CVE-2022-31738

CVE-2022-31738 concerns an issue where, when exiting fullscreen mode, an iframe could mislead the browser about the current fullscreen state, enabling user confusion or spoofing. Affected: Thunderbird < 91.10, Firefox < 101, and Firefox ESR

CVE-2023-23605

CVE-2023-23605 corresponds to memory-safety bugs in Mozilla Firefox 108 and Firefox ESR 102.6 (Thunderbird < 102.7; Firefox < 109; ESR

CVE-2022-1520

CVE-2022-1520 affects Thunderbird prior to 91.9. The issue is an incorrect encryption/signature status display when viewing an email A with an attached B (encrypted/digitally signed). After opening B, returning to A may cause A to show B’s security status. This is a client-side UI discrepancy, no...

CVE-2021-23954

CVE-2021-23954 : A memory corruption vulnerability in Firefox/Thunderbird was caused by using the new logical assignment operators inside a JavaScript switch, leading to a type confusion and potentially exploitable crash. Affected: Firefox <= 85.0 (fixed in 85.0+), Thunderbird

CVE-2022-34479

CVE-2022-34479 describes a vulnerability where a malicious website could create a popup that is resized to overlay the browser address bar, potentially causing user confusion or spoofing. The issue explicitly affects Thunderbird for Linux and, per the referenced advisories, Firefox and Thunderbir...

CVE-2020-26950

CVE-2020-26950 concerns a write-side effect in the MCallGetProperty opcode causing a use-after-free in Mozilla Firefox/Thunderbird. Affected software: Firefox < 82.0.3, Firefox ESR < 78.4.1, Thunderbird

CVE-2022-31739

CVE-2022-31739 is a Windows file-save path traversal in Mozilla Thunderbird (versions 91.0–91.9.1 per CNVD). An input-validation flaw could allow a downloaded file to be saved to attacker-controlled paths (e.g., using environment variables like %HOMEPATH% or %APPDATA%). No public fix/version deta...

CVE-2022-34484

CVE-2022-34484 is a memory-corruption issue reported by the Mozilla Fuzzing Team affecting Mozilla Thunderbird and Firefox/Firefox ESR: Thunderbird < 102 and Thunderbird < 91.11, Firefox < 102, and Firefox ESR

CVE-2022-34468

CVE-2022-34468: An iframe that is not allowed to run scripts could execute scripts when a user clicked a javascript: link. Affected: Firefox <102, Firefox ESR <91.11, Thunderbird <102, Thunderbird

CVE-2022-45418

CVE-2022-45418 describes a UI spoofing risk where a custom CSS mouse cursor could be drawn over the browser UI, potentially confusing users. Affