CVE-2011-0053

CVE-2011-0053 : Multiple memory-safety vulnerabilities in the Mozilla Firefox/Thunderbird/SeaMonkey browser engine were reported. The issue allows remote attackers to cause memory corruption and application crashes, and possibly execute arbitrary code via unknown vectors. The advisory details ind...

CVE-2011-0070

Summary of CVE-2011-0070 (as per provided documents) Affected products/versions: Mozilla Firefox up to 3.5.18 (3.5.x before 3.5.19), Firefox 3.6.x before 3.6.17, Firefox 4.x before 4.0.1; Mozilla Thunderbird before 3.1.10; SeaMonkey before 2.0.14. Root cause/impact (from description): Unspecified...

CVE-2011-0074

CVE-2011-0074 is described as an unspecified vulnerability in the Mozilla Firefox browser engine for Firefox 3.5.x (pre-3.5.19) and 3.6.x (pre-3.6.17), Thunderbird up to 3.1.10, and SeaMonkey up to 2.0.14. The issue allows remote attackers to cause memory corruption and application crash or possi...

CVE-2011-0081

CVE-2011-0081 covers an unspecified memory-corruption vulnerability in the Mozilla Firefox 3.6.x engine (before 3.6.17) and Firefox 4.x (before 4.0.1), and in Thunderbird 3.1.x (before 3.1.10). It can be exploited remotely to cause a denial of service or potentially execute arbitrary code via unk...

CVE-2012-0475

The CVE-2012-0475 issue affects Mozilla Firefox 4.x–11.0, Thunderbird 5.0–11.0, and SeaMonkey before 2.9, caused by improper construction of Origin and Sec-WebSocket-Origin HTTP headers that could allow bypassing an IPv6 literal ACL via cross-site XMLHttpRequest or WebSocket on a nonstandard port...

CVE-2012-1973

CVE-2012-1973 is a use-after-free vulnerability in Mozilla Firefox family components. The issue arises in nsObjectLoadingContent::LoadObject, affecting Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. Expl...

CVE-2012-3975

Technical details about CVE-2012-3975 (affected product, root cause, impact, remediation) are not provided in the connected documents. Monitor for updates.

CVE-2012-4209

Mode C: The CVE-2012-4209 issue affects Mozilla-based components used in MiracleLinux 4 (firefox-10.0.11-1.0.1.AXS4, xulrunner-10.0.11-1.0.1.AXS4) and is described as allowing cross-site scripting by abusing top frame name and location access. Affected products include Mozilla Firefox and Firefox...

CVE-2014-1539

Technical details for CVE-2014-1539 are not publicly available in the provided documents. Please monitor for official updates or vendor advisories to obtain affected products, impact, and fixes.

CVE-2025-26695

The Mozilla Thunderbird email client is vulnerable to an information leak when requesting an OpenPGP key from a WKD server . The root cause is the use of an incorrect padding size , which allows a network observer to determine the length of the requested email address. This vulnerability affects ...

CVE-2026-6769

This vulnerability involves a privilege escalation within the Debugger component of the Mozilla Firefox browser and the Thunderbird email client. Deficiencies in access control could allow a malicious actor to enhance their privileges remotely. The issue is fixed in Firefox 150 , Firefox ESR 140....

CVE-2006-5462

CVE-2006-5462 affects the NSS library used by Mozilla Firefox (pre-3.11.3 NSS) and by Thunderbird/SeaMonkey in versions before the listed patched releases. The issue arises when using an RSA key with exponent 3 and corrupted/extra data in a PKCS#1 signature, enabling forgery of SSL/TLS and email ...

CVE-2010-1215

CVE-2010-1215 affects Mozilla Firefox 3.6.x (pre-3.6.7) and Thunderbird 3.1.x (pre-3.1.1). The vulnerability arises when a content script accesses a content object via SJOW (SafeJSObjectWrapper); this can let attacker-controlled code in the chrome context execute arbitrary JavaScript with chrome ...

CVE-2011-3232

CVE-2011-3232 affects the YARR engine used by Mozilla Firefox up to 7.0, Thunderbird up to 7.0, and SeaMonkey up to 2.4. The vulnerability allows remote attackers to crash the application or potentially execute arbitrary code via crafted JavaScript. The issue arises from the JavaScript engine han...

CVE-2012-1975

CVE-2012-1975 is a Use-after-free vulnerability in PresShell::CompleteMove affecting Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. It potentially allows remote code execution or a denial of serv...

CVE-2012-4191

Technical details about CVE-2012-4191 (affected products, root cause, impact, or fixes) are not provided in the connected documents. Please monitor for updates.

CVE-2013-1678

CVE-2013-1678 affects Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6, via the _cairo_xlib_surface_add_glyph function which allows remote code execution or a denial of service (invalid write) through unspecified vector...

CVE-2013-1712

CVE-2013-1712 affects Mozilla updater in Firefox (before 23.0) and Firefox ESR 17.x (before 17.0.8), as well as Thunderbird (before 17.0.8 and ESR 17.x before 17.0.8) on Windows 7/Server 2008 R2/8/Server 2012. The issue is a local privilege escalation via untrusted search path Trojan horse DLLs l...

