CVE-2009-2210

CVE-2009-2210 affects Mozilla Thunderbird before 2.0.0.22 and SeaMonkey before 1.1.17. It allows a remote attacker to cause a denial of service (application crash) or potentially execute arbitrary code via a multipart/alternative e‑mail message containing a text/enhanced part that triggers access...

CVE-2010-0175

CVE-2010-0175 is a use-after-free in the nsTreeSelection code path for XUL tree items, affecting Mozilla Firefox before 3.0.19 and 3.5.x before 3.5.9, Thunderbird before 3.0.4, and SeaMonkey before 2.0.4. Exploitation could allow remote code execution or cause a crash via triggering the select ev...

CVE-2010-2763

CVE-2010-2763 concerns the XPCSafeJSObjectWrapper (SJOW) in Mozilla’s Firefox/XULRunner implementation. The connected documents confirm a logical error in the SJOW scripted function handling on the Mozilla 1.9.1 development branch, allowing a caller to execute a function in the context of another...

CVE-2011-2364

CVE-2011-2364 relates to an unspecified vulnerability in the browser engine of Mozilla Firefox 3.6.x before 3.6.18 and Thunderbird before 3.1.11. The issue can cause a denial of service via memory corruption and may allow arbitrary code execution. Affected products are Firefox up to 3.6.17 and Th...

CVE-2011-2365

CVE-2011-2365 involves an unspecified vulnerability in the browser engine of Mozilla Firefox 3.6.x (pre-3.6.18) and Thunderbird before 3.1.11. Exploitation could cause a denial of service (memory corruption and application crash) or, in some cases, allow arbitrary code execution via unknown vecto...

CVE-2011-2375

CVE-2011-2375 is a set of multiple unspecified vulnerabilities in the Mozilla Firefox browser engine, affecting Firefox before 5.0 and Thunderbird through 3.1.11 . Exploitation could cause memory corruption and a crash, with a possible remote code execution via unknown vectors. The connected Mira...

CVE-2012-0468

CVE-2012-0468 affects Mozilla Firefox 4.x–11.0, Thunderbird 5.0–11.0, and SeaMonkey before 2.9. The browser engine’s vulnerability is tied to vectors related to jsval.h and the js::array_shift function, leading to a potential denial of service (assertion failure and memory corruption) and possibl...

CVE-2012-5835

CVE-2012-5835 describes an integer overflow in the WebGL subsystem of Mozilla Firefox prior to 17.0 (also affecting Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0 and Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14). The overflow can lead to remote code execution or a den...

CVE-2025-9185

CVE-2025-9185 is a memory-safety issue affecting Firefox and Thunderbird components across Firefox/Thunderbird releases up to version 142 (Firefox <142, ESR <115.27/128.14/140.2; Thunderbird

CVE-2026-0818

CVE-2026-0818 concerns Thunderbird where decrypting an inline OpenPGP message embedded in HTML/CSS could render in a context with outer email CSS, potentially enabling exfiltration of secret content if remote content is allowed. Affected versions: Thunderbird < 147.0.1 and Thunderbird

CVE-2006-1736

Technical details (affected product/version/root cause/impact) are not publicly provided in the connected documents. Monitor for updates.

CVE-2008-1237

CVE-2008-1237 affects SeaMonkey before 1.1.9 (and related Mozilla components) per the description: multiple vulnerabilities in the JavaScript engine could allow a remote attacker to cause a crash and potentially execute arbitrary code. Connected Nessus/NASA text confirms SeaMonkey, Firefox, and T...

CVE-2008-4058

CVE-2008-4058 affects Mozilla-based products (Firefox, SeaMonkey, Thunderbird) where XPConnect could be abused to pollute XPCNativeWrappers via chrome XBL/chrome JS, enabling remote arbitrary-code execution with chrome privileges. Publicly documented affected ranges include Firefox before 2.0.0.1...

CVE-2009-0353

CVE-2009-0353 affects Mozilla components: Firefox 3.x before 3.0.6, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15. The vulnerability is related to the JavaScript engine and can allow a remote attacker to cause memory corruption and an application crash, potentially leading to arbitrary...

CVE-2009-2466

The CVE-2009-2466 issue affects Mozilla Firefox (and Thunderbird) up to version prior to 3.0.12, where the JavaScript engine can be abused to cause memory corruption, a crash, or potentially arbitrary code execution. The described vectors involve the engine internals in nsDOMClassInfo.cpp, JS_Has...

CVE-2011-0062

This CVE (CVE-2011-0062) affects Mozilla Firefox 3.6.x before 3.6.14 and Thunderbird 3.1.x before 3.1.8, per the Initial Description. It arises from multiple unspecified vulnerabilities in the browser engine that can cause memory corruption and application crash (DoS) or potentially allow arbitra...

