1883 matches found
CVE-2012-3984
CVE-2012-3984 affects Mozilla Firefox (<16.0), Mozilla Thunderbird (<16.0), and SeaMonkey (
CVE-2013-0752
Technical details for CVE-2013-0752 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.
CVE-2013-0799
The CVE-2013-0799 issue is a local privilege-escalation vulnerability in the Mozilla Maintenance Service component of Mozilla Firefox (and Thunderbird) prior to certain 17.x/20.0-era builds on Windows. It stems from a buffer overflow when processing crafted arguments, allowing an unprivileged use...
CVE-2015-2740
CVE-2015-2740 affects Mozilla Firefox (and Thunderbird) with a buffer overflow in nsXMLHttpRequest::AppendToResponseText, allowing remote denial of service or other impact. Affected: Firefox before 39.0; Firefox ESR 31.x before 31.8 and 38.x before 38.1. Remediation: upgrade to Firefox 39.0+ (and...
CVE-2017-17689
CVE-2017-17689 arises from S/MIME CBC gadget attacks (EFAIL) that can lead to plaintext exfiltration. Connected sources show this affecting KDE PIM/KMail components and related mail tooling across Linux/macOS ecosystems, with public advisories describing how S/MIME/CBC malleability could leak pla...
CVE-2017-5406
CVE-2017-5406 is a memory/segmentation fault in the Skia graphics library triggered during certain canvas operations due to issues with mask/clip intersection and empty masks. Affected products include Mozilla Firefox and Mozilla Thunderbird (Firefox/Thunderbird versions earlier than 52). The roo...
CVE-2013-0756
CVE-2013-0756 corresponds to a use-after-free in Mozilla Firefox’s obj_toSource path that can be triggered by a crafted web page referencing JavaScript Proxy objects, allowing remote code execution via standard web-visit attack vectors. Affected products include Firefox (pre-18.0), Firefox ESR 17...
CVE-2013-1738
CVE-2013-1738 describes a use-after-free in Mozilla’s JS_GetGlobalForScopeChain, enabling remote code execution via mismanaged garbage collection in default compartments during frame-chain restoration. Affected products from the provided data include Mozilla Firefox (before 24.0), Thunderbird (be...
CVE-2014-1553
Technical details about CVE-2014-1553 are not publicly provided in the connected documents. Monitor for updates from vendors/security advisories; current sources only reference the CVE among broader Firefox/Thunderbird vulnerabilities, with no explicit affected versions or fixes in the supplied d...
CVE-2015-0836
CVE-2015-0836 involves multiple memory-safety vulnerabilities in the Mozilla Firefox browser engine and related Thunderbird components. Affected products/versions include Firefox up to 36.0, Firefox ESR up to 31.x before 31.5, and Thunderbird up to 31.5. The flaws allow remote attackers to cause ...
CVE-2017-5422
CVE-2017-5422 describes a denial-of-service crash triggered by repeatedly using the view-source: protocol within a single hyperlink. The issue affects Mozilla Firefox and Thunderbird prior to version 52. The root cause is tied to how the view-source: protocol was handled in a chained hyperlink, a...
CVE-2017-7750
CVE-2017-7750 describes a use-after-free in video control operations when a element holds a reference to an older window that has been replaced in the DOM, leading to a potentially exploitable crash. Affected products and versions from the connected records include Mozilla Firefox < 54, Firef...
CVE-2022-3155
CVE-2022-3155 affects Mozilla Thunderbird and is described as: when saving or opening a mail attachment on macOS, Thunderbird failed to set the com.apple.quarantine attribute on the received file. If the file was an application, opening it could launch the application immediately without user con...
CVE-2026-2447
CVE-2026-2447 describes a heap buffer overflow in libvpx that affects components used by Firefox and Thunderbird. The Initial Description notes fixes in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2. Connected documents corroborate the sa...
CVE-2012-5830
CVE-2012-5830 is a use-after-free vulnerability in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 on Mac OS X that allows remote attackers to execute arbitrary code via an HTML document. The con...
CVE-2013-1724
CVE-2013-1724 is a use-after-free in Mozilla Firefox (and related Mozilla products) where mozilla::dom::HTMLFormElement::IsDefaultSubmitElement can be triggered by a destroyed SELECT element. Affected software includes Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21. The v...
CVE-2014-1565
Technical details about CVE-2014-1565 are not provided in the connected documents. OpenSUSE and OSV entries reference Firefox-related updates but do not describe affected components, impact, or fixes for this CVE. Monitor for updates.