CVE-2014-1511

Mozilla Firefox versions before 28.0 , Firefox ESR 24.x before 24.4 , Thunderbird before 24.4 , and SeaMonkey before 2.25 are vulnerable to a security flaw that allows remote attackers to bypass the popup blocker via unspecified vectors. While specific technical root causes for this bypass are no...

CVE-2014-1585

CVE-2014-1585 affects Mozilla Firefox and related ESR/Thunderbird builds prior to fixed versions. The issue is in the WebRTC video-sharing feature (dom/media/MediaManager.cpp) where stopping sharing actions for videos inside IFRAMEs is not recognized, allowing a remote attacker to continue an act...

CVE-2015-2736

CVE-2015-2736 concerns Mozilla Firefox (pre-39.0), Firefox ESR (31.x pre-31.8 and 38.x pre-38.1), and Thunderbird (pre-38.1). The issue is in nsZipArchive::BuildFileList where unintended memory locations may be accessed when processing crafted ZIP archives, leading to a remote attacker potentiall...

CVE-2017-7829

CVE-2017-7829 is a Thunderbird vulnerability in which the sender’s address can be spoofed. The real sender is hidden if a null character precedes the display string, causing the recipient to see an arbitrary address. Affected product is Mozilla Thunderbird prior to 52.5.2. The issue is described ...

CVE-2017-7848

CVE-2017-7848 affects Mozilla Thunderbird prior to 52.5.2. The issue allows RSS fields to inject new lines into the created email structure, altering the message body. Public entries and advisories confirm Thunderbird upgrades to 52.5.2 as the fix (e.g., CentOS/RHSA-2018:0061, Debian DSA-4075-1 a...

CVE-2025-8035

Mozilla Firefox and Thunderbird products are affected by CVE-2025-8035 , which involves multiple memory safety bugs . These vulnerabilities can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial of service (service failure) on a vulnerable syst...

CVE-2026-6766

The NSS library contains a vulnerability caused by incorrect boundary conditions in its Libraries component . This flaw allows a remote attacker to cause a service failure . Affected software includes Mozilla Firefox , Firefox ESR , and Thunderbird . Remediation is available in Firefox 150 , Fire...

CVE-2009-1832

CVE-2009-1832 affects Mozilla Firefox (before 3.0.11), Mozilla Thunderbird (before 2.0.0.22), and SeaMonkey (before 1.1.17). The issue allows remote attackers to trigger memory corruption and/or potentially execute arbitrary code via a vulnerability described as “double frame construction.” Explo...

CVE-2010-0174

CVE-2010-0174 covers multiple Mozilla packages with several browser-engine vulnerabilities that could allow memory corruption, DoS, or potentially arbitrary code execution. Affected products and versions, as documented, include Mozilla Firefox up to 3.0.18/3.0.x (pre-3.0.19), Firefox 3.5.x before...

CVE-2010-1210

CVE-2010-1210 affects Mozilla Firefox before 3.6.7 and Thunderbird before 3.1.1, where undefined positions in certain 8‑bit encodings map to U+FFFD, potentially enabling cross‑site scripting (XSS) via crafted text. The NVD entry shows a base score of 4.3 (MEDIUM) with network access and no user i...

CVE-2011-0078

CVE-2011-0078 is an unspecified vulnerability in the browser engine affecting Mozilla Firefox 3.5.x prior to 3.5.19, Firefox 3.6.x prior to 3.6.17, Thunderbird prior to 3.1.10, and SeaMonkey prior to 2.0.14. The issue can cause a denial of service through memory corruption and may allow arbitrary...

CVE-2012-1949

CVE-2012-1949 affects Mozilla Firefox (4.x–13.0), Mozilla Thunderbird (5.0–13.0), and SeaMonkey (pre-2.11). The description cites multiple browser-engine vulnerabilities that allow remote attackers to trigger memory corruption, leading to a crash or possibly arbitrary code execution via unknown v...

CVE-2012-3961

CVE-2012-3961 is a use-after-free in the RangeData implementation affecting Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0/ESR 10.x before 10.0.7, and SeaMonkey before 2.12. Exploitation could allow remote code execution or a denial of service via heap memory...

CVE-2012-3985

CVE-2012-3985 is a vulnerability in Mozilla Firefox, Thunderbird, and SeaMonkey where the HTML5 Same Origin Policy could be violated, allowing initial-origin access after document.domain is set and potentially enabling cross-site scripting (XSS). Affected versions are Firefox/Thunderbird/SeaMonke...

CVE-2013-0770

CVE-2013-0770 affects Mozilla Firefox (pre-18.0), Thunderbird (pre-17.0.2), and SeaMonkey (pre-2.15). The issue is described as multiple unspecified vulnerabilities in the browser engine that can cause memory corruption and application crashes, with potential for arbitrary code execution via unkn...

