPI GetProperty access, bypassing the Same Origin Policy. This vulnerability could allow remote attacker...
CVE-2012-4202
CVE-2012-4202 describes a heap-based buffer overflow in Firefox’s image::RasterImage::DrawFrameTo, exploitable via a crafted GIF image to execute arbitrary code. Affected products include Mozilla Firefox before 17.0, Firefox ESR before 10.0.11 (10.x), Thunderbird before 17.0, Thunderbird ESR befo...
CVE-2013-5599
CVE-2013-5599 is a use-after-free vulnerability in the PresShell path: nsIPresShell::GetPresContext in Mozilla Firefox before 25.0 (and related ESR/Thunderbird/SeaMonkey branches) that can be triggered via a CANVAS element, a mozTextStyle attribute, and an onresize event. The underlying issue is ...
CVE-2013-5602
CVE-2013-5602 describes a vulnerability in the Web workers implementation of Mozilla Firefox and related Mozilla products where the function Worker::SetEventListener is susceptible to memory corruption/use-after-free. Affected products include Firefox before 25.0, ESR 17.x before 17.0.10 and 24.x...
CVE-2013-5618
CVE-2013-5618 is a use-after-free in Mozilla Firefox’s table-editing UI (nsNodeUtils::LastRelease). Affected: Firefox < 26.0, Firefox ESR < 24.2, Thunderbird < 24.2, SeaMonkey
CVE-2018-5174
CVE-2018-5174 involves Windows Defender SmartScreen honoring the SEE_MASK_FLAG_NO_UI flag, allowing downloaded files to run without UI prompts on Windows 10 April 2018 Update and later. The issue, as documented in NVD and reflected in the connected Nessus/SUSE advisories, notes that Firefox and T...
CVE-2023-50761
Affected software: Mozilla Thunderbird. Issue: S/MIME signature may be accepted despite mismatching signature creation date with message date/time, enabling impression of a different send date. Root cause: Thunderbird
CVE-2008-0412
The CVE-2008-0412 entry describes multiple remote-denial-of-service and potential memory corruption vulnerabilities in the browser engines of Mozilla Firefox <2.0.0.12, Thunderbird <2.0.0.12, and SeaMonkey
CVE-2010-2766
CVE-2010-2766 is a memory/DOM handling flaw in Mozilla’s browser engines where the normalization code could remove DOM nodes during traversal, leading to an access of a deleted object and potential code execution. Affected products and versions per the provided documents: Mozilla Firefox before 3...
CVE-2010-3168
CVE-2010-3168 affects Mozilla products (Firefox, Thunderbird, SeaMonkey) where XUL tree removal could be triggered by setting certain properties. Root cause: improper restriction of property changes in triggering XUL tree removal. Impact: remote attackers could cause a denial of service (deleted ...