CVE-2013-6671

CVE-2013-6671 affects Mozilla Firefox before 26.0 (and corresponding ESR/Thunderbird/SeaMonkey releases listed) where nsGfxScrollFrameInner::IsLTR can be abused by crafted JavaScript used with ordered list elements to trigger remote code execution. The vulnerability is a browser-engine issue that...

CVE-2013-6673

Technical details about CVE-2013-6673 are not publicly available in the provided connected documents; monitor for updates.

CVE-2014-1549

The CVE-2014-1549 vulnerability affects Mozilla Firefox (before 31.0) and Thunderbird (before 31.0). It arises in mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer where poor Web Audio buffer memory allocation enables remote code execution or a denial of service via crafted audio con...

CVE-2017-5426

CVE-2017-5426: On Linux, when seccomp-bpf is active as Gecko Media Plugin sandbox starts, the sandbox may fail to initialize, leaving code that would run in the sandbox only protected by a weaker filter. Affected products are Firefox < 52 and Thunderbird < 52 (Linux only). This can enable s...

CVE-2026-16367

CVE-2026-16367 affects Mozilla Firefox versions earlier than 153.0. The Sandboxing escape is due to an invalid pointer in the Disability Access APIs component, with the vulnerability fixed in Firefox 153. The CVSS v3.1 base score is 10.0 (CRITICAL), with Network attack vector, Low attack complexi...

CVE-2008-0591

CVE-2008-0591 concerns Mozilla Firefox (pre-2.0.0.12) and Thunderbird (pre-2.0.0.12). The issue arises from how a delay timer protecting security-sensitive dialogs is handled; an attacker could exploit window focus changes to bypass the timer and trick a user into confirming an unsafe action (pot...

CVE-2009-2463

CVE-2009-2463 is a browser vulnerability described for Mozilla Firefox before 3.0.12 (and related Thunderbird/SeaMonkey components in older advisories) involving integer overflows in PL_Base64Decode/PL_Base64Encode within nsprpub/lib/libc/src/base64.c. The issue can trigger memory corruption and ...

CVE-2011-3655

CVE-2011-3655 affects Mozilla Firefox 4.x–7.0 and Thunderbird 5.0–7.0, where access control is bypassed due to lack of checking for NoWaiverWrapper, enabling privilege escalation from a crafted web site. The Solaris/OSSVA/Nessus entries corroborate this issue as part of a broader Firefox/Thunderb...

CVE-2011-3658

The CVE-2011-3658 issue affects Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5, where the SVG implementation mishandles DOMAttrModified interactions, leading to out-of-bounds memory access when removing SVG elements. This can enable a remote attacker to cause a denial of service or poten...

CVE-2012-0447

CVE-2012-0447 affects Mozilla Firefox 4.x–9.0, Mozilla Thunderbird 5.0–9.0, and SeaMonkey

CVE-2012-1944

CVE-2012-1944 affects Mozilla Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The underlying issue is CSP not blocking inline event handlers, enabling potential cross-site scripting via crafted HTML documents. ...

CVE-2017-7804

CVE-2017-7804 involves the WindowsDllDetourPatcher destructor, which can be repurposed by malicious code in conjunction with other flaws to write arbitrary data to memory under attacker control on Windows. Public advisories for Mozilla Thunderbird and Firefox (MFSA 2017-18/19, MFSA 2017-20) descr...

CVE-2006-4340

CVE-2006-4340 is a cryptographic flaw in Mozilla NSS prior to 3.11.3 (used in Firefox ≤1.5.0.7, Thunderbird ≤1.5.0.7, SeaMonkey ≤1.0.5) where RSA with exponent 3 can produce signature forgery due to improper handling of extra data in PKCS #1 v1.5 verification. This enables remote attackers to for...

CVE-2007-3845

CVE-2007-3845 affects Mozilla Firefox (before 2.0.0.6), Thunderbird (before 1.5.0.13 and 2.x before 2.0.0.6), and SeaMonkey (before 1.1.4). The issue allows remote code execution via a vector tied to launching a file handling program based on the file extension at the end of the URI, a variant of...

CVE-2008-1233

CVE-2008-1233 affects Mozilla Firefox <2.0.0.13, Thunderbird <2.0.0.13, and SeaMonkey

CVE-2008-5018

CVE-2008-5018 affects Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13. Root cause: insufficient class checking in the Date class in the JavaScript engine, enabling remote crash (DoS). Remediation from the initial desc...

CVE-2011-3650

CVE-2011-3650 affects Mozilla Firefox versions prior to 3.6.24 and 4.x through 7.0, and Thunderbird prior to 3.1.6 and 5.0 through 7.0. The issue arises from how JavaScript files that contain many functions are handled when accessed via debugging APIs, enabling a user‑assisted attacker to trigger...