CVE-2011-2983

CVE-2011-2983 affects Mozilla Firefox before 3.6.20, Thunderbird 2.x and 3.x before 3.1.12, SeaMonkey 1.x and 2.x. Root cause: improper handling of RegExp.input, which can bypass the Same Origin Policy and allow reading data from a different domain via a crafted page (potential use-after-free). E...

CVE-2012-0462

CVE-2012-0462 describes multiple unspecified vulnerabilities in Mozilla Firefox’s browser engine (Firefox 4.x–10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0–10.0, Thunderbird ESR 10.x before 10.0.3, SeaMonkey before 2.8) that can cause denial of service (memory corruption and crash) or pos...

CVE-2012-1948

CVE-2012-1948 is a member of a set of vulnerabilities in the Mozilla browser engine affecting Mozilla Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11. The issue enables remote attackers to cause a denial of serv...

CVE-2012-5839

CVE-2012-5839 is a heap-based buffer overflow in Mozilla's gfxShapedWord::CompressedGlyph::IsClusterStart that affects Firefox and related Mozilla components. Affected software includes Mozilla Firefox before 17.0 (and ESR 10.x before 10.0.11), Thunderbird before 17.0 (and ESR 10.x before 10.0.11...

CVE-2013-1707

CVE-2013-1707 is a stack-based buffer overflow in Mozilla Updater used by Mozilla Maintenance Service, enabling local privilege escalation via a long pathname on the command line. Affected products/versions include Mozilla Firefox up to version 23.0 (and ESR), Thunderbird up to 17.0.8, with corre...

CVE-2025-5262

CVE-2025-5262: A double-free in vpx_codec_enc_init_multi after a failed allocation during WebRTC encoder initialization can cause memory corruption and a potentially exploitable crash. Affected: Thunderbird < 139 and Thunderbird

CVE-2006-0749

CVE-2006-0749 affects Mozilla Firefox and Thunderbird (Firefox/Thunderbird 1.x before 1.5 and Mozilla Suite before 1.7.13; SeaMonkey before 1.0.8). The issue is a memory corruption triggered by a particular sequence of HTML tags, leading to memory corruption, a remote crash, and possibly arbitrar...

CVE-2008-1236

CVE-2008-1236 affects Mozilla Firefox (before 2.0.0.13), Mozilla Thunderbird (before 2.0.0.13), and SeaMonkey (before 1.1.9). The issue stems from memory-related vulnerabilities in the layout/web content processing, described as memory corruption via layout-engine interactions, allowing a remote ...

CVE-2008-5024

CVE-2008-5024 concerns Mozilla Firefox 3.x prior to 3.0.4, Firefox 2.x prior to 2.0.0.18, Thunderbird 2.x prior to 2.0.0.18, and SeaMonkey 1.x prior to 1.1.13. The issue arises from improper escaping of quote characters in XML processing via E4X (default namespace), enabling remote XML injection....

CVE-2009-2464

The CVE-2009-2464 issue affects Mozilla Firefox before 3.0.12, SeaMonkey 2.0a1pre, and Thunderbird, where nsXULTemplateQueryProcessorRDF::CheckIsSeparator can be exploited via loading multiple RDF files in a XUL tree to cause memory corruption and potential code execution, leading to DoS or crash...

CVE-2012-4184

CVE-2012-4184 affects Mozilla's COW in Firefox (and related Mozilla products) prior to version 16.0 (Firefox), ESR 10.x prior to 10.0.8, Thunderbird prior to 16.0, Thunderbird ESR 10.x prior to 10.0.8, and SeaMonkey prior to 2.13. The issue allows a crafted web site to bypass restrictions and acc...

CVE-2012-4193

CVE-2012-4193 affects Mozilla Firefox and related Mozilla products (Firefox before 16.0.1, Firefox ESR before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR before 10.0.9, SeaMonkey before 2.13.1). Root cause: a security check in the defaultValue unwrapping of security wrappers is omitted, al...

CVE-2012-4196

CVE-2012-4196 affects Mozilla Firefox (and related Mozilla components) where a prototype property-injection attack on the Location object (window.location) bypassed Same Origin Policy. Affected are Firefox prior to 16.0.2, Firefox ESR 10.x prior to 10.0.10, Thunderbird prior to 16.0.2, Thunderbir...

CVE-2013-5601

CVE-2013-5601 is a use-after-free in Mozilla Firefox’s nsEventListenerManager::SetEventHandler that could allow remote code execution. Affected products and versions include Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1 and ESR 17.x before 17.0...

CVE-2018-18513

CVE-2018-18513 is a Firefox/Thunderbird vulnerability where a crash can occur while processing a crafted S/MIME message or an XPI package with a crafted signature, allowing a denial-of-service attack as Thunderbird reopens the last seen message on restart and re-triggers the crash. Affected produ...