CVE-2017-5412
CVE-2017-5412 is a buffer overflow read in SVG filter color value processing that results in data exposure. Affected products are Firefox and Thunderbird versions older than 52. The root cause is a memory safety/overflow issue in SVG filter handling. Remediation is to update to Firefox 52.0+ and ...
CVE-2017-7754
CVE-2017-7754 is an out-of-bounds read in WebGL when processing a malicious ImageInfo object during WebGL operations. Affected products/versions per connected docs: Firefox versions prior to 54 and Firefox ESR prior to 52.2, and Thunderbird prior to 52.2. The vulnerability stems from an improper ...
CVE-2017-7782
CVE-2017-7782 affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox
CVE-2020-15685
CVE-2020-15685 affects Thunderbird prior to 78.7. During the plaintext phase of STARTTLS, protocol commands could be injected and evaluated within the encrypted session. Affected product: Thunderbird (before 78.7). Root cause: insufficient validation during STARTTLS plaintext phase. Impact: poten...
CVE-2025-0510
Thunderbird vulnerability: The From address can be displayed incorrectly when the From field uses the invalid group name syntax described in CVE-2024-49040. Affects Thunderbird <128.7 and
CVE-2010-0169
Technical details about CVE-2010-0169 are not provided in the supplied documents. Please monitor official advisories and vendor patches for affected products and versions.
CVE-2011-2989
The CVE-2011-2989 entry describes a WebGL memory-corruption flaw in the browser engine affecting Firefox 4.x–5 , SeaMonkey 2.x before 2.3 , and Thunderbird before 6 , with potential for memory corruption, DoS, or arbitrary code execution via unspecified vectors. Connected documents confirm instan...
CVE-2012-1945
CVE-2012-1945 affects Mozilla Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The issue occurs when an HTML document loads a shortcut file (.lnk) inside an IFRAME, demonstrated by a network share on Windows or ...
CVE-2012-1961
CVE-2012-1961 affects Mozilla Firefox 4.x–13.0, Firefox ESR 10.x prior to 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x prior to 10.0.6, and SeaMonkey prior to 2.11. The issue is a UI security flaw in how duplicate values in the X-Frame-Options header are handled, which can enable remote att...
CVE-2012-3995
CVE-2012-3995 affects Mozilla Firefox and related Mozilla applications. The vulnerability arises from the IsCSSWordSpacingSpace function in Firefox (and Firefox ESR 10.x, Thunderbird, SeaMonkey as listed) where an out-of-bounds read could be exploited to run arbitrary code or trigger a denial-of-...
CVE-2013-1728
Affected software: Mozilla Firefox (before 24.0), Thunderbird (before 24.0), and SeaMonkey (before 2.21). Root cause: IonMonkey memory not properly initialized when Valgrind mode is used, enabling potential leakage of sensitive data. Impact: remote attackers could obtain sensitive information via...
CVE-2013-5596
Affected software: Mozilla Firefox (before 25.0), Firefox ESR (before 24.1, 24.x line), Thunderbird (before 24.1), SeaMonkey (before 2.22). Vulnerability: cycle-collection (CC) in Firefox may misdetermine the thread for releasing an image object, enabling a remote attacker to trigger arbitrary co...
CVE-2015-2725
CVE-2015-2725 refers to multiple memory safety vulnerabilities in Mozilla Firefox (and Thunderbird) that could allow remote code execution or memory corruption leading to a crash. The connected IBM advisories confirm affected products (IBM Storwize V7000 Unified and IBM SONAS) ship Firefox compon...
CVE-2017-5414
CVE-2017-5414 affects Mozilla Firefox (and Thunderbird) prior to version 52. The file picker dialog can instantiate and display the wrong local default directory, potentially disclosing OS or local account name. Remediation from connected docs: upgrade to Firefox 52.0+ (and Thunderbird 52.0+ as a...
CVE-2026-7320
CVE-2026-7320 involves an information disclosure in the Firefox Audio/Video component caused by incorrect boundary conditions. Affected products are Firefox desktop browser (and ESR branches). The vulnerability allows information disclosure with high confidentiality impact (per CVSS: AV:N/AC:L/PR...
CVE-2007-0775
CVE-2007-0775 involves multiple unspecified vulnerabilities in the layout engine of Mozilla Firefox (pre-1.5.0.10 and pre-2.0.0.2), Thunderbird (pre-1.5.0.10), and SeaMonkey (pre-1.0.8). The issues can cause a denial of service (crash) and potentially allow arbitrary code execution via certain ve...
