CVE-2025-3523

Vulnerability in Thunderbird where the X-Mozilla-External-Attachment-URL header is processed such that only the last external link is shown on hover for multi-attachment messages. The hover text can mislead users into downloading content from untrusted sources, while the correct link is used on c...

CVE-2012-0447

CVE-2012-0447 affects Mozilla Firefox 4.x–9.0, Mozilla Thunderbird 5.0–9.0, and SeaMonkey

CVE-2012-0472

CVE-2012-0472 is present in the MiracleLinux AXSA:2012-874:05 advisory, which mentions Mozilla Firefox 4.x–11.0 (and related products like Thunderbird/SeaMonkey in affected lines) and links the issue to the cairo-dwrite font rendering code. The description in the initial document (and mirrored in...

CVE-2012-1938

CVE-2012-1938 affects Mozilla's browser engine and is described in the MiracleLinux AXSA:2012-857 advisory as multiple vulnerabilities in Firefox (and related components) that could allow memory corruption and remote code execution. Specifically, it impacts Mozilla Firefox before 13.0, Thunderbir...

CVE-2012-1945

CVE-2012-1945 affects Mozilla Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The issue occurs when an HTML document loads a shortcut file (.lnk) inside an IFRAME, demonstrated by a network share on Windows or ...

CVE-2012-3988

CVE-2012-3988 is a use-after-free vulnerability in Mozilla Firefox (pre-16.0), Firefox ESR (pre-10.0.8), Thunderbird (pre-16.0), Thunderbird ESR (pre-10.0.8), and SeaMonkey (pre-2.13). It can be triggered via mozRequestFullScreen with full-screen mode and navigation via history.back, potentially ...

CVE-2012-3989

CVE-2012-3989 affects Mozilla Firefox (and related Mozilla products) prior to version 16.0, Thunderbird prior to 16.0, and SeaMonkey prior to 2.13. The vulnerability is a crash caused by an invalid cast when using the instanceof operator on certain JavaScript objects, which could allow remote att...

CVE-2014-1549

The CVE-2014-1549 vulnerability affects Mozilla Firefox (before 31.0) and Thunderbird (before 31.0). It arises in mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer where poor Web Audio buffer memory allocation enables remote code execution or a denial of service via crafted audio con...

CVE-2017-5414

CVE-2017-5414 affects Mozilla Firefox (and Thunderbird) prior to version 52. The file picker dialog can instantiate and display the wrong local default directory, potentially disclosing OS or local account name. Remediation from connected docs: upgrade to Firefox 52.0+ (and Thunderbird 52.0+ as a...

CVE-2018-5162

CVE-2018-5162 is a Thunderbird information-disclosure vulnerability where plaintext of decrypted emails can leak through the src attribute of remote images or links. Affected products include Thunderbird ESR and Thunderbird before version 52.8. The root cause is plaintext leakage via image/src ha...

CVE-2008-5018

CVE-2008-5018 affects Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13. Root cause: insufficient class checking in the Date class in the JavaScript engine, enabling remote crash (DoS). Remediation from the initial desc...

CVE-2009-2463

CVE-2009-2463 is a browser vulnerability described for Mozilla Firefox before 3.0.12 (and related Thunderbird/SeaMonkey components in older advisories) involving integer overflows in PL_Base64Decode/PL_Base64Encode within nsprpub/lib/libc/src/base64.c. The issue can trigger memory corruption and ...

CVE-2011-3650

CVE-2011-3650 affects Mozilla Firefox versions prior to 3.6.24 and 4.x through 7.0, and Thunderbird prior to 3.1.6 and 5.0 through 7.0. The issue arises from how JavaScript files that contain many functions are handled when accessed via debugging APIs, enabling a user‑assisted attacker to trigger...

CVE-2013-6673

Technical details about CVE-2013-6673 are not publicly available in the provided connected documents; monitor for updates.

CVE-2015-0815

CVE-2015-0815 affects Mozilla Firefox (pre-37.0), Firefox ESR (31.x before 31.6), and Thunderbird (before 31.6). The underlying issue is memory safety bugs in the Firefox/browser engine, with exploitation scenarios described as remote code execution or denial of service via unknown vectors. Affec...

CVE-2015-2735

CVE-2015-2735 affects Mozilla Firefox (before 39.0), Firefox ESR (31.x before 31.8 and 38.x before 38.1), and Thunderbird (before 38.1). The issue is in nsZipArchive.cpp where memory locations are accessed in an unintended way when processing crafted ZIP archives, which could allow a remote attac...

CVE-2017-5426

CVE-2017-5426: On Linux, when seccomp-bpf is active as Gecko Media Plugin sandbox starts, the sandbox may fail to initialize, leaving code that would run in the sandbox only protected by a weaker filter. Affected products are Firefox < 52 and Thunderbird < 52 (Linux only). This can enable s...