CVE-2025-1942

The CVE-2025-1942 vulnerability affects Mozilla Firefox (<136) and Mozilla Thunderbird (

CVE-2025-4082

CVE-2025-4082 affects Thunderbird for macOS. It describes memory corruption in WebGL shader attributes that can trigger an out-of-bounds read, with potential for privilege escalation when combined with other issues. The vulnerability applies to Thunderbird versions before 138 and 128.10 (and to F...

CVE-2025-4084

CVE-2025-4084 concerns Firefox products. The issue arises from insufficient escaping of special characters in the copy as cURL feature, which could mislead users into running a crafted command and potentially enable local code execution on Windows. Affected software includes Firefox for Windows, ...

CVE-2025-8029

CVE-2025-8029: Thunderbird and Firefox products are affected by a vulnerability where javascript: URLs are executed when used inside object and embed tags. The impact list states affected versions include Firefox < 141 and Thunderbird < 141 (and ESR branches

CVE-2026-12295

CVE-2026-12295 describes a sandbox escape in the DOM: Navigation component affecting Mozilla Firefox and Thunderbird. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. The entry lists a CVSS v3.1 base score of 9.6 (CRITICAL...

CVE-2026-6770

CVE-2026-6770 concerns an issue in the Storage: IndexedDB component affecting Firefox and Thunderbird. The initial entry notes an “Other issue in the Storage: IndexedDB component” and states it was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Connected adviso...

CVE-2026-6777

CVE-2026-6777 is a general description of an issue in the Networking: DNS component, without explicit exploitation details. The connected advisories indicate a fix in Firefox 150 and Thunderbird 150, and Fedora advisories recommend updating NSS to 3.122.1 along with Firefox to 150.0. The ENISA/EU...

CVE-2006-2775

The CVE-2006-2775 issue affects Mozilla Firefox and Thunderbird prior to 1.5.0.4. It arises from XUL attribute handling that can be associated with an incorrect URL under certain conditions, potentially letting a persisted string be linked to the wrong URL and thereby bypass restrictions. The fla...

CVE-2006-3113

CVE-2006-3113 affects Mozilla Firefox

CVE-2006-6499

The CVE-2006-6499 entry concerns Mozilla Firefox 2.x before 2.0.0.1, Firefox 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7. The vulnerability is a memory overwrite that occurs when floating-point precision is reduced, rather than exiting safely. This can allow remot...

CVE-2008-0304

CVE-2008-0304 is a heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.12 and SeaMonkey before 1.1.8, allowing remote code execution via a crafted external-body MIME type in an email. The root cause is an incorrect memory allocation during message preview, enabling an attacker to run a...

CVE-2009-1304

CVE-2009-1304 affects the JavaScript engine in Mozilla Firefox 3.x prior to 3.0.9, Thunderbird prior to 2.0.0.22, and SeaMonkey prior to 1.1.16. The vulnerability arises from the engine’s handling of (1) js_FindPropertyHelper (related to Math and Date) and (2) js_CheckRedeclaration, enabling remo...

CVE-2012-1942

CVE-2012-1942 affects Mozilla Firefox 12.0, Thunderbird 12.0 and SeaMonkey 2.9 on Windows. The root cause is the Mozilla/Windows Updater Service loading a DLL in a privileged context, enabling a local user to gain privileges by placing a malicious DLL in a privileged path before updater execution...

CVE-2013-1719

CVE-2013-1719 affects Mozilla Firefox (<24.0), Thunderbird (<24.0), and SeaMonkey (

CVE-2025-8031

CVE-2025-8031 concerns a vulnerability where the username:password portion is not correctly stripped from URLs in CSP reports, potentially leaking HTTP Basic Authentication credentials. The CVE’s context across connected documents shows affected software including Firefox and Thunderbird variants...

CVE-2025-9181

CVE-2025-9181: Uninitialized memory in the JavaScript Engine is confirmed in connected documents affecting Firefox and Thunderbird branches prior to version 142 (and ESR branches prior to 128.14, 140.2 for ESR). The issue is a memory-safety bug in the JS engine; no exploitation details are provid...

CVE-2005-2353

CVE-2005-2353 affects Mozilla Thunderbird. The advisory notes that the script run-mozilla.sh, when Thunderbird is built with debugging enabled, can be exploited by local users to create or overwrite arbitrary files via a symlink attack on temporary files. Debian security notices (DSA-1046/DSA-105...

CVE-2007-2867

CVE-2007-2867 involves multiple Mozilla components (Firefox 1.5.x before 1.5.0.12 and Firefox 2.x before 2.0.0.4, Thunderbird 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, SeaMonkey 1.0.9 and 1.1.2). The issue is described as memory-related vulnerabilities (dangling pointers, heap corruption, sig...

CVE-2009-1840

CVE-2009-1840 affects Mozilla Firefox (before 3.0.11), Thunderbird and SeaMonkey, where content policy checks were not performed before loading a script file into a XUL document. This allowed a crafted HTML document (e.g., via a web bug in email or a web page/ad) to bypass intended access restric...