CVE-2010-3168

CVE-2010-3168 affects Mozilla products (Firefox, Thunderbird, SeaMonkey) where XUL tree removal could be triggered by setting certain properties. Root cause: improper restriction of property changes in triggering XUL tree removal. Impact: remote attackers could cause a denial of service (deleted ...

CVE-2011-3062

CVE-2011-3062 : An off-by-one error in the OpenType Sanitizer used by Google Chrome prior to 18.0.1025.142 allows remote attackers to cause a denial of service or possibly other impact via a crafted OpenType file. The MiracleLinux/OpenSUSE/Oracle Solaris advisories reference this CVE as part of C...

CVE-2012-1967

CVE-2012-1967 affects Mozilla Firefox 4.x–13.0, Firefox ESR 10.x prior to 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x prior to 10.0.6, and SeaMonkey prior to 2.11. Root cause: JavaScript sandbox may run javascript: URLs with insufficient context, allowing remote code execution with user pr...

CVE-2012-4188

CVE-2012-4188 is a heap-based buffer overflow in Mozilla Firefox’s Convolve3x3 path, affecting Firefox before 16.0 (and ESR 10.x before 10.0.8), Thunderbird before 16.0 (and ESR 10.x before 10.0.8), and SeaMonkey before 2.13. The vulnerability allows remote code execution via unspecified vectors;...

CVE-2012-4214

CVE-2012-4214 is a use-after-free in Mozilla Firefox’s nsTextEditorState::PrepareEditor, affecting Firefox before 17.0 and ESR 10.x before 10.0.11, Thunderbird before 17.0/ESR 10.x before 10.0.11, and SeaMonkey before 2.14. The vulnerability can allow remote attackers to execute arbitrary code or...

CVE-2023-37208

CVE-2023-37208 affects Firefox (<115), Firefox ESR (<102.13), and Thunderbird (

CVE-2010-2765

CVE-2010-2765: Integer overflow in the FRAMESET cols attribute may allow remote code execution via a large number of columns. Affected products include Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7. Exploitation c...

CVE-2012-0477

CVE-2012-0477 is one of multiple XSS-related issues affecting Mozilla Firefox 4.x–11.0, ESR 10.x before 10.0.4, Thunderbird 5.0–11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9. It enables remote attackers to inject arbitrary web script or HTML via decoding of (1) ISO-2022-KR or...

CVE-2013-0745

This CVE (CVE-2013-0745) affects Mozilla Firefox prior to 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. It is caused by the AutoWrapperChanger not interacting correctly with garbage collection, enabling remote code ...

CVE-2013-0764

CVE-2013-0764 affects Mozilla Firefox (before 18.0), Firefox ESR (before 17.0.2), Thunderbird (before 17.0.2 and ESR 17.x before 17.0.2), and SeaMonkey (before 2.15). The vulnerability is a thread-safety issue in nsSOCKSSocketInfo::ConnectToProxy that can allow remote code execution through craft...

CVE-2013-1737

CVE-2013-1737 affects Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0/ESR 17.x before 17.0.9, and SeaMonkey before 2.21. The issue is that the attacker-controlled getter on DOM proxies may fail to correctly identify the this object, potentially bypassing acces...

CVE-2014-1592

CVE-2014-1592 is a use-after-free in Mozilla Firefox’s nsHtml5TreeOperation (xul.dll) that enables remote code execution by adding a second root element to an HTML5 document during parsing. Affected products/versions include Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird b...

CVE-2023-29545

CVE-2023-29545 describes a Windows Save As issue where Firefox/Thunderbird could resolve environment-variable-like names in suggested filenames to the current user context. Affected: Firefox and Thunderbird on Windows; versions affected per the entry are Firefox < 112, Firefox ESR < 102.10,...

CVE-2012-3959

CVE-2012-3959 describes a use-after-free in Mozilla Firefox’s nsRangeUpdater::SelAdjDeleteNode, affecting Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. The vulnerability allows remote attackers to execu...

CVE-2012-3967

CVE-2012-3967 is a Firefox/WebGL vulnerability on Linux where the WebGL implementation fails to interact correctly with Mesa drivers when a large number of sampler uniforms are used. This can let remote attackers execute arbitrary code or cause a denial of service (stack memory corruption) via a ...

CVE-2012-4207

CVE-2012-4207 affects Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0 / ESR 10.x, and SeaMonkey before 2.14. The flaw in the HZ-GB-2312 charset implementation allows remote attackers to perform cross-site scripting (XSS) via a crafted document, due to imprope...

