CVE-2004-0765

The CVE-2004-0765 entry affects Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, where cert_TestHostName only validates the hostname portion of a certificate when the URI hostname is not an FQDN. This allows remote attackers to spoof trusted certificates. Root cause: certificat...

CVE-2006-0749

CVE-2006-0749 affects Mozilla Firefox and Thunderbird (Firefox/Thunderbird 1.x before 1.5 and Mozilla Suite before 1.7.13; SeaMonkey before 1.0.8). The issue is a memory corruption triggered by a particular sequence of HTML tags, leading to memory corruption, a remote crash, and possibly arbitrar...

CVE-2006-2775

The CVE-2006-2775 issue affects Mozilla Firefox and Thunderbird prior to 1.5.0.4. It arises from XUL attribute handling that can be associated with an incorrect URL under certain conditions, potentially letting a persisted string be linked to the wrong URL and thereby bypass restrictions. The fla...

CVE-2006-3113

CVE-2006-3113 affects Mozilla Firefox

CVE-2006-6499

The CVE-2006-6499 entry concerns Mozilla Firefox 2.x before 2.0.0.1, Firefox 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7. The vulnerability is a memory overwrite that occurs when floating-point precision is reduced, rather than exiting safely. This can allow remot...

CVE-2007-2867

CVE-2007-2867 involves multiple Mozilla components (Firefox 1.5.x before 1.5.0.12 and Firefox 2.x before 2.0.0.4, Thunderbird 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, SeaMonkey 1.0.9 and 1.1.2). The issue is described as memory-related vulnerabilities (dangling pointers, heap corruption, sig...

CVE-2008-4062

Summary: CVE-2008-4062 covers multiple /unspecified / vulnerabilities in Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12). The flaws involve the JavaScript engine and are triggered by vectors related to (1) misinterpretation of N...

CVE-2009-1840

CVE-2009-1840 affects Mozilla Firefox (before 3.0.11), Thunderbird and SeaMonkey, where content policy checks were not performed before loading a script file into a XUL document. This allowed a crafted HTML document (e.g., via a web bug in email or a web page/ad) to bypass intended access restric...

CVE-2010-2763

CVE-2010-2763 concerns the XPCSafeJSObjectWrapper (SJOW) in Mozilla’s Firefox/XULRunner implementation. The connected documents confirm a logical error in the SJOW scripted function handling on the Mozilla 1.9.1 development branch, allowing a caller to execute a function in the context of another...

CVE-2011-0061

CVE-2011-0061 affects Mozilla Firefox 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12. The vulnerability is a buffer overflow triggered by a crafted JPEG image, enabling remote attackers to execute arbitrary code or cause a denial of service (application crash). MITRE/O...

CVE-2011-2375

CVE-2011-2375 is a set of multiple unspecified vulnerabilities in the Mozilla Firefox browser engine, affecting Firefox before 5.0 and Thunderbird through 3.1.11 . Exploitation could cause memory corruption and a crash, with a possible remote code execution via unknown vectors. The connected Mira...

CVE-2012-5839

CVE-2012-5839 is a heap-based buffer overflow in Mozilla's gfxShapedWord::CompressedGlyph::IsClusterStart that affects Firefox and related Mozilla components. Affected software includes Mozilla Firefox before 17.0 (and ESR 10.x before 10.0.11), Thunderbird before 17.0 (and ESR 10.x before 10.0.11...

CVE-2013-5600

CVE-2013-5600 is a use-after-free in Mozilla projects where the nsIOService::NewChannelFromURIWithProxyFlags function can be exploited via blob: URLs to execute arbitrary code. Affected packages/versions include Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbir...

CVE-2013-5601

CVE-2013-5601 is a use-after-free in Mozilla Firefox’s nsEventListenerManager::SetEventHandler that could allow remote code execution. Affected products and versions include Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1 and ESR 17.x before 17.0...

CVE-2025-9185

CVE-2025-9185 is a memory-safety issue affecting Firefox and Thunderbird components across Firefox/Thunderbird releases up to version 142 (Firefox <142, ESR <115.27/128.14/140.2; Thunderbird

CVE-2004-0904

CVE-2004-0904 : Integer overflow in the BMP decoder can trigger heap-based buffer overflows, enabling remote code execution. Affected products are Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8. Remediation is to apply fixes/updates released after the...

CVE-2005-2353

CVE-2005-2353 affects Mozilla Thunderbird. The advisory notes that the script run-mozilla.sh, when Thunderbird is built with debugging enabled, can be exploited by local users to create or overwrite arbitrary files via a symlink attack on temporary files. Debian security notices (DSA-1046/DSA-105...

CVE-2006-1724

CVE-2006-1724 affects Firefox and Thunderbird before 1.5.0.2, 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1. It is an unspecified vulnerability related to DHTML that can cause a denial of service (crash) and possibly remote code execution. The initial document does n...