CVE-2025-3909

Thunderbird (email client) is affected by CVE-2025-3909 via the X-Mozilla-External-Attachment-URL header. An attacker could craft a nested message/rfc822 attachment with content type application/pdf, causing Thunderbird to render it as HTML and execute JavaScript in the file:/// context after aut...

CVE-2026-12318

CVE-2026-12318 concerns the Mozilla NSS Libraries component. The vulnerability is described as incorrect boundary conditions in the NSS Libraries, with the fixed versions identified as Firefox 152 and Thunderbird 152. Connected sources confirm this fix and cite Firefox/Thunderbird 152 as the reme...

CVE-2026-2757

CVE-2026-2757 (FF/Thunderbird) is confirmed with root cause: incorrect boundary conditions in the WebRTC: Audio/Video component, fixed in Firefox 148, Firefox ESR 115.33/140.8 ESR, Thunderbird 148/140.8. Affected products explicitly include Firefox and Thunderbird lines in multiple advisories (AL...

CVE-2006-4340

CVE-2006-4340 is a cryptographic flaw in Mozilla NSS prior to 3.11.3 (used in Firefox ≤1.5.0.7, Thunderbird ≤1.5.0.7, SeaMonkey ≤1.0.5) where RSA with exponent 3 can produce signature forgery due to improper handling of extra data in PKCS #1 v1.5 verification. This enables remote attackers to for...

CVE-2009-0777

CVE-2009-0777 affects Mozilla Firefox (before 3.0.7), Mozilla Thunderbird (before 2.0.0.21), and SeaMonkey (before 1.1.15). The issue arises when decoding invisible characters displayed in the location bar, causing an incorrect address to be shown. This can enable remote attackers to spoof URLs a...

CVE-2011-0077

CVE-2011-0077 corresponds to an unspecified vulnerability in the Mozilla family browser engine affecting Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14. The issue could lead to memory corruption and application crash, with possi...

CVE-2011-3658

The CVE-2011-3658 issue affects Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5, where the SVG implementation mishandles DOMAttrModified interactions, leading to out-of-bounds memory access when removing SVG elements. This can enable a remote attacker to cause a denial of service or poten...

CVE-2012-1944

CVE-2012-1944 affects Mozilla Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The underlying issue is CSP not blocking inline event handlers, enabling potential cross-site scripting via crafted HTML documents. ...

CVE-2012-4187

CVE-2012-4187 is listed in the MiracleLinux/Miracle Linux AXSA advisory as affecting Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13. The vulnerability is described as an issue with managing a cert...

CVE-2013-0767

CVE-2013-0767 affects Mozilla Firefox (and related Mozilla components) with the nsSVGPathElement::GetPathLengthScale path handling. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service via an out-of-bounds read, reported for Firefox before 18.0, ESR 10....

CVE-2013-6671

CVE-2013-6671 affects Mozilla Firefox before 26.0 (and corresponding ESR/Thunderbird/SeaMonkey releases listed) where nsGfxScrollFrameInner::IsLTR can be abused by crafted JavaScript used with ordered list elements to trigger remote code execution. The vulnerability is a browser-engine issue that...

CVE-2024-8394

CVE-2024-8394 affects Mozilla Thunderbird prior to version 128.2. The issue is a use-after-free triggered when aborting the verification of an OTR chat session, potentially causing a crash. A fix is available in Thunderbird 128.2 and later; affected users should upgrade. This vulnerability is con...

CVE-2025-9179

CVE-2025-9179 describes a memory corruption vulnerability in the GMP process used by Firefox/Thunderbird for encrypted media handling, with privileges that are sandboxed yet could allow total impact (CVE-2025-9179). Affected products include Firefox < 142, Firefox ESR < 115.27/128.14/140.2,...

CVE-2007-3845

CVE-2007-3845 affects Mozilla Firefox (before 2.0.0.6), Thunderbird (before 1.5.0.13 and 2.x before 2.0.0.6), and SeaMonkey (before 1.1.4). The issue allows remote code execution via a vector tied to launching a file handling program based on the file extension at the end of the URI, a variant of...

CVE-2008-0591

CVE-2008-0591 concerns Mozilla Firefox (pre-2.0.0.12) and Thunderbird (pre-2.0.0.12). The issue arises from how a delay timer protecting security-sensitive dialogs is handled; an attacker could exploit window focus changes to bypass the timer and trick a user into confirming an unsafe action (pot...

CVE-2008-5012

CVE-2008-5012 affects Mozilla Firefox 2.x, Thunderbird 2.x, and SeaMonkey 1.x (before versions 2.0.0.18 / 1.1.13) where processing a canvas element and an HTTP redirect can bypass the same-origin policy, allowing access to images not directly accessible to the attacker. Several connected sources ...

