1914 matches found
CVE-2006-1731
CVE-2006-1731 affects Mozilla Firefox/Thunderbird 1.x and related Mozilla suites; the flaw lets a remote attacker trigger XSS by valueOf.call/valueOf.apply with no args, returning the Object prototype instead of the global window. Impact is cross-site scripting; vendors released fixes in Firefox/...
CVE-2006-2787
CVE-2006-2787 affects Mozilla Firefox and Thunderbird prior to 1.5.0.4. The issue arises in EvalInSandbox, where JavaScript calling valueOf on objects created outside the sandbox can let remote attackers gain privileges. This is a sandbox-escape vulnerability with full confidentiality, integrity,...
CVE-2006-3806
CVE-2006-3806 refers to multiple integer overflows in the JavaScript engine affecting Mozilla Firefox (pre-1.5.0.5), Thunderbird (pre-1.5.0.5), and SeaMonkey (pre-1.0.3). The primary issues involve long strings in Object/Array/String.toSource and related string function arguments, with the potent...
CVE-2006-4567
CVE-2006-4567 affects Firefox < 1.5.0.7 and Thunderbird
CVE-2008-5503
CVE-2008-5503 affects Mozilla Firefox 2.x up to 2.0.0.19, Mozilla Thunderbird 2.x up to 2.0.0.19, and SeaMonkey 1.x up to 1.1.14. The vulnerability arises from the loadBindingDocument function failing to enforce same-domain policy checks, enabling remote attackers to read or access data from othe...
CVE-2009-1303
Affected products: Mozilla Firefox up to 3.0.8/3.0.9, Mozilla Thunderbird up to 2.0.0.21/22, and SeaMonkey up to 1.1.15/16. CVE-2009-1303 arises from nsSVGElement::BindToTree in the browser engine, allowing a remote attacker to trigger denial of service (application crash) and potentially memory ...
CVE-2010-0179
CVE-2010-0179 affects Mozilla Firefox (pre-3.0.19 and pre-3.5.8 in the 3.x line) and SeaMonkey (pre-2.0.3), where the Firebug add-on’s XMLHttpRequestSpy module can improperly interact with chrome-privileged objects. This leads to arbitrary JavaScript execution via a crafted HTTP response due to t...
CVE-2011-2984
CVE-2011-2984 affects Mozilla Firefox prior to 3.6.20, SeaMonkey 2.x, and Thunderbird 3.x prior to 3.1.12. The issue is a tab-dropping handling bug that lets a remote attacker load a content area, register for drop events, and execute arbitrary JavaScript with chrome privileges. Public summaries ...
CVE-2011-3660
CVE-2011-3660 concernsMozilla Firefox 4.x–8.0, Thunderbird 5.0–8.0, and SeaMonkey before 2.6, where multiple vulnerabilities in the browser engine enable remote denial of service or possibly arbitrary code execution via vectors that trigger a compartment mismatch in nsDOMMessageEvent::GetData and...
CVE-2017-7757
CVE-2017-7757 is a use-after-free vulnerability in IndexedDB that can occur when an IndexedDB object is destroyed while a method on it is executing, potentially causing a crash. Affected products include Firefox versions before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The issue a...
CVE-2026-16349
CVE-2026-16349 : Same-origin policy bypass in the DOM: Navigation component affects Mozilla Firefox and Firefox ESR. Root cause is a bypass vulnerability in the Navigation component that can impact confidentiality, integrity, and availability (CVSS v3.1: 9.8, high) with network attack vector and ...
CVE-2026-6767
CVE-2026-6767 is a vulnerability in the NSS Libraries component described as “Other issue in the Libraries component in NSS.” It is fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. The CVSS v3.1 base score is 5.3 (attack vector: network, attac...
CVE-2026-6772
CVE-2026-6772 affects the NSS Libraries component, specifically an incorrect boundary condition in NSS Libraries. The vulnerability is exploitable via network access with no user interaction and no privileges required, with a CVSS v3.1 base score of 7.5 (High). Affected products/contexts include ...
CVE-2026-6776
CVE-2026-6776 is a boundary-condition vulnerability in the WebRTC: Networking component that affected Firefox/Thunderbird, fixed in Firefox 150 (and ESR 140.10) and Thunderbird 150 (and ESR 140.10). The explicit issue is an incorrect boundary handling in the WebRTC Networking path, with CVSSv3.1 ...
CVE-2006-2786
CVE-2006-2786 is an HTTP response smuggling vulnerability affecting Mozilla Firefox and Thunderbird prior to 1.5.0.4. According to connected advisories, an attacker could craft responses that a proxy or header formatting could fool the client into treating as responses from two different sites, p...
CVE-2008-5507
CVE-2008-5507 affects Mozilla products: Firefox 2.x before 2.0.0.19, Firefox 3.x before 3.0.5, SeaMonkey 1.x before 1.1.14, and Thunderbird 2.x before 2.0.0.19. Root cause: bypass of the same-origin policy via a JavaScript URL that redirects to a target resource, triggering an error if the target...
