2028 matches found
CVE-2025-8029
Mozilla Thunderbird and Firefox (including ESR versions) are vulnerable to the execution of javascript: URLs when used within object and embed tags. This issue affects versions prior to Firefox 141 , Firefox ESR 128.13 , Firefox ESR 140.1 , Thunderbird 141 , Thunderbird 128.13 , and Thunderbird 1...
CVE-2025-8039
Mozilla Firefox , Firefox ESR , and the Thunderbird email client are affected by an information disclosure vulnerability where search terms persist in the URL bar even after navigating away from the search page. This exposure can allow an attacker to compromise the confidentiality and integrity o...
CVE-2025-9181
Mozilla Firefox and Thunderbird are affected by a vulnerability involving uninitialized memory in the JavaScript Engine component. Specifically, the issue relates to access to an uninitialized pointer , which could allow a malicious actor to compromise the confidentiality, integrity, and accessib...
CVE-2026-74940
CVE-2026-74940 is a use-after-free vulnerability in the Graphics: Text component of Mozilla Firefox and Thunderbird . It carries a CVSS 3.1 score of 9.8 (Critical) with a network attack vector requiring no privileges or user interaction. The Debian advisory notes that the vulnerability could pote...
CVE-2026-8949
An integer overflow exists in the Widget: Win32 component across several Mozilla products, including Firefox , Firefox ESR , and Thunderbird . This input validation error can lead to multiple impacts, including Arbitrary Code Execution (ACE) , Denial of Service (DoS) , Security Bypass (SB) , and ...
CVE-2005-2261
CVE-2005-2261 affects multiple browsers: Firefox <1.0.5, Thunderbird <1.0.5, Mozilla
CVE-2006-3802
CVE-2006-3802 affects Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3. The issue is that remote attackers can hijack native DOM methods from objects in another domain to conduct cross-site scripting (XSS) attacks using DOM methods of the top-level object. Th...
CVE-2006-3805
CVE-2006-3805 affects Mozilla Firefox (before 1.5.0.5), Thunderbird (before 1.5.0.5), and SeaMonkey (before 1.0.3). The issue stems from the JavaScript engine: a garbage-collection path could delete a temporary object still in use, potentially allowing arbitrary code execution. Public advisories ...
CVE-2008-5017
CVE-2008-5017 is an integer overflow in xpcom/io/nsEscape.cpp in the Mozilla browser engine. The vulnerability could allow a remote attacker to crash the affected application (DoS) via unspecified vectors in Mozilla Firefox 3.x prior to 3.0.4, Firefox 2.x prior to 2.0.0.18, Thunderbird 2.x prior ...
CVE-2009-3981
CVE-2009-3981 affects Mozilla Firefox before 3.0.16, SeaMonkey before 2.0.1, and Thunderbird. The issue is an unspecified remote vulnerability in the browser engine that can cause memory corruption, leading to a crash or potentially arbitrary code execution via unknown vectors, and can result in ...
CVE-2011-2378
CVE-2011-2378 affects Mozilla Firefox before 3.6.20, Thunderbird 3.x before 3.1.12, SeaMonkey 2.x (and possibly other products). The root cause is improper handling of DOM objects in appendChild, allowing remote attackers to execute arbitrary code via vectors leading to a dangling pointer. Impact...
CVE-2012-3968
CVE-2012-3968 is a use-after-free in Firefox’s WebGL implementation related to deletion of a fragment shader by its accessor. The issue allows remote attackers to execute arbitrary code via crafted web content. Affected products include Mozilla Firefox (and Firefox ESR 10.x lineage) prior to patc...
CVE-2012-5840
CVE-2012-5840 is a Use-after-free vulnerability in Mozilla Firefox’s nsTextEditorState::PrepareEditor, affecting Firefox prior to 17.0, Firefox ESR 10.x prior to 10.0.11, Thunderbird prior to 17.0, Thunderbird ESR 10.x prior to 10.0.11, and SeaMonkey prior to 2.14. The flaw allows remote attacker...
CVE-2025-9182
The Graphics: WebRender component in Mozilla Firefox , Firefox ESR , and Thunderbird is vulnerable to a denial-of-service (DoS) attack. The root cause is an out-of-memory condition, which may be triggered by improper resource cleanup or release. This vulnerability allows an attacker to cause remo...
CVE-2026-74935
A privilege escalation vulnerability exists in the DOM: Networking component of the Mozilla Firefox and Thunderbird browsers. The flaw allows for unauthorized privilege escalation within the networking component. This issue has been addressed in the following versions: Firefox 154 , Firefox ESR 1...
CVE-2006-4565
CVE-2006-4565 is a vulnerability in Mozilla-related products (Firefox/SeaMonkey/Thunderbird) tied to processing of certain JavaScript regular expressions. The root cause is flaws in handling specific regular expressions, which could crash the application or allow arbitrary code execution. Public ...