CVE-2012-1937

CVE-2012-1937 affects Mozilla Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The vulnerability arises from multiple unspecified memory-safety/behavioral issues in the browser engine that could cause memory cor...

CVE-2013-0762

CVE-2013-0762 is a use-after-free in imgRequest::OnStopFrame affecting Mozilla Firefox prior to 18.0 (and ESR 10.x before 10.0.12, ESR 17.x before 17.0.1), Thunderbird prior to 17.0.2, and SeaMonkey prior to 2.15. It can allow remote code execution or a denial of service via heap memory corruptio...

CVE-2014-1552

CVE-2014-1552 is referenced in a 2014 Mozilla/Firefox advisory set (SUSE-SU-2014:0960-1) and in MFSA2014-66, with openVAS entries tying Firefox-related advisories to this CVE. The SUSE advisory lists CVE-2014-1552 among fixed items for Mozilla products, and shows a high severity/impact context (c...

CVE-2015-2737

CVE-2015-2737 affects Mozilla Firefox before 39.0 (and ESR 31.x before 31.8, 38.x before 38.1) and Thunderbird before 38.1. It targets rx::d3d11::SetBufferData, which reads data from uninitialized memory locations. The description notes the impact and attack vectors are unspecified; no explicit f...

CVE-2025-3523

Vulnerability in Thunderbird where the X-Mozilla-External-Attachment-URL header is processed such that only the last external link is shown on hover for multi-attachment messages. The hover text can mislead users into downloading content from untrusted sources, while the correct link is used on c...

CVE-2011-2986

CVE-2011-2986 affects Mozilla Firefox 4.x–5, Thunderbird before 6, and SeaMonkey 2.x before 2.3 on Windows when using Direct2D. The issue allows cross‑origin data theft by inserting image data from a different domain into a canvas, potentially bypassing the Same Origin Policy. Root cause, as stat...

CVE-2012-4187

CVE-2012-4187 is listed in the MiracleLinux/Miracle Linux AXSA advisory as affecting Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13. The vulnerability is described as an issue with managing a cert...

CVE-2014-1558

CVE-2014-1558 affects Mozilla Firefox before 31.0 and Thunderbird before 31.0. A crafted certificate that does not use UTF-8 in a required context can cause a denial of service via X.509 certificate parsing. The connected Gentoo GLSA notes multiple vulnerabilities and instructs upgrading Firefox/...

CVE-2017-7846

CVE-2017-7846 affects Mozilla Thunderbird. The issue arises in parsing RSS feeds when viewed via website or default feed format, allowing JavaScript execution from the parsed feed (feed origin mailbox://). Published mitigations indicate Thunderbird versions up to 52.5.2 are affected, with fixes i...

CVE-2018-5162

CVE-2018-5162 is a Thunderbird information-disclosure vulnerability where plaintext of decrypted emails can leak through the src attribute of remote images or links. Affected products include Thunderbird ESR and Thunderbird before version 52.8. The root cause is plaintext leakage via image/src ha...

CVE-2006-5462

CVE-2006-5462 affects the NSS library used by Mozilla Firefox (pre-3.11.3 NSS) and by Thunderbird/SeaMonkey in versions before the listed patched releases. The issue arises when using an RSA key with exponent 3 and corrupted/extra data in a PKCS#1 signature, enabling forgery of SSL/TLS and email ...

CVE-2007-0777

CVE-2007-0777 affects Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, as well as Thunderbird before 1.5.0.10 and SeaMonkey before 1.0.8. The issue is a memory corruption vulnerability in the JavaScript engine that can be triggered by crafted JavaScript, resulting in a crash and possibly a...

CVE-2008-4060

CVE-2008-4060 affects Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12). The flaw, exploitable via document.loadBindingDocument and XSLT processing, could allow remote attackers to execute arbitrary code with chrome privileges. Th...

CVE-2008-5012

CVE-2008-5012 affects Mozilla Firefox 2.x, Thunderbird 2.x, and SeaMonkey 1.x (before versions 2.0.0.18 / 1.1.13) where processing a canvas element and an HTTP redirect can bypass the same-origin policy, allowing access to images not directly accessible to the attacker. Several connected sources ...

CVE-2011-0053

CVE-2011-0053 : Multiple memory-safety vulnerabilities in the Mozilla Firefox/Thunderbird/SeaMonkey browser engine were reported. The issue allows remote attackers to cause memory corruption and application crashes, and possibly execute arbitrary code via unknown vectors. The advisory details ind...

CVE-2011-0077

CVE-2011-0077 corresponds to an unspecified vulnerability in the Mozilla family browser engine affecting Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14. The issue could lead to memory corruption and application crash, with possi...

CVE-2012-0475

The CVE-2012-0475 issue affects Mozilla Firefox 4.x–11.0, Thunderbird 5.0–11.0, and SeaMonkey before 2.9, caused by improper construction of Origin and Sec-WebSocket-Origin HTTP headers that could allow bypassing an IPv6 literal ACL via cross-site XMLHttpRequest or WebSocket on a nonstandard port...