CVE-2026-12295
CVE-2026-12295 describes a sandbox escape in the DOM: Navigation component affecting Mozilla Firefox and Thunderbird. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. The entry lists a CVSS v3.1 base score of 9.6 (CRITICAL...
CVE-2006-3810
CVE-2006-3810 is an XSS vulnerability in Mozilla Firefox 1.5 before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 that can be exploited via the XPCNativeWrapper(window).Function construct to inject arbitrary web script/HTML. The issue is triggered by cross-site scripting when a ...
CVE-2006-6497
CVE-2006-6497 affects Mozilla Firefox 2.x (before 2.0.0.1) and Firefox 1.5.x (before 1.5.0.9), SeaMonkey before 1.0.7, and Thunderbird before 1.5.0.9. The issue, along with related flaws (CVE-2006-6498, CVE-2006-6499, CVE-2006-6501–CVE-2006-6505), enables memory corruption and crashes and can pot...
CVE-2006-6503
CVE-2006-6503: Affected Mozilla Firefox 2.x before 2.0.0.1, Mozilla Firefox 1.5.x before 1.5.0.9, Mozilla Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7. The issue allows bypassing cross-site scripting (XSS) protection by changing the src attribute of an IMG element to a javascript: URI. ...
CVE-2007-4841
CVE-2007-4841 affects Mozilla Firefox (before 2.0.0.8), Mozilla Thunderbird (before 2.0.0.8), and SeaMonkey (before 1.1.5). The vulnerability permits remote command execution via (1) mailto, (2) nntp, (3) news, or (4) snews URIs that use invalid percent encoding, tied to improper file-type handli...
CVE-2008-1380
CVE-2008-1380 is described in the provided materials as a vulnerability in the processing of malformed JavaScript content that could crash the SeaMonkey web browser and potentially allow arbitrary code execution when JavaScript is enabled. Red Hat Oracle Linux advisories (e.g., RHSA-2008-0223, EL...
CVE-2009-1833
CVE-2009-1833 affects Mozilla Firefox <= 3.0.10 (before 3.0.11), Mozilla Thunderbird <= 2.0.0.21 (before 2.0.0.22), and SeaMonkey
CVE-2011-2988
CVE-2011-2988 describes a buffer overrun in an unspecified string class used by the WebGL shader implementation in Mozilla Firefox (4.x–5), SeaMonkey (2.x before 2.3), and Thunderbird before 6. The vulnerability can be triggered by a long shader source block, potentially allowing remote code exec...
CVE-2012-3962
CVE-2012-3962 affects Mozilla Firefox before 15.0, Firefox ESR before 10.0.7, Thunderbird before 15.0, Thunderbird ESR before 10.0.7, and SeaMonkey before 2.12. The issue is a failure to properly iterate through characters in a text run, enabling remote code execution via a crafted document. The ...
CVE-2025-4092
The CVE-2025-4092 entry concerns memory safety bugs in Mozilla Firefox 137/Thunderbird 137 that reportedly could be exploited to execute arbitrary code. Affected products are Firefox and Thunderbird versions before 138. Root cause is memory safety/memory corruption in the browser components; Mozi...
CVE-2026-0818
CVE-2026-0818 concerns Thunderbird where decrypting an inline OpenPGP message embedded in HTML/CSS could render in a context with outer email CSS, potentially enabling exfiltration of secret content if remote content is allowed. Affected versions: Thunderbird < 147.0.1 and Thunderbird
CVE-2026-12291
CVE-2026-12291 is a use‑after‑free defect in the Networking: HTTP component that affects Firefox and Thunderbird products. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. The CVSS 3.1 base score is 8.8 (HIGH) with network...
CVE-2006-2776
CVE-2006-2776 affects Mozilla Firefox and Thunderbird prior to 1.5.0.4. Privileged UI code calls content-defined setters on an object prototype, enabling remote code execution at higher privileges. Impact is remote code execution with web content privileges; mitigation is upgrading Firefox/Thunde...
CVE-2006-3802
CVE-2006-3802 affects Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3. The issue is that remote attackers can hijack native DOM methods from objects in another domain to conduct cross-site scripting (XSS) attacks using DOM methods of the top-level object. Th...
CVE-2007-5340
CVE-2007-5340 is part of multiple vulnerabilities in the Javascript engine of Mozilla Firefox (<2.0.0.8), Thunderbird (<2.0.0.8), and SeaMonkey (
CVE-2009-2462
CVE-2009-2462 affects Mozilla Firefox before 3.0.12 (and Thunderbird) with memory corruption/DoS or potentially arbitrary code execution via multiple rendering/DOM and CSS-related vectors. The connected MiracleLinux advisories reference Firefox 3.0.12 as the fixed version for AXSA:2009-364/365, i...
