CVE-2006-6501

CVE-2006-6501 affects Mozilla Firefox 2.x before 2.0.0.1, Firefox 1.5.x before 1.5.0.9, SeaMonkey before 1.0.7, and Thunderbird/SeaMonkey-family components as noted in connected advisories. The issue is a privilege-escalation via the watch Javascript function that could allow remote code executio...

CVE-2008-0416

CVE-2008-0416 describes multiple XSS vulnerabilities in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8. The issue allows remote attackers to inject arbitrary web script or HTML via certain character encodings, specifically: (1) a backspace character treat...

CVE-2008-5511

Affected software: Mozilla Firefox (3.x before 3.0.5; 2.x before 2.0.0.19), Mozilla Thunderbird (2.x before 2.0.0.19), and SeaMonkey (1.x before 1.1.14). Root cause: vulnerability in XBL bindings allowing an XSS payload via an unloaded document, combined with bypass of the same-origin policy (CVE...

CVE-2010-1210

CVE-2010-1210 affects Mozilla Firefox before 3.6.7 and Thunderbird before 3.1.1, where undefined positions in certain 8‑bit encodings map to U+FFFD, potentially enabling cross‑site scripting (XSS) via crafted text. The NVD entry shows a base score of 4.3 (MEDIUM) with network access and no user i...

CVE-2011-0072

CVE-2011-0072 refers to an unspecified vulnerability in the browser engine affecting Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14, allowing remote attackers to cause memory corruption and application crashes or possibly execut...

CVE-2012-0452

Technical details about CVE-2012-0452 are not publicly provided in the connected documents. The initial description lists the vulnerability and affected products, but no further technical specifics or patch information are included here. Monitor for updates.

CVE-2012-3975

Technical details about CVE-2012-3975 (affected product, root cause, impact, remediation) are not provided in the connected documents. Monitor for updates.

CVE-2013-0769

CVE-2013-0769 refers to multiple unspecified vulnerabilities in the Mozilla browser engine that could cause memory corruption and application crashes, potentially enabling remote code execution. Affected products and versions cited in connected docs include Mozilla Firefox before 18.0, Firefox ES...

CVE-2013-0782

CVE-2013-0782 is a heap-based buffer overflow in Mozilla’s nsSaveAsCharset::DoCharsetConversion that affects Firefox before 19.0, ESR 17.x before 17.0.3, Thunderbird before 17.0.3, and SeaMonkey before 2.16. The connected documents confirm this vulnerability and show affected components include F...

CVE-2013-1680

CVE-2013-1680 is a use-after-free vulnerability in the nsFrameList::FirstChild function of Mozilla Firefox (and related components) that could allow remote code execution or a denial of service. Per the connected MiracleLinux advisories, affected products include Firefox/XULRunner packages around...

CVE-2014-1562

CVE-2014-1562 affects Mozilla Firefox before 32.0, Firefox ESR before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1. The vulnerability arises from memory-safety issues in the browser engine, allowing remote attackers to cause memory corruption, crashes, or possi...

CVE-2017-17688

CVE-2017-17688 concerns an OpenPGP CFB gadget/malleability attack (EFAIL) that can lead to plaintext exfiltration from encrypted emails. Connected advisories show Enigmail/OpenPGP patches (e.g., openSUSE SUSE/OpenSUSE-2019-368/395; Thunderbird enigmail updates) addressing this vulnerability by ti...

CVE-2026-16349

CVE-2026-16349 : Same-origin policy bypass in the DOM: Navigation component affects Mozilla Firefox and Firefox ESR. Root cause is a bypass vulnerability in the Navigation component that can impact confidentiality, integrity, and availability (CVSS v3.1: 9.8, high) with network attack vector and ...

CVE-2026-8092

CVE-2026-8092 refers to memory safety bugs in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (and related Firefox components) with evidence of memory corruption and a potential for arbitrary code execution. The vulnerability was addressed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 11...

CVE-2006-1742

CVE-2006-1742 affects Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0. The issue stems from improper handling of temporary variables that are not garbage collected, which could allow remote attackers to access freed memo...

CVE-2010-0174

CVE-2010-0174 covers multiple Mozilla packages with several browser-engine vulnerabilities that could allow memory corruption, DoS, or potentially arbitrary code execution. Affected products and versions, as documented, include Mozilla Firefox up to 3.0.18/3.0.x (pre-3.0.19), Firefox 3.5.x before...

CVE-2010-3768

CVE-2010-3768 affects Mozilla Firefox (before 3.5.16 and 3.6.x before 3.6.13), Thunderbird (before 3.0.11 and 3.1.x before 3.1.7), and SeaMonkey (before 2.0.11). The issue stems from improper validation of downloadable fonts in the OS font implementation, enabling remote code execution via vector...

