CVE-2012-1949

CVE-2012-1949 affects Mozilla Firefox (4.x–13.0), Mozilla Thunderbird (5.0–13.0), and SeaMonkey (pre-2.11). The description cites multiple browser-engine vulnerabilities that allow remote attackers to trigger memory corruption, leading to a crash or possibly arbitrary code execution via unknown v...

CVE-2012-1954

CVE-2012-1954 is a use-after-free in Mozilla Firefox’s nsDocument::AdoptNode, affecting Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, and SeaMonkey before 2.11. Exploitation can cause a denial of service (heap memory corruption) or possibly remote code execution via vect...

CVE-2012-3964

CVE-2012-3964 is a use-after-free in gfxTextRun::GetUserData in Mozilla Firefox before 15.0 (and similar affected components in Thunderbird/SeaMonkey) that allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. Public/conne...

CVE-2012-4209

Mode C: The CVE-2012-4209 issue affects Mozilla-based components used in MiracleLinux 4 (firefox-10.0.11-1.0.1.AXS4, xulrunner-10.0.11-1.0.1.AXS4) and is described as allowing cross-site scripting by abusing top frame name and location access. Affected products include Mozilla Firefox and Firefox...

CVE-2013-0778

CVE-2013-0778 affects Mozilla Firefox (pre-19.0), Thunderbird (pre-17.0.3), and SeaMonkey (pre-2.16). The issue stems from use-after-free and out-of-bounds/read vulnerabilities in the browser components (notably flagged in MFSA 2013-28), enabling remote code execution or denial of service via uns...

CVE-2017-7756

CVE-2017-7756 is a use-after-free/use-after-scope vulnerability affecting Firefox <54, Firefox ESR <52.2, and Thunderbird

CVE-2017-7829

CVE-2017-7829 is a Thunderbird vulnerability in which the sender’s address can be spoofed. The real sender is hidden if a null character precedes the display string, causing the recipient to see an arbitrary address. Affected product is Mozilla Thunderbird prior to 52.5.2. The issue is described ...

CVE-2011-0070

Summary of CVE-2011-0070 (as per provided documents) Affected products/versions: Mozilla Firefox up to 3.5.18 (3.5.x before 3.5.19), Firefox 3.6.x before 3.6.17, Firefox 4.x before 4.0.1; Mozilla Thunderbird before 3.1.10; SeaMonkey before 2.0.14. Root cause/impact (from description): Unspecified...

CVE-2011-0071

CVE-2011-0071 is a directory traversal vulnerability affecting Mozilla Firefox prior to 3.5.19, and Firefox 3.6.x prior to 3.6.17, Thunderbird prior to 3.1.10, and SeaMonkey prior to 2.0.14 on Windows. The issue allows remote attackers to determine the existence of arbitrary files, and potentiall...

CVE-2012-1973

CVE-2012-1973 is a use-after-free vulnerability in Mozilla Firefox family components. The issue arises in nsObjectLoadingContent::LoadObject, affecting Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. Expl...

CVE-2013-1678

CVE-2013-1678 affects Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6, via the _cairo_xlib_surface_add_glyph function which allows remote code execution or a denial of service (invalid write) through unspecified vector...

CVE-2013-1712

CVE-2013-1712 affects Mozilla updater in Firefox (before 23.0) and Firefox ESR 17.x (before 17.0.8), as well as Thunderbird (before 17.0.8 and ESR 17.x before 17.0.8) on Windows 7/Server 2008 R2/8/Server 2012. The issue is a local privilege escalation via untrusted search path Trojan horse DLLs l...

CVE-2014-1511

CVE-2014-1511 affects Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25. The issue is described as a remote bypass of the popup blocker via unspecified vectors. Public security advisories in 2014 consolidate Firefox/Thunderbird/SeaMonkey...

CVE-2014-1539

Technical details for CVE-2014-1539 are not publicly available in the provided documents. Please monitor for official updates or vendor advisories to obtain affected products, impact, and fixes.

CVE-2017-7848

CVE-2017-7848 affects Mozilla Thunderbird prior to 52.5.2. The issue allows RSS fields to inject new lines into the created email structure, altering the message body. Public entries and advisories confirm Thunderbird upgrades to 52.5.2 as the fix (e.g., CentOS/RHSA-2018:0061, Debian DSA-4075-1 a...

CVE-2006-3809

CVE-2006-3809: Firefox <=1.5.0.4/Thunderbird <=1.5.0.4/SeaMonkey

CVE-2008-5014

CVE-2008-5014 affects Mozilla firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13. Root cause: modifying window.proto .proto can lock a non-native object, triggering an OBJ_IS_NATIVE assertion. Impact: remote attacker could crash...