CVE-2008-1380
CVE-2008-1380 is described in the provided materials as a vulnerability in the processing of malformed JavaScript content that could crash the SeaMonkey web browser and potentially allow arbitrary code execution when JavaScript is enabled. Red Hat Oracle Linux advisories (e.g., RHSA-2008-0223, EL...
CVE-2008-5016
CVE-2008-5016 affects Mozilla Firefox (3.x up to 3.0.4), Thunderbird (2.x up to 2.0.0.18), and SeaMonkey (1.x up to 1.1.13). The issue is triggered by the layout engine and can cause a remote denial of service (crash) via multiple vectors that lead to an assertion failure or other consequences. A...
CVE-2008-5508
CVE-2008-5508 affects Mozilla Firefox (3.x prior to 3.0.5 and 2.x prior to 2.0.0.19), Mozilla Thunderbird (2.x prior to 2.0.0.19), and SeaMonkey (1.x prior to 1.1.14). The issue stems from improper parsing of URLs that start with leading whitespace or control characters, which can allow a remote ...
CVE-2009-1303
Affected products: Mozilla Firefox up to 3.0.8/3.0.9, Mozilla Thunderbird up to 2.0.0.21/22, and SeaMonkey up to 1.1.15/16. CVE-2009-1303 arises from nsSVGElement::BindToTree in the browser engine, allowing a remote attacker to trigger denial of service (application crash) and potentially memory ...
CVE-2011-2605
CVE-2011-2605 is a CRLF-injection issue in Firefox/Thunderbird: nsCookieService::SetCookieStringInternal mishandles a newline in document.cookie, bypassing access restrictions. Affected: Mozilla Firefox before 3.6.18 and 4.x through 4.0.1; Thunderbird before 3.1.11. Outcome: potential cookie isol...
CVE-2011-2982
CVE-2011-2982 affects Mozilla Firefox before 3.6.20, Thunderbird 2.x/3.x before 3.1.12, SeaMonkey 1.x/2.x, and possibly other Mozilla-based products. The issue stems from multiple unspecified browser‑engine vulnerabilities causing memory corruption and remote code execution or DoS via unknown vec...
CVE-2011-2988
CVE-2011-2988 describes a buffer overrun in an unspecified string class used by the WebGL shader implementation in Mozilla Firefox (4.x–5), SeaMonkey (2.x before 2.3), and Thunderbird before 6. The vulnerability can be triggered by a long shader source block, potentially allowing remote code exec...
CVE-2012-4216
CVE-2012-4216 is a use-after-free in gfxFont::GetFontEntry affecting Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14. Exploitation could lead to remote code execution or a denial of service via h...
CVE-2025-8038
Mozilla Firefox , Firefox ESR , and the Thunderbird email client are vulnerable to a data forgery issue where Thunderbird ignores paths during frame navigation validity checks. Specifically, the CSP frame-src was not correctly enforced for paths. This vulnerability stems from insufficient verific...
CVE-2006-1732
Technical details (affected products, root cause, and exploit specifics) for CVE-2006-1732 are not provided in the supplied documents. Monitor for updates from official advisories.
CVE-2008-2811
The CVE-2008-2811 issue affects Mozilla components (Firefox <2.0.0.15, Thunderbird ≤2.0.0.14, SeaMonkey
CVE-2008-4067
CVE-2008-4067 describes a directory traversal vulnerability in Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12) on Linux. An attacker could read arbitrary files via a resource: URI containing .. and URL-encoded / sequences. The c...
CVE-2008-5513
CVE-2008-5513 affects Mozilla Firefox. The issue arises in the session-restore feature, where restoration of SessionStore data can bypass the Same Origin Policy, enabling content injection and cross-site scripting (XSS) via unknown vectors. Affected products/versions include Firefox 3.x prior to ...
CVE-2009-1305
CVE-2009-1305 is a vulnerability in the JavaScript engine of Mozilla Firefox (and affected Thunderbird/SeaMonkey) prior to version 3.0.9. It allows remote attackers to cause a denial of service (application crash) and potentially memory corruption via vectors involving JSOP_DEFVAR and properties ...
CVE-2009-1841
CVE-2009-1841 affects Mozilla products: Firefox <3.0.11, Thunderbird <2.0.0.22, SeaMonkey
CVE-2009-2462
CVE-2009-2462 affects Mozilla Firefox before 3.0.12 (and Thunderbird) with memory corruption/DoS or potentially arbitrary code execution via multiple rendering/DOM and CSS-related vectors. The connected MiracleLinux advisories reference Firefox 3.0.12 as the fixed version for AXSA:2009-364/365, i...