CVE-2013-0761

CVE-2013-0761 is a use-after-free vulnerability in Firefox’s mozilla::TrackUnionStream::EndTrack that could allow remote code execution or a denial of service via heap memory corruption. Affected products include Firefox before 18.0 (and ESR 17.x before 17.0.1), Thunderbird before 17.0.2 (and ESR...

CVE-2014-1541

CVE-2014-1541 is a use-after-free in the RefreshDriverTimer::TickDriver function of the SMIL Animation Controller, affecting Mozilla Firefox before 30.0, Firefox ESR before 24.6, and Thunderbird before 24.6. Remote attackers could abuse crafted web content to execute arbitrary code or cause a den...

CVE-2017-5403

CVE-2017-5403 affects Mozilla Firefox and Thunderbird prior to version 52.0 (Firefox <52, Thunderbird

CVE-2017-5416

CVE-2017-5416 is a null dereference crash in HttpChannel caused by premature release of a networking event listener in certain Firefox/Thunderbird environments. Concrete details from connected docs show the issue as a memory-access crash stemming from a premature release, affecting Firefox/Firefo...

CVE-2017-5421

CVE-2017-5421 is reported as a print preview spoofing issue affecting Mozilla Firefox and Mozilla Thunderbird when popup windows are enabled. The vulnerability description states that a malicious site could spoof the contents of the print preview window, causing user confusion about which site is...

CVE-2009-0773

Mode C: The CVE-2009-0773 issue affects Mozilla Firefox (and related Mozilla-based browsers) prior to 3.0.7, Thunderbird prior to 2.0.0.21, and SeaMonkey 1.1.15. The vulnerability is in the JavaScript engine and is triggered by: (1) a splice of an array containing some non-set elements, causing j...

CVE-2010-0176

CVE-2010-0176 affects Mozilla Firefox (before 3.0.19; 3.5.x before 3.5.9; 3.6.x before 3.6.2), Thunderbird before 3.0.4, and SeaMonkey before 2.0.4. The issue is a reference-counting error for option elements in a XUL tree optgroup, described as a dangling pointer vulnerability that could allow r...

CVE-2012-0456

CVE-2012-0456 concerns the SVG Filters implementation in Mozilla Firefox (and related Mozilla products) that can allow remote attackers to obtain sensitive information from process memory via an out-of-bounds read. Affected products include Firefox versions prior to 3.6.28 and 4.x through 10.0, F...

CVE-2012-1959

CVE-2012-1959 affects Mozilla Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0 and Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11. The root cause is the failure to consider same-compartment security wrappers (SCSW) during cross-compartment wrapping, allowing r...

CVE-2012-3992

CVE-2012-3992 affects Mozilla Firefox (and related Firefox-based apps) where history data is not properly handled. The flaw lets remote attackers perform cross-site scripting (XSS) or obtain sensitive POST content via a location.hash write operation combined with history navigation that loads a U...

CVE-2012-4201

CVE-2012-4201 is a concrete Firefox/XULRunner/Thunderbird/SeaMonkey vulnerability: the evalInSandbox path mishandles the context when processing JavaScript that sets location.href, enabling remote XSS or read access to arbitrary files via a sandboxed add-on. Affected software includes Mozilla Fir...

CVE-2012-5842

CVE-2012-5842 is a Mozilla Firefox browser engine vulnerability described as multiple unspecified vulnerabilities that can cause memory corruption leading to a crash or possibly remote code execution. Affected products/versions per description: Mozilla Firefox before 17.0, Firefox ESR 10.x before...

CVE-2013-5595

CVE-2013-5595 affects the Mozilla/XUL Firefox engine. The vulnerability arises from improper memory allocation in unspecified JavaScript functions, enabling remote attackers to trigger a buffer overflow via a crafted web page. Affected are Firefox before 25.0, Firefox ESR 17.x before 17.0.10, and...

CVE-2018-5185

CVE-2018-5185 is a vulnerability in Mozilla Thunderbird where plaintext of decrypted emails can leak through when a user submits an embedded form. The public descriptions specify the affected products as Thunderbird ESR < 52.8 and Thunderbird

CVE-2026-8090

CVE-2026-8090 describes a use-after-free in Firefox’s DOM: Networking component. The issue is fixed in Firefox 150.0.2, Firefox ESR 140.10.2, and Firefox ESR 115.35.2. The connected sources confirm the vulnerability class and the exact patched versions. The description does not specify affected c...

CVE-2009-1309

CVE-2009-1309 affects Mozilla Firefox (pre-3.0.9) and its related Mozilla suite components (Thunderbird, SeaMonkey). The issue arises from improper Same Origin Policy handling for XMLHttpRequest (document principal mismatch) and XPCNativeWrapper.toString (incorrect proto scope), enabling cross-si...