CVE-2008-5024

CVE-2008-5024 concerns Mozilla Firefox 3.x prior to 3.0.4, Firefox 2.x prior to 2.0.0.18, Thunderbird 2.x prior to 2.0.0.18, and SeaMonkey 1.x prior to 1.1.13. The issue arises from improper escaping of quote characters in XML processing via E4X (default namespace), enabling remote XML injection....

CVE-2009-0353

CVE-2009-0353 affects Mozilla components: Firefox 3.x before 3.0.6, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15. The vulnerability is related to the JavaScript engine and can allow a remote attacker to cause memory corruption and an application crash, potentially leading to arbitrary...

CVE-2012-1948

CVE-2012-1948 is a member of a set of vulnerabilities in the Mozilla browser engine affecting Mozilla Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11. The issue enables remote attackers to cause a denial of serv...

CVE-2012-4184

CVE-2012-4184 affects Mozilla's COW in Firefox (and related Mozilla products) prior to version 16.0 (Firefox), ESR 10.x prior to 10.0.8, Thunderbird prior to 16.0, Thunderbird ESR 10.x prior to 10.0.8, and SeaMonkey prior to 2.13. The issue allows a crafted web site to bypass restrictions and acc...

CVE-2012-4193

CVE-2012-4193 affects Mozilla Firefox and related Mozilla products (Firefox before 16.0.1, Firefox ESR before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR before 10.0.9, SeaMonkey before 2.13.1). Root cause: a security check in the defaultValue unwrapping of security wrappers is omitted, al...

CVE-2025-8030

CVE-2025-8030 is publicly known and tied to an insufficent escaping in the “Copy as cURL” feature that could lead to code execution. The connected Astra Linux and Amazon/Linux advisories confirm the issue affects Firefox and Thunderbird across multiple tracks (e.g., Firefox < 141, Firefox ESR ...

CVE-2026-2757

CVE-2026-2757 (FF/Thunderbird) is confirmed with root cause: incorrect boundary conditions in the WebRTC: Audio/Video component, fixed in Firefox 148, Firefox ESR 115.33/140.8 ESR, Thunderbird 148/140.8. Affected products explicitly include Firefox and Thunderbird lines in multiple advisories (AL...

CVE-2026-6786

CVE-2026-6786 refers to memory-safety bugs in Mozilla products (Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149, Thunderbird 149) with evidence of memory corruption. The description notes that some bugs could be exploited to run arbitrary code, and the fixes are implemented in Firefox 150, ...

CVE-2006-6505

CVE-2006-6505 involves multiple heap-based buffer overflows in Mozilla Thunderbird (before 1.5.0.9) and SeaMonkey (before 1.0.7). The vulnerability stems from parsing mail headers: (1) external message modies with long Content-Type headers and (2) long RFC2047-encoded (MIME non-ASCII) headers, en...

CVE-2009-2464

The CVE-2009-2464 issue affects Mozilla Firefox before 3.0.12, SeaMonkey 2.0a1pre, and Thunderbird, where nsXULTemplateQueryProcessorRDF::CheckIsSeparator can be exploited via loading multiple RDF files in a XUL tree to cause memory corruption and potential code execution, leading to DoS or crash...

CVE-2012-0457

CVE-2012-0457 is a use-after-free in the Firefox DOM/SVG handling: the nsSMILTimeValueSpec::ConvertBetweenTimeContainer path can be triggered via SVG animations to allow remote code execution. Affected products and versions per sources include Mozilla Firefox before 3.6.28 and 4.x through 10.0, F...

CVE-2012-1942

CVE-2012-1942 affects Mozilla Firefox 12.0, Thunderbird 12.0 and SeaMonkey 2.9 on Windows. The root cause is the Mozilla/Windows Updater Service loading a DLL in a privileged context, enabling a local user to gain privileges by placing a malicious DLL in a privileged path before updater execution...

CVE-2012-3963

CVE-2012-3963 is a Use-after-free in Mozilla Firefox's js::gc::MapAllocToTraceKind that can allow remote code execution. Affected: Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, SeaMonkey before 2.12. Mitigation: upgrade to Firefo...

CVE-2013-1672

CVE-2013-1672 affects Mozilla Firefox on Windows (and related Thunderbird/ESR components) where the Mozilla Maintenance Service can be exploited to bypass integrity verification and escalate privileges. The issue is tied to local privilege escalation via manipulation of data passed to the mainten...

CVE-2005-0255

CVE-2005-0255 affects Mozilla Suite 1.7.3, Firefox 1.0, and Thunderbird before 1.0.2. The flaw is in string handling (nsTSubstring_CharT::Replace) where return values of functions that resize strings are not properly checked, which can lead to a reallocation failure and a pointer to a fixed addre...

CVE-2006-0884

CVE-2006-0884 affects Mozilla Thunderbird’s WYSIWYG editor (the rich mail composer) where an e-mail containing a JavaScript URI in the SRC attribute of an IFRAME can be executed when the user edits the message. The vulnerability enables user-assisted attackers to bypass JavaScript security settin...