CVE-2010-3777
CVE-2010-3777 is an unspecified vulnerability in Mozilla Firefox 3.6.x before 3.6.13 and Thunderbird 3.1.x before 3.1.7 that allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Connected advisories ...
CVE-2017-7845
CVE-2017-7845 is a concrete vulnerability: a buffer overflow in ANGLE’s Direct3D 9 path used for WebGL rendering can crash the process. It affects Windows, and is listed against Thunderbird < 52.5.2, Firefox ESR < 52.5.2, and Firefox
CVE-2025-8030
CVE-2025-8030 is publicly known and tied to an insufficent escaping in the “Copy as cURL” feature that could lead to code execution. The connected Astra Linux and Amazon/Linux advisories confirm the issue affects Firefox and Thunderbird across multiple tracks (e.g., Firefox < 141, Firefox ESR ...
CVE-2005-2261
CVE-2005-2261 affects multiple browsers: Firefox <1.0.5, Thunderbird <1.0.5, Mozilla
CVE-2006-5748
CVE-2006-5748 involves memory-corruption flaws in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, potentially causing a crash or arbitrary code execution via unspecified vectors. The connected advisories confirm these products and versions are affected and ...
CVE-2008-2811
The CVE-2008-2811 issue affects Mozilla components (Firefox <2.0.0.15, Thunderbird ≤2.0.0.14, SeaMonkey
CVE-2008-5508
CVE-2008-5508 affects Mozilla Firefox (3.x prior to 3.0.5 and 2.x prior to 2.0.0.19), Mozilla Thunderbird (2.x prior to 2.0.0.19), and SeaMonkey (1.x prior to 1.1.14). The issue stems from improper parsing of URLs that start with leading whitespace or control characters, which can allow a remote ...
CVE-2008-5510
CVE-2008-5510 concerns the CSS parser in Mozilla Firefox (3.x up to 3.0.5 and 2.x up to 2.0.0.19), Thunderbird 2.x up to 2.0.0.19, and SeaMonkey 1.x up to 1.1.14, where the escaped null character (\0) is ignored, potentially allowing remote attackers to bypass sanitization protections. The descri...
CVE-2008-5513
CVE-2008-5513 affects Mozilla Firefox. The issue arises in the session-restore feature, where restoration of SessionStore data can bypass the Same Origin Policy, enabling content injection and cross-site scripting (XSS) via unknown vectors. Affected products/versions include Firefox 3.x prior to ...
CVE-2009-1305
CVE-2009-1305 is a vulnerability in the JavaScript engine of Mozilla Firefox (and affected Thunderbird/SeaMonkey) prior to version 3.0.9. It allows remote attackers to cause a denial of service (application crash) and potentially memory corruption via vectors involving JSOP_DEFVAR and properties ...
CVE-2011-2378
CVE-2011-2378 affects Mozilla Firefox before 3.6.20, Thunderbird 3.x before 3.1.12, SeaMonkey 2.x (and possibly other products). The root cause is improper handling of DOM objects in appendChild, allowing remote attackers to execute arbitrary code via vectors leading to a dangling pointer. Impact...
CVE-2012-5840
CVE-2012-5840 is a Use-after-free vulnerability in Mozilla Firefox’s nsTextEditorState::PrepareEditor, affecting Firefox prior to 17.0, Firefox ESR 10.x prior to 10.0.11, Thunderbird prior to 17.0, Thunderbird ESR 10.x prior to 10.0.11, and SeaMonkey prior to 2.14. The flaw allows remote attacker...
CVE-2026-6766
CVE-2026-6766 affects NSS Libraries component. The issue is incorrect boundary conditions in NSS, with fixes landed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Affected platforms include Firefox/Thunderbird releases; remediation is upgrading to the indicated versi...
CVE-2026-6786
CVE-2026-6786 refers to memory-safety bugs in Mozilla products (Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149, Thunderbird 149) with evidence of memory corruption. The description notes that some bugs could be exploited to run arbitrary code, and the fixes are implemented in Firefox 150, ...
CVE-2026-8091
CVE-2026-8091 affects Mozilla Audio/Video: Playback with an incorrect boundary condition in the component. It is fixed by updating to Firefox 150, Thunderbird 150, and Firefox ESR 140.10.1 (and 140.10.2 per ESR updates) as well as Firefox ESR 115.35.2. Connected disclosures corroborate this is a ...
CVE-2006-1732
Technical details (affected products, root cause, and exploit specifics) for CVE-2006-1732 are not provided in the supplied documents. Monitor for updates from official advisories.
CVE-2006-3807
CVE-2006-3807 describes a privilege-escalation vulnerability in Mozilla Firefox (pre-1.5.0.5), Thunderbird (pre-1.5.0.5), and SeaMonkey (pre-1.0.3). The issue arises when the standard Object() constructor is redefined by script, allowing named JavaScript functions to reference a privileged parent...