CVE-2011-2377

CVE-2011-2377 affects Mozilla Firefox (Firefox <3.6.18 and 4.x ≤ 4.0.1), Thunderbird (

CVE-2012-0478

CVE-2012-0478 affects Mozilla Firefox WebGL texImage2D in Firefox 4.x–11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0–11.0 and ESR 10.x before 10.0.4, and SeaMonkey before 2.9. Root cause is improper restriction of JSVAL_TO_OBJECT casts in WebGL, enabling remote code execution via a crafted...

CVE-2012-0479

CVE-2012-0479 affects Mozilla Firefox (4.x–11.0; ESR 10.x before 10.0.4), Thunderbird (5.0–11.0), and SeaMonkey (before 2.9). Root cause per description: spoofing of the address bar via an https URL for invalid RSS/Atom XML content. This enables remote attackers to mislead users about the site th...

CVE-2012-1956

CVE-2012-1956 affects Mozilla Firefox (pre-15.0), Thunderbird (pre-15.0), and SeaMonkey (pre-2.12). The issue is that Object.defineProperty can shadow the top-level location object (window.location), enabling cross-site scripting via plugin-imbued vectors. MiracleLinux advisories enumerate CVE-20...

CVE-2013-0747

Technical details for CVE-2013-0747 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2013-5597

CVE-2013-5597 is a use-after-free vulnerability in Mozilla Firefox (and affected Mozilla platforms) caused by improper handling in nsDocLoader::doStopDocumentLoad during an offline-cache update. The issue allows remote attackers to trigger arbitrary code execution or a denial of service via a sta...

CVE-2014-1593

CVE-2014-1593 is a stack-based buffer overflow in Mozilla Firefox’s mozilla::FileBlockCache::Read that could allow remote code execution via crafted media content. Affected products and versions in the provided documents: Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird befo...

CVE-2014-8639

CVE-2014-8639 affects Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32. It improperly interprets Set-Cookie headers in responses with a 407 Proxy Authentication Required status, enabling a remote proxy to perform session fixation by inj...

CVE-2015-2729

Mozilla Firefox contains an out-of-bounds read in AudioParamTimeline::AudioNodeInputValue affecting Web Audio oscillator rendering range (pre-39.0 and ESR 38.x before 38.1). Remote attackers could disclose a few bytes of memory or trigger a DoS. The fix is to upgrade Firefox to 39.0+ (and ESR 38....

CVE-2017-7749

This CVE-2017-7749 is a use-after-free in the docshell reload path that affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird

CVE-2017-7758

CVE-2017-7758 describes an out-of-bounds read in the Opus encoder when the number of channels in an audio stream changes during encoding. Affected products include Firefox < 54, Firefox ESR < 52.2, and Thunderbird

CVE-2021-29949

CVE-2021-29949 concerns Thunderbird and the OTR protocol library loading. The issue: during startup, Thunderbird may load a shared OTR library using a filename not distributed by Thunderbird. If a system already hosts a malicious copy of that alternative filename and the library is on the executa...

CVE-2009-0774

The CVE-2009-0774 entry affects the Mozilla layout/JavaScript stack: Firefox 2 and 3 prior to 3.0.7, Thunderbird prior to 2.0.0.21, and SeaMonkey prior to 1.1.15 are vulnerable to remote-triggered denial of service and potential arbitrary code execution via gczeal-related vectors (distinct from C...

CVE-2011-3648

CVE-2011-3648 is an XSS vulnerability in Mozilla Firefox prior to 3.6.24 and 4.x through 7.0 and in Thunderbird prior to 3.1.6 and 5.0 through 7.0. It allows remote attackers to inject arbitrary web script or HTML via crafted text encoded in Shift_JIS. Affected products include Firefox and Thunde...

CVE-2012-0458

CVE-2012-0458 affects Mozilla Firefox and related Mozilla products where a drag-and-drop of a javascript: URL to the home button could bypass restrictions and execute arbitrary JavaScript with chrome privileges in the about:sessionrestore context. Affected products include Firefox before 3.6.28 a...

CVE-2012-0471

CVE-2012-0471 is documented in multiple connected advisories as a Cross-site Scripting (XSS) vulnerability in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9. The root cause is a vulnerabi...

CVE-2012-0473

CVE-2012-0473 : In Mozilla Firefox and related Mozilla products, the WebGLBuffer::FindMaxUshortElement function calls FindMaxElementInSubArray with incorrect template arguments, allowing remote attackers to obtain sensitive information from video memory via a crafted WebGL.drawElements call. Affe...

CVE-2012-1947

CVE-2012-1947 describes a heap-based buffer overflow in the utf16_to_isolatin1 function affecting Mozilla Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The vulnerability allows remote attackers to execute arb...