CVE-2013-0766

CVE-2013-0766 is a use-after-free in the ~nsHTMLEditRules implementation affecting Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15. The vulnerabili...

CVE-2014-1585

CVE-2014-1585 affects Mozilla Firefox and related ESR/Thunderbird builds prior to fixed versions. The issue is in the WebRTC video-sharing feature (dom/media/MediaManager.cpp) where stopping sharing actions for videos inside IFRAMEs is not recognized, allowing a remote attacker to continue an act...

CVE-2016-1526

CVE-2016-1526 concerns Graphite2 Libgraphite’s TtfUtil:LocaLookup in Graphite 2 1.2.4 used by Mozilla Firefox before 43.0 and ESR 38.x before 38.6.1. The bug stems from incorrect validation of a size value in TtfUtil.cpp, enabling remote attackers to trigger an out-of-bounds read, potentially lea...

CVE-2021-4127

CVE-2021-4127 concerns an out-of-date Angle graphics library used by Mozilla Thunderbird and Firefox ESR, affecting Thunderbird < 78.9 and Firefox ESR

CVE-2024-8394

CVE-2024-8394 affects Mozilla Thunderbird prior to version 128.2. The issue is a use-after-free triggered when aborting the verification of an OTR chat session, potentially causing a crash. A fix is available in Thunderbird 128.2 and later; affected users should upgrade. This vulnerability is con...

CVE-2025-3909

Thunderbird (email client) is affected by CVE-2025-3909 via the X-Mozilla-External-Attachment-URL header. An attacker could craft a nested message/rfc822 attachment with content type application/pdf, causing Thunderbird to render it as HTML and execute JavaScript in the file:/// context after aut...

CVE-2008-2803

CVE-2008-2803 affects Mozilla Firefox <= 2.0.0.14/2.0.0.15? and SeaMonkey

CVE-2011-3232

CVE-2011-3232 affects the YARR engine used by Mozilla Firefox up to 7.0, Thunderbird up to 7.0, and SeaMonkey up to 2.4. The vulnerability allows remote attackers to crash the application or potentially execute arbitrary code via crafted JavaScript. The issue arises from the JavaScript engine han...

CVE-2012-1946

CVE-2012-1946 is a Use-after-free in Mozilla’s browser engine (nsINode::ReplaceOrInsertBefore) affecting Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0 and ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The connected docs confirm this is a remote code-execution risk vi...

CVE-2012-1949

CVE-2012-1949 affects Mozilla Firefox (4.x–13.0), Mozilla Thunderbird (5.0–13.0), and SeaMonkey (pre-2.11). The description cites multiple browser-engine vulnerabilities that allow remote attackers to trigger memory corruption, leading to a crash or possibly arbitrary code execution via unknown v...

CVE-2012-1960

The CVE-2012-1960 entry affects Mozilla Firefox 4.x–13.0, Thunderbird 5.0–13.0, and SeaMonkey before 2.11. The qcms_transform_data_rgb_out_lut_sse2 function in the QCMS implementation may trigger an out-of-bounds read via a crafted color profile, allowing remote attackers to obtain sensitive info...

CVE-2015-0815

CVE-2015-0815 affects Mozilla Firefox (pre-37.0), Firefox ESR (31.x before 31.6), and Thunderbird (before 31.6). The underlying issue is memory safety bugs in the Firefox/browser engine, with exploitation scenarios described as remote code execution or denial of service via unknown vectors. Affec...

CVE-2015-2735

CVE-2015-2735 affects Mozilla Firefox (before 39.0), Firefox ESR (31.x before 31.8 and 38.x before 38.1), and Thunderbird (before 38.1). The issue is in nsZipArchive.cpp where memory locations are accessed in an unintended way when processing crafted ZIP archives, which could allow a remote attac...

CVE-2017-5399

CVE-2017-5399 is a memory-safety vulnerability affecting Firefox and Thunderbird prior to version 52. Several connected advisories (e.g., Arch Linux ASA-201703-3, DEBIAN CVE tracker, MFSA2017-09) describe memory-safety bugs that could lead to arbitrary code execution or crashes. The documented re...

CVE-2017-7825

The CVE-2017-7825 entry describes an OS X–specific issue where several fonts render Tibetan and Arabic characters as whitespace. When such characters appear in an IDN in the address bar, they enable domain name spoofing. Affected products include Mozilla Firefox versions earlier than 56 and Firef...

CVE-2011-0074

CVE-2011-0074 is described as an unspecified vulnerability in the Mozilla Firefox browser engine for Firefox 3.5.x (pre-3.5.19) and 3.6.x (pre-3.6.17), Thunderbird up to 3.1.10, and SeaMonkey up to 2.0.14. The issue allows remote attackers to cause memory corruption and application crash or possi...