CVE-2016-1526

CVE-2016-1526 concerns Graphite2 Libgraphite’s TtfUtil:LocaLookup in Graphite 2 1.2.4 used by Mozilla Firefox before 43.0 and ESR 38.x before 38.6.1. The bug stems from incorrect validation of a size value in TtfUtil.cpp, enabling remote attackers to trigger an out-of-bounds read, potentially lea...

CVE-2017-17688

CVE-2017-17688 concerns an OpenPGP CFB gadget/malleability attack (EFAIL) that can lead to plaintext exfiltration from encrypted emails. Connected advisories show Enigmail/OpenPGP patches (e.g., openSUSE SUSE/OpenSUSE-2019-368/395; Thunderbird enigmail updates) addressing this vulnerability by ti...

CVE-2017-7756

CVE-2017-7756 is a use-after-free/use-after-scope vulnerability affecting Firefox <54, Firefox ESR <52.2, and Thunderbird

CVE-2017-7764

CVE-2017-7764 concerns a domain spoofing issue in the address bar caused by mixing Canadian Syllabics with Latin characters in IDN rendering. Affected products include Firefox before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The vulnerability arises from the Unicode handling that ...

CVE-2025-1943

Mozilla Firefox and Thunderbird (versions prior to 136 ) are affected by memory safety bugs involving memory corruption . A buffer overflow in dynamic memory could allow a remote attacker to execute arbitrary code . Remediation is available in Firefox 136 and Thunderbird 136 . Exploitation detail...

CVE-2025-26696

The Mozilla Thunderbird email client is vulnerable to a flaw where certain crafted MIME email messages can be incorrectly displayed as encrypted. Specifically, messages that claim to contain an encrypted OpenPGP message but actually contain an OpenPGP signed message are wrongly shown as being enc...

CVE-2025-4082

CVE-2025-4082 involves a memory corruption vulnerability in the WebGL Shader Attribute Handler component of Mozilla Firefox , Mozilla Firefox ESR , and the Mozilla Thunderbird email client. Modification of specific WebGL shader attributes can trigger an out-of-bounds read , which, when chained wi...

CVE-2025-9180

A Same-origin policy bypass vulnerability exists in the Graphics: Canvas2D component of Firefox and Thunderbird . This flaw allows for a bypass of security boundaries, leading to potential cross-origin data access. The vulnerability has been addressed in Firefox 142 , Firefox ESR 115.27 , Firefox...

CVE-2026-16377

A mitigation bypass vulnerability exists in the PDF Viewer component of the Mozilla Firefox and Thunderbird browsers. This flaw could potentially lead to the execution of arbitrary code. The issue has been addressed in Firefox 153 , Firefox ESR 140.13 , Thunderbird 153 , and Thunderbird 140.13 . ...

CVE-2026-6773

The Graphics: WebGPU component in Mozilla Firefox and Mozilla Thunderbird is vulnerable to a Denial-of-service (DoS) attack caused by an integer overflow . This numerical overflow condition can be exploited remotely by an attacker to induce service interruptions. The vulnerability has been addres...

CVE-2008-0304

CVE-2008-0304 is a heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.12 and SeaMonkey before 1.1.8, allowing remote code execution via a crafted external-body MIME type in an email. The root cause is an incorrect memory allocation during message preview, enabling an attacker to run a...

CVE-2008-5511

Affected software: Mozilla Firefox (3.x before 3.0.5; 2.x before 2.0.0.19), Mozilla Thunderbird (2.x before 2.0.0.19), and SeaMonkey (1.x before 1.1.14). Root cause: vulnerability in XBL bindings allowing an XSS payload via an unloaded document, combined with bypass of the same-origin policy (CVE...

CVE-2010-3768

CVE-2010-3768 affects Mozilla Firefox (before 3.5.16 and 3.6.x before 3.6.13), Thunderbird (before 3.0.11 and 3.1.x before 3.1.7), and SeaMonkey (before 2.0.11). The issue stems from improper validation of downloadable fonts in the OS font implementation, enabling remote code execution via vector...

CVE-2012-3971

CVE-2012-3971 affects SIL Graphite 2 as used in Mozilla Firefox up to 15.0, Mozilla Thunderbird up to 15.0, and SeaMonkey up to 2.12. The vulnerability arises from issues in Silf::readClassMap and Pass::readPass, allowing remote attackers to execute arbitrary code or cause memory corruption (DoS)...

CVE-2012-4208

CVE-2012-4208 affects Mozilla Firefox ≤ prior to 17.0, Thunderbird ≤ prior to 17.0, and SeaMonkey ≤ 2.13/2.14. The XrayWrapper did not consider compartment during property filtering, allowing remote sites to bypass chrome-only restrictions on reading DOM object properties. Impact per description:...

CVE-2013-1680

CVE-2013-1680 is a use-after-free vulnerability in the nsFrameList::FirstChild function of Mozilla Firefox (and related components) that could allow remote code execution or a denial of service. Per the connected MiracleLinux advisories, affected products include Firefox/XULRunner packages around...

CVE-2013-1736

CVE-2013-1736 affects Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21. The vulnerability is due to improper establishment of parent-child relationships of range-request nodes in nsGfxScrollFrameInn...