CVE-2012-1974

CVE-2012-1974 is a use-after-free vulnerability in gfxTextRun::CanBreakLineBefore affecting Mozilla Firefox (and related apps like Thunderbird/SeaMonkey) prior to version 15.0, with remote code execution or a denial of service via unspecified vectors. The connected Nessus entries confirm the CVE ...

CVE-2013-0763

CVE-2013-0763 is a use-after-free vulnerability in Mozilla Firefox (pre-18.0) and Firefox ESR 17.x (pre-17.0.1), Thunderbird (pre-17.0.2/ESR 17.x pre-17.0.1), and SeaMonkey (pre-2.15). It is triggered via Mesa driver interactions and a resized WebGL canvas, potentially allowing remote attackers t...

CVE-2025-1943

CVE-2025-1943 covers memory-safety bugs in Mozilla Firefox 135 and Thunderbird 135, affecting Firefox < 136 and Thunderbird

CVE-2026-12289

CVE-2026-12289 describes a privilege-escalation vulnerability in the Graphics: WebRender component. The public description and connected advisories indicate this affects Mozilla Firefox and Thunderbird products, with fixes shipped in: Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbi...

CVE-2006-6497

CVE-2006-6497 affects Mozilla Firefox 2.x (before 2.0.0.1) and Firefox 1.5.x (before 1.5.0.9), SeaMonkey before 1.0.7, and Thunderbird before 1.5.0.9. The issue, along with related flaws (CVE-2006-6498, CVE-2006-6499, CVE-2006-6501–CVE-2006-6505), enables memory corruption and crashes and can pot...

CVE-2009-2466

The CVE-2009-2466 issue affects Mozilla Firefox (and Thunderbird) up to version prior to 3.0.12, where the JavaScript engine can be abused to cause memory corruption, a crash, or potentially arbitrary code execution. The described vectors involve the engine internals in nsDOMClassInfo.cpp, JS_Has...

CVE-2025-26696

CVE-2025-26696 affects Mozilla Thunderbird and is triggered by certain crafted MIME messages that claim to contain an encrypted OpenPGP message but actually contain an OpenPGP signed message, causing the UI to mis-display the content as encrypted. Public references in connected documents corrobor...

CVE-2026-6785

CVE-2026-6785 affects memory-safety bugs in Mozilla Firefox/Thunderbird components across Firefox ESR 115.34, ESR 140.9, Thunderbird ESR 140.9, Firefox 149, and Thunderbird 149. The issues potentially allow memory corruption and could enable arbitrary code execution; Mozilla fixed these bugs in F...

CVE-2006-1730

CVE-2006-1730 is a heap-based buffer overflow vulnerability caused by an integer overflow in the CSS letter-spacing handling, allowing remote code execution. Affected products and versions include Mozilla Firefox and Thunderbird 1.x before 1.5.0.2, and 1.0.x before 1.0.8; Mozilla Suite before 1.7...

CVE-2006-1739

CVE-2006-1739 is a memory-corruption flaw in the CSS border rendering path used by Mozilla Firefox/Thunderbird/SeaMonkey. The issue could crash the browser or potentially allow arbitrary code execution via crafted CSS (out-of-bounds writes/buffer overflow). Affected products include Firefox/Thund...

CVE-2006-4571

CVE-2006-4571 is evidenced in multiple Firefox/Thunderbird/SeaMonkey advisories as causing crashes and memory corruption, with potential for remote code execution. Affected: Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, SeaMonkey before 1.0.5. The issue is associated with JavaScript executi...

CVE-2006-5464

CVE-2006-5464 affects Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6. The issue, tied to the layout/processing path, allows remote attackers to cause a denial of service (crash) via unspecified vectors. Public advisories (Oracle/Linux/OpenVAS records) corroborate t...

CVE-2008-0304

CVE-2008-0304 is a heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.12 and SeaMonkey before 1.1.8, allowing remote code execution via a crafted external-body MIME type in an email. The root cause is an incorrect memory allocation during message preview, enabling an attacker to run a...

CVE-2008-2798

CVE-2008-2798 and related CVEs affected Mozilla Firefox (before 2.0.0.15), SeaMonkey (before 1.1.10), and Thunderbird (before 2.0.0.14), with issues in the layout/JavaScript processing that could crash the application and potentially allow arbitrary code execution via crafted content. The base vu...

CVE-2008-5021

The CVE-2008-5021 vulnerability affects Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13. It is caused by modifying properties of a file input element while it is still initializing, followed by using blur to access un...

CVE-2008-5506

CVE-2008-5506 affects Mozilla components (e.g., Firefox/Thunderbird/SeaMonkey) where an XMLHttpRequest to an attacker-controlled resource that performs a 302 redirect to a different domain can bypass same-origin policy, allowing reading of the redirected response. This can enable a remote attacke...

CVE-2009-1836

CVE-2009-1836: The vulnerability arises from how Mozilla Firefox (pre-3.0.11), Thunderbird (pre-2.0.0.22), and SeaMonkey (pre-1.1.17) use the HTTP Host header to determine the document context in a non-200 CONNECT response from a proxy. This can enable a man-in-the-middle attacker to modify the C...