CVE-2012-3958
CVE-2012-3958 describes a use-after-free in Mozilla’s browser components, specifically nsHTMLEditRules::DeleteNonTableElements. A remote attacker could exploit this to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. Affected products include M...
CVE-2014-1548
CVE-2014-1548 affects Mozilla Firefox and Mozilla Thunderbird browser engines prior to version 31.0. The issues are described as multiple unspecified vulnerabilities that could lead to memory corruption, application crash, or possibly remote arbitrary code execution via unknown vectors. The conne...
CVE-2017-7757
CVE-2017-7757 is a use-after-free vulnerability in IndexedDB that can occur when an IndexedDB object is destroyed while a method on it is executing, potentially causing a crash. Affected products include Firefox versions before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The issue a...
CVE-2025-8036
Mozilla products, specifically Firefox , Firefox ESR , and Thunderbird , are vulnerable to a flaw where Thunderbird caches CORS preflight responses across IP address changes. This behavior enables attackers to circumvent Cross-Origin Resource Sharing (CORS) policies using DNS rebinding attacks. A...
CVE-2026-16381
A Same-origin policy bypass exists in the Networking: DNS component of the Firefox and Thunderbird web browser and mail client. This vulnerability was resolved in Firefox 153 , Firefox ESR 140.13 , Thunderbird 153 , and Thunderbird 140.13 . Exploitation details are not provided in the documents, ...
CVE-2026-16396
A privilege escalation vulnerability exists in the WebExtensions component of the Mozilla Firefox and Thunderbird browsers. This flaw impacts various versions of the software, including Firefox 153 and Thunderbird 153, as well as the ESR 140.13 release. The vulnerability has been addressed in the...
CVE-2006-1734
CVE-2006-1734 affects Mozilla Firefox/Thunderbird 1.x prior to 1.5 and 1.0.x prior to 1.0.8, Mozilla Suite prior to 1.7.13, and SeaMonkey prior to 1.0. The vulnerability arises from the Object.watch method being able to access the internal cloneParent function, enabling remote attackers to execut...
CVE-2006-5748
CVE-2006-5748 involves memory-corruption flaws in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, potentially causing a crash or arbitrary code execution via unspecified vectors. The connected advisories confirm these products and versions are affected and ...
CVE-2007-3844
CVE-2007-3844 affects Mozilla Firefox 2.0.0.5, Thunderbird 2.0.0.5 and earlier (1.5.0.13), and SeaMonkey 1.1.3. The issue allows remote attackers to perform cross-context scripting (XSS) with chrome privileges by injecting a javascript: or data: link into an about:blank document loaded by chrome ...
CVE-2007-4841
CVE-2007-4841 affects Mozilla Firefox (before 2.0.0.8), Mozilla Thunderbird (before 2.0.0.8), and SeaMonkey (before 1.1.5). The vulnerability permits remote command execution via (1) mailto, (2) nntp, (3) news, or (4) snews URIs that use invalid percent encoding, tied to improper file-type handli...
CVE-2012-5839
CVE-2012-5839 is a heap-based buffer overflow in Mozilla's gfxShapedWord::CompressedGlyph::IsClusterStart that affects Firefox and related Mozilla components. Affected software includes Mozilla Firefox before 17.0 (and ESR 10.x before 10.0.11), Thunderbird before 17.0 (and ESR 10.x before 10.0.11...
CVE-2025-4084
The "Copy as cURL" feature in Mozilla Firefox ESR (on Windows) and Mozilla Thunderbird is vulnerable to local code execution due to insufficient escaping of special characters . An attacker could trick a user into executing a malicious command on their system. This issue specifically affects Fire...
CVE-2026-12292
The Web Audio component in Firefox and Thunderbird is vulnerable to incorrect boundary conditions . This flaw affects the following versions: Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . The vulnerability was addressed in the aforementioned releases. No specific e...
CVE-2026-12296
A sandbox escape vulnerability exists in the Security: Process Sandboxing component of Mozilla products, including Firefox and Thunderbird . This issue was addressed in Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . While the specific technical root cause is not det...
CVE-2026-12315
A mitigation bypass exists in the DOM: Security component of the Firefox and Thunderbird applications. This vulnerability was addressed in Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . Exploitation details are not provided in the available documentation. For Amazon...
CVE-2026-6752
The WebRTC component in Mozilla Firefox , Firefox ESR , and the Thunderbird email client is vulnerable to incorrect boundary conditions . This flaw allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information. The vulnerability has been addressed in ...
CVE-2026-6760
The Firefox web browser and Thunderbird email client are affected by a mitigation bypass vulnerability in the Networking: Cookies component. The root cause is related to the software's reliance on cookies without sufficient checks for their authenticity and integrity . Exploitation of this flaw c...