CVE-2010-3776

CVE-2010-3776 affects Mozilla Firefox before 3.5.16 and Firefox 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11. The issue is described as memory safety/memory corruption in the browser engine, allowing a remote attacker to cause a denial of serv...

CVE-2012-0463

The CVE-2012-0463 issue affects Mozilla Firefox browser engine in Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR before 10.0.3, and SeaMonkey before 2.8. The flaw is in the nsWindow implementation not val...

CVE-2012-3961

CVE-2012-3961 is a use-after-free in the RangeData implementation affecting Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0/ESR 10.x before 10.0.7, and SeaMonkey before 2.12. Exploitation could allow remote code execution or a denial of service via heap memory...

CVE-2012-4205

CVE-2012-4205 affects Mozilla Firefox (prior to 17.0), Mozilla Thunderbird (prior to 17.0), and SeaMonkey (prior to 2.14). The root cause, per the description, is that XMLHttpRequest objects created in sandboxes are assigned the system principal rather than the sandbox principal, enabling CSRF ag...

CVE-2013-0770

CVE-2013-0770 affects Mozilla Firefox (pre-18.0), Thunderbird (pre-17.0.2), and SeaMonkey (pre-2.15). The issue is described as multiple unspecified vulnerabilities in the browser engine that can cause memory corruption and application crashes, with potential for arbitrary code execution via unkn...

CVE-2008-5511

Affected software: Mozilla Firefox (3.x before 3.0.5; 2.x before 2.0.0.19), Mozilla Thunderbird (2.x before 2.0.0.19), and SeaMonkey (1.x before 1.1.14). Root cause: vulnerability in XBL bindings allowing an XSS payload via an unloaded document, combined with bypass of the same-origin policy (CVE...

CVE-2009-1832

CVE-2009-1832 affects Mozilla Firefox (before 3.0.11), Mozilla Thunderbird (before 2.0.0.22), and SeaMonkey (before 1.1.17). The issue allows remote attackers to trigger memory corruption and/or potentially execute arbitrary code via a vulnerability described as “double frame construction.” Explo...

CVE-2010-0174

CVE-2010-0174 covers multiple Mozilla packages with several browser-engine vulnerabilities that could allow memory corruption, DoS, or potentially arbitrary code execution. Affected products and versions, as documented, include Mozilla Firefox up to 3.0.18/3.0.x (pre-3.0.19), Firefox 3.5.x before...

CVE-2010-1210

CVE-2010-1210 affects Mozilla Firefox before 3.6.7 and Thunderbird before 3.1.1, where undefined positions in certain 8‑bit encodings map to U+FFFD, potentially enabling cross‑site scripting (XSS) via crafted text. The NVD entry shows a base score of 4.3 (MEDIUM) with network access and no user i...

CVE-2011-0078

CVE-2011-0078 is an unspecified vulnerability in the browser engine affecting Mozilla Firefox 3.5.x prior to 3.5.19, Firefox 3.6.x prior to 3.6.17, Thunderbird prior to 3.1.10, and SeaMonkey prior to 2.0.14. The issue can cause a denial of service through memory corruption and may allow arbitrary...

CVE-2011-0081

CVE-2011-0081 covers an unspecified memory-corruption vulnerability in the Mozilla Firefox 3.6.x engine (before 3.6.17) and Firefox 4.x (before 4.0.1), and in Thunderbird 3.1.x (before 3.1.10). It can be exploited remotely to cause a denial of service or potentially execute arbitrary code via unk...

CVE-2012-0452

Technical details about CVE-2012-0452 are not publicly provided in the connected documents. The initial description lists the vulnerability and affected products, but no further technical specifics or patch information are included here. Monitor for updates.

CVE-2012-3975

Technical details about CVE-2012-3975 (affected product, root cause, impact, remediation) are not provided in the connected documents. Monitor for updates.

CVE-2026-7322

CVE-2026-7322 affects Mozilla Firefox: memory safety bugs in Firefox 150.0.0 and Firefox ESR 115.35.0, 140.10.0. Some bugs showed evidence of memory corruption and, with enough effort, could be exploited to run arbitrary code. Affected components include Firefox core/browser memory handling acros...

CVE-2006-0748

CVE-2006-0748 affects Mozilla Firefox/Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1. The vulnerability arises from an invalid and non-sensical ordering of table-related tags that results in a negative array index, enabling remote ar...

CVE-2006-1742

CVE-2006-1742 affects Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0. The issue stems from improper handling of temporary variables that are not garbage collected, which could allow remote attackers to access freed memo...

CVE-2006-6501

CVE-2006-6501 affects Mozilla Firefox 2.x before 2.0.0.1, Firefox 1.5.x before 1.5.0.9, SeaMonkey before 1.0.7, and Thunderbird/SeaMonkey-family components as noted in connected advisories. The issue is a privilege-escalation via the watch Javascript function that could allow remote code executio...