CVE-2006-4566

CVE-2006-4566 is a heap corruption vulnerability in Mozilla family browsers caused by parsing a malformed JavaScript regular expression that ends with a backslash () in an unterminated character class (e.g., []). It affects Mozilla Firefox, Thunderbird, and SeaMonkey as listed in connected adviso...

CVE-2008-1235

CVE-2008-1235 affects Mozilla Firefox <2.0.0.13, Thunderbird <2.0.0.13, and SeaMonkey

CVE-2008-4065

CVE-2008-4065 affects Mozilla Firefox (≤2.0.0.16, and ≤3.0.1/3.0.x before 3.0.2), Thunderbird (≤2.0.0.16), and SeaMonkey (≤1.1.11) with a BOM-based stripping issue that can bypass cross‑site scripting (XSS) protections. The root cause is removal of Stripped BOM characters from JavaScript code pri...

CVE-2008-4068

CVE-2008-4068 is a directory-traversal vulnerability in Mozilla Firefox (pre-2.0.0.17 and 3.x pre-3.0.2), Thunderbird (pre-2.0.0.17), and SeaMonkey (pre-1.1.12) triggered by crafted resource: URIs. The flaw lets remote attackers bypass local HTML restrictions, read sensitive information, and prom...

CVE-2010-3778

The CVE-2010-3778 issue affects Mozilla Firefox 3.5.x before 3.5.16 , Thunderbird before 3.0.11 , and SeaMonkey before 2.0.11 . It is described as an unspecified vulnerability allowing remote attackers to cause memory corruption and an application crash, potentially enabling arbitrary code execut...

CVE-2011-3647

CVE-2011-3647 affects Mozilla Firefox pre-3.6.24 and Thunderbird pre-3.1.6. The vulnerability arises from how the JSSubScriptLoader handles XPCNativeWrappers when calling loadSubScript in add-ons, enabling privilege escalation via a crafted web site that exploits unwrapping behavior. Related to C...

CVE-2012-4179

CVE-2012-4179 is a use-after-free in Mozilla Firefox's nsHTMLCSSUtils::CreateCSSPropertyTxn that can lead to code execution or heap memory corruption. Affected are Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey befor...

CVE-2012-4183

CVE-2012-4183 is a use-after-free in DOMSVGTests::GetRequiredFeatures affecting Firefox before 16.0, Firefox ESR before 10.0.8, Thunderbird before 16.0, and SeaMonkey before 2.13, with potential for remote code execution or a denial of service via heap memory corruption. Connected advisories from...

CVE-2025-4092

The CVE-2025-4092 entry concerns memory safety bugs in Mozilla Firefox 137/Thunderbird 137 that reportedly could be exploited to execute arbitrary code. Affected products are Firefox and Thunderbird versions before 138. Root cause is memory safety/memory corruption in the browser components; Mozi...

CVE-2026-6772

CVE-2026-6772 affects the NSS Libraries component, specifically an incorrect boundary condition in NSS Libraries. The vulnerability is exploitable via network access with no user interaction and no privileges required, with a CVSS v3.1 base score of 7.5 (High). Affected products/contexts include ...

CVE-2006-2780

The CVE-2006-2780 entry affects Mozilla Firefox and Thunderbird prior to 1.5.0.4. The issue is an integer overflow in the jsstr tagify path, leading to memory corruption that can cause a remote denial of service (crash) and possibly arbitrary code execution. The vulnerability is assessed with a h...

CVE-2009-1304

CVE-2009-1304 affects the JavaScript engine in Mozilla Firefox 3.x prior to 3.0.9, Thunderbird prior to 2.0.0.22, and SeaMonkey prior to 1.1.16. The vulnerability arises from the engine’s handling of (1) js_FindPropertyHelper (related to Math and Date) and (2) js_CheckRedeclaration, enabling remo...

CVE-2025-8027

CVE-2025-8027 describes a 64-bit value handling bug in the Firefox/Thunderbird JavaScript engines: on 64-bit platforms IonMonkey-JIT writes only 32 bits of a 64-bit return value to the stack, while Baseline-JIT reads all 64 bits. This can disclose or mishandle information in the return value spac...

CVE-2025-8037

CVE-2025-8037 affects Mozilla Firefox (and Thunderbird) browsers when a nameless cookie value contains an equals sign, shadowing other cookies. Affected: Firefox <141, Firefox ESR <140.1, Thunderbird <141, Thunderbird

CVE-2006-1045

The CVE affects Mozilla Thunderbird 1.5. When Block loading of remote images in mail messages is enabled, Thunderbird’s HTML rendering engine does not fully block external images in inline HTML attachments. This could allow a remote attacker to obtain sensitive information (e.g., application vers...

CVE-2006-3804

The CVE-2006-3804 entry describes a heap-based buffer overflow in Mozilla Thunderbird prior to 1.5.0.5 and SeaMonkey prior to 1.0.3 triggered by a VCard attachment with a malformed base64 field, due to an integer underflow, leading to a remote denial of service (crash). The vulnerability affects ...