CVE-2012-3957

Affected components: Mozilla Firefox before 15.0 (and Firefox ESR 10.x before 10.0.7), Thunderbird before 15.0 (and Thunderbird ESR 10.x before 10.0.7), SeaMonkey before 2.12.** Vulnerability and root cause: Heap-based buffer overflow in nsBlockFrame::MarkLineDirty, enabling remote code execution...

CVE-2012-4208

CVE-2012-4208 affects Mozilla Firefox ≤ prior to 17.0, Thunderbird ≤ prior to 17.0, and SeaMonkey ≤ 2.13/2.14. The XrayWrapper did not consider compartment during property filtering, allowing remote sites to bypass chrome-only restrictions on reading DOM object properties. Impact per description:...

CVE-2013-1685

CVE-2013-1685 is a use-after-free in nsIDocument::GetRootElement that affects Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7, allowing remote code execution or a heap memory corruption-based DoS via a crafted site. Co...

CVE-2013-1736

CVE-2013-1736 affects Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21. The vulnerability is due to improper establishment of parent-child relationships of range-request nodes in nsGfxScrollFrameInn...

CVE-2024-11159

CVE-2024-11159 : A vulnerability in Mozilla Thunderbird where using remote content in OpenPGP encrypted messages can disclose plaintext. Affected products include Thunderbird versions prior to 128.4.3 and prior to 132.0.1 (per multiple advisories). The root cause is exposure of OpenPGP ciphertext...

CVE-2026-0818

CVE-2026-0818 concerns Thunderbird where decrypting an inline OpenPGP message embedded in HTML/CSS could render in a context with outer email CSS, potentially enabling exfiltration of secret content if remote content is allowed. Affected versions: Thunderbird < 147.0.1 and Thunderbird

CVE-2026-12291

CVE-2026-12291 is a use‑after‑free defect in the Networking: HTTP component that affects Firefox and Thunderbird products. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. The CVSS 3.1 base score is 8.8 (HIGH) with network...

CVE-2026-6747

CVE-2026-6747 is a use-after-free vulnerability in the WebRTC component. Technical details across connected advisories show this affects Firefox/Firefox ESR and Thunderbird suites, with fixes applied in Firefox 150 and ESR 140.10, and in Thunderbird 150 (also 140.10). Remediation per the linked a...

CVE-2026-6767

CVE-2026-6767 is a vulnerability in the NSS Libraries component described as “Other issue in the Libraries component in NSS.” It is fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. The CVSS v3.1 base score is 5.3 (attack vector: network, attac...

CVE-2026-6772

CVE-2026-6772 affects the NSS Libraries component, specifically an incorrect boundary condition in NSS Libraries. The vulnerability is exploitable via network access with no user interaction and no privileges required, with a CVSS v3.1 base score of 7.5 (High). Affected products/contexts include ...

CVE-2026-6776

CVE-2026-6776 is a boundary-condition vulnerability in the WebRTC: Networking component that affected Firefox/Thunderbird, fixed in Firefox 150 (and ESR 140.10) and Thunderbird 150 (and ESR 140.10). The explicit issue is an incorrect boundary handling in the WebRTC Networking path, with CVSSv3.1 ...

CVE-2006-2781

CVE-2006-2781 describes a double-free vulnerability in nsVCard.cpp that affects Mozilla Thunderbird prior to 1.5.0.4 and SeaMonkey prior to 1.0.2 . An attacker could craft a VCard containing invalid base64 characters to trigger a vulnerability, potentially causing a denial of service (hang) and, ...

CVE-2006-3811

CVE-2006-3811 is a memory corruption crash vulnerability within Mozilla Firefox components (notably the Firefox 1.5.x line around the 1.5.0.5 release) and related Mozilla projects (SeaMonkey/Thunderbird in affected bundles). The issue manifests as crashes and is described as memory corruption tha...

CVE-2010-1202

CVE-2010-1202 affects Mozilla Firefox 3.5.x before 3.5.10, Firefox 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5. It is part of a set of vulnerabilities in the JavaScript engine/browser engine where memory corruption may lead to a crash or, potentially, arbitrary code e...

CVE-2011-3661

CVE-2011-3661 affects Mozilla’s YARR library used by Firefox 4.x–8.0, Thunderbird 5.0–8.0, and SeaMonkey before 2.6. A crafted JavaScript input could crash the application or, possibly, allow code execution. Connected updates indicate fixes were applied in SeaMonkey 2.6 and related Firefox/Thunde...

CVE-2013-0759

CVE-2013-0759 affects Mozilla Firefox (and related Mozilla components) prior to version 18.0, Firefox ESR prior to 10.0.12 and 17.0.2, Thunderbird prior to 17.0.2 and ESR prior to 10.0.12/17.0.2, and SeaMonkey prior to 2.15. The vulnerability allows remote attackers to spoof the address bar by ex...