CVE-2008-0418
CVE-2008-0418 is a directory-traversal flaw in Chrome URL handling that could allow remote attackers to read local files (Javascript, images, stylesheets) and potentially exfiltrate session data. Affected: Mozilla Firefox <= 2.0.0.11/12, Thunderbird <= 2.0.0.11/12, SeaMonkey
CVE-2008-2785
The CVE-2008-2785 issue affects Mozilla Firefox (before 2.0.0.16 and 3.x before 3.0.1), Thunderbird (before 2.0.0.16), and SeaMonkey (before 1.1.11). It stems from using an incorrect integer data type as the CSS object reference counter in the CSSValue array (nsCSSValue:Array) data structure, all...
CVE-2011-2363
CVE-2011-2363 is a use-after-free vulnerability in the nsSVGPointList::AppendElement function affecting Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14. It can cause application crashes or possibly allow arbitrary code execution via vectors involving a user-...
CVE-2011-2366
CVE-2011-2366 : Gecko-based browsers (Firefox < 5.0, Thunderbird
CVE-2012-0446
CVE-2012-0446 maps to multiple XSS flaws in Mozilla Firefox (4.x–9.0), Thunderbird (5.0–9.0), and SeaMonkey before 2.7, tied to improper XPConnect frame-script restrictions. Connected advisories confirm affected products and patches: openSUSE/SUSE updates reference Firefox ESR packages (e.g., fir...
CVE-2012-1955
The CVE applies to Mozilla Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11. It enables remote attackers to spoof the address bar using navigation history (history.forward/history.back). Root cause is likely a fl...
CVE-2012-3988
CVE-2012-3988 is a use-after-free vulnerability in Mozilla Firefox (pre-16.0), Firefox ESR (pre-10.0.8), Thunderbird (pre-16.0), Thunderbird ESR (pre-10.0.8), and SeaMonkey (pre-2.13). It can be triggered via mozRequestFullScreen with full-screen mode and navigation via history.back, potentially ...
CVE-2013-0767
CVE-2013-0767 affects Mozilla Firefox (and related Mozilla components) with the nsSVGPathElement::GetPathLengthScale path handling. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service via an out-of-bounds read, reported for Firefox before 18.0, ESR 10....
CVE-2013-1723
CVE-2013-1723 affects Mozilla Firefox (before 24.0), Thunderbird (before 24.0) and SeaMonkey (before 2.21). The NativeKey widget processes key messages after destruction by a dispatched event listener, enabling a denial of service (application crash) via incorrect event usage after widget-memory ...
CVE-2018-5161
The CVE-2018-5161 issue affects Mozilla Thunderbird (including ESR branches) and is caused by crafted message headers that can cause the Thunderbird process to hang when receiving a message. Public records identify affected versions as Thunderbird ESR < 52.8 and Thunderbird
CVE-2025-3875
CVE-2025-3875 affects Thunderbird. The issue arises from how Thunderbird parses addresses, allowing sender spoofing if the server permits an invalid From address; e.g., a From header value like "Spoofed Name" can cause the address to appear as [email protected]. Impact is spoofing of From: head...
CVE-2009-0777
CVE-2009-0777 affects Mozilla Firefox (before 3.0.7), Mozilla Thunderbird (before 2.0.0.21), and SeaMonkey (before 1.1.15). The issue arises when decoding invisible characters displayed in the location bar, causing an incorrect address to be shown. This can enable remote attackers to spoof URLs a...
CVE-2012-0472
CVE-2012-0472 is present in the MiracleLinux AXSA:2012-874:05 advisory, which mentions Mozilla Firefox 4.x–11.0 (and related products like Thunderbird/SeaMonkey in affected lines) and links the issue to the cairo-dwrite font rendering code. The description in the initial document (and mirrored in...
CVE-2012-0474
CVE-2012-0474 describes a cross-site scripting (XSS) vulnerability in the docshell of Mozilla Firefox 4.x–11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0–11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9. The issue is a Universal XSS (UXSS) flaw that lets remote attackers i...
CVE-2012-1938
CVE-2012-1938 affects Mozilla's browser engine and is described in the MiracleLinux AXSA:2012-857 advisory as multiple vulnerabilities in Firefox (and related components) that could allow memory corruption and remote code execution. Specifically, it impacts Mozilla Firefox before 13.0, Thunderbir...
CVE-2012-3989
CVE-2012-3989 affects Mozilla Firefox (and related Mozilla products) prior to version 16.0, Thunderbird prior to 16.0, and SeaMonkey prior to 2.13. The vulnerability is a crash caused by an invalid cast when using the instanceof operator on certain JavaScript objects, which could allow remote att...