CVE-2012-1937

CVE-2012-1937 affects Mozilla Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The vulnerability arises from multiple unspecified memory-safety/behavioral issues in the browser engine that could cause memory cor...

CVE-2013-0762

CVE-2013-0762 is a use-after-free in imgRequest::OnStopFrame affecting Mozilla Firefox prior to 18.0 (and ESR 10.x before 10.0.12, ESR 17.x before 17.0.1), Thunderbird prior to 17.0.2, and SeaMonkey prior to 2.15. It can allow remote code execution or a denial of service via heap memory corruptio...

CVE-2014-1552

CVE-2014-1552 is referenced in a 2014 Mozilla/Firefox advisory set (SUSE-SU-2014:0960-1) and in MFSA2014-66, with openVAS entries tying Firefox-related advisories to this CVE. The SUSE advisory lists CVE-2014-1552 among fixed items for Mozilla products, and shows a high severity/impact context (c...

CVE-2015-2737

CVE-2015-2737 affects Mozilla Firefox before 39.0 (and ESR 31.x before 31.8, 38.x before 38.1) and Thunderbird before 38.1. It targets rx::d3d11::SetBufferData, which reads data from uninitialized memory locations. The description notes the impact and attack vectors are unspecified; no explicit f...

CVE-2017-7846

CVE-2017-7846 affects Mozilla Thunderbird. The issue arises in parsing RSS feeds when viewed via website or default feed format, allowing JavaScript execution from the parsed feed (feed origin mailbox://). Published mitigations indicate Thunderbird versions up to 52.5.2 are affected, with fixes i...

CVE-2025-8032

CVE-2025-8032 involves an XSLT loading flaw where the source document was not propagated, allowing a CSP bypass in Mozilla components. Affected products/versions (per provided sources): Firefox and Thunderbird lines including Firefox < 141, Firefox ESR < 128.13 and < 140.1, Thunderbird &...

CVE-2006-5462

CVE-2006-5462 affects the NSS library used by Mozilla Firefox (pre-3.11.3 NSS) and by Thunderbird/SeaMonkey in versions before the listed patched releases. The issue arises when using an RSA key with exponent 3 and corrupted/extra data in a PKCS#1 signature, enabling forgery of SSL/TLS and email ...

CVE-2008-1233

CVE-2008-1233 affects Mozilla Firefox <2.0.0.13, Thunderbird <2.0.0.13, and SeaMonkey

CVE-2011-3651

CVE-2011-3651 involves Mozilla Firefox 7.0 and Thunderbird 7.0. The description cites multiple unspecified vulnerabilities in the browser engine that could allow remote attackers to cause a denial of service via memory corruption and application crash, or possibly execute arbitrary code through u...

CVE-2012-1946

CVE-2012-1946 is a Use-after-free in Mozilla’s browser engine (nsINode::ReplaceOrInsertBefore) affecting Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0 and ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The connected docs confirm this is a remote code-execution risk vi...

CVE-2017-5399

CVE-2017-5399 is a memory-safety vulnerability affecting Firefox and Thunderbird prior to version 52. Several connected advisories (e.g., Arch Linux ASA-201703-3, DEBIAN CVE tracker, MFSA2017-09) describe memory-safety bugs that could lead to arbitrary code execution or crashes. The documented re...

CVE-2021-4127

CVE-2021-4127 concerns an out-of-date Angle graphics library used by Mozilla Thunderbird and Firefox ESR, affecting Thunderbird < 78.9 and Firefox ESR

CVE-2006-1727

CVE-2006-1727 affects Mozilla-derived browsers: Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1. The issue allows remote attackers to gain chrome privileges through multiple attack vectors related to the use of XBL...

CVE-2008-2803

CVE-2008-2803 affects Mozilla Firefox <= 2.0.0.14/2.0.0.15? and SeaMonkey

CVE-2008-4060

CVE-2008-4060 affects Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12). The flaw, exploitable via document.loadBindingDocument and XSLT processing, could allow remote attackers to execute arbitrary code with chrome privileges. Th...

CVE-2012-4205

CVE-2012-4205 affects Mozilla Firefox (prior to 17.0), Mozilla Thunderbird (prior to 17.0), and SeaMonkey (prior to 2.14). The root cause, per the description, is that XMLHttpRequest objects created in sandboxes are assigned the system principal rather than the sandbox principal, enabling CSRF ag...

CVE-2016-1526

CVE-2016-1526 concerns Graphite2 Libgraphite’s TtfUtil:LocaLookup in Graphite 2 1.2.4 used by Mozilla Firefox before 43.0 and ESR 38.x before 38.6.1. The bug stems from incorrect validation of a size value in TtfUtil.cpp, enabling remote attackers to trigger an out-of-bounds read, potentially lea...