CVE-2010-1215

CVE-2010-1215 affects Mozilla Firefox 3.6.x (pre-3.6.7) and Thunderbird 3.1.x (pre-3.1.1). The vulnerability arises when a content script accesses a content object via SJOW (SafeJSObjectWrapper); this can let attacker-controlled code in the chrome context execute arbitrary JavaScript with chrome ...

CVE-2011-0085

CVE-2011-0085 is a use-after-free in the nsXULCommandDispatcher of Mozilla Firefox prior to 3.6.18, Thunderbird prior to 3.1.11, and SeaMonkey up to 2.0.14. The flaw allows remote attackers to execute arbitrary code by crafting an XUL document that dequeues the current command updater, enabling c...

CVE-2012-3971

CVE-2012-3971 affects SIL Graphite 2 as used in Mozilla Firefox up to 15.0, Mozilla Thunderbird up to 15.0, and SeaMonkey up to 2.12. The vulnerability arises from issues in Silf::readClassMap and Pass::readPass, allowing remote attackers to execute arbitrary code or cause memory corruption (DoS)...

CVE-2013-0769

CVE-2013-0769 refers to multiple unspecified vulnerabilities in the Mozilla browser engine that could cause memory corruption and application crashes, potentially enabling remote code execution. Affected products and versions cited in connected docs include Mozilla Firefox before 18.0, Firefox ES...

CVE-2017-17688

CVE-2017-17688 concerns an OpenPGP CFB gadget/malleability attack (EFAIL) that can lead to plaintext exfiltration from encrypted emails. Connected advisories show Enigmail/OpenPGP patches (e.g., openSUSE SUSE/OpenSUSE-2019-368/395; Thunderbird enigmail updates) addressing this vulnerability by ti...

CVE-2017-7764

CVE-2017-7764 concerns a domain spoofing issue in the address bar caused by mixing Canadian Syllabics with Latin characters in IDN rendering. Affected products include Firefox before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The vulnerability arises from the Unicode handling that ...

CVE-2025-26695

CVE-2025-26695 is a Thunderbird vulnerability where an incorrect padding size is used when requesting an OpenPGP key from a WKD server, enabling a network observer to learn the length of the requested email address. Affected: Thunderbird versions prior to 136 and prior to 128.8. Remediation: upgr...

CVE-2025-8032

CVE-2025-8032 involves an XSLT loading flaw where the source document was not propagated, allowing a CSP bypass in Mozilla components. Affected products/versions (per provided sources): Firefox and Thunderbird lines including Firefox < 141, Firefox ESR < 128.13 and < 140.1, Thunderbird &...

CVE-2006-1728

CVE-2006-1728 affects multiple Mozilla-based products (Firefox and Thunderbird 1.x < 1.5.0.2; Mozilla Suite < 1.7.13; SeaMonkey

CVE-2008-0416

CVE-2008-0416 describes multiple XSS vulnerabilities in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8. The issue allows remote attackers to inject arbitrary web script or HTML via certain character encodings, specifically: (1) a backspace character treat...

CVE-2011-0072

CVE-2011-0072 refers to an unspecified vulnerability in the browser engine affecting Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14, allowing remote attackers to cause memory corruption and application crashes or possibly execut...

CVE-2012-3985

CVE-2012-3985 is a vulnerability in Mozilla Firefox, Thunderbird, and SeaMonkey where the HTML5 Same Origin Policy could be violated, allowing initial-origin access after document.domain is set and potentially enabling cross-site scripting (XSS). Affected versions are Firefox/Thunderbird/SeaMonke...

CVE-2012-4191

Technical details about CVE-2012-4191 (affected products, root cause, impact, or fixes) are not provided in the connected documents. Please monitor for updates.

CVE-2026-2757

CVE-2026-2757 (FF/Thunderbird) is confirmed with root cause: incorrect boundary conditions in the WebRTC: Audio/Video component, fixed in Firefox 148, Firefox ESR 115.33/140.8 ESR, Thunderbird 148/140.8. Affected products explicitly include Firefox and Thunderbird lines in multiple advisories (AL...

CVE-2026-6746

This CVE (CVE-2026-6746) is a use-after-free in the DOM: Core & HTML component. The Initial document states it was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Connected documents also reference Mozilla advisories tying this CVE to Firefox...

CVE-2006-3811

CVE-2006-3811 is a memory corruption crash vulnerability within Mozilla Firefox components (notably the Firefox 1.5.x line around the 1.5.0.5 release) and related Mozilla projects (SeaMonkey/Thunderbird in affected bundles). The issue manifests as crashes and is described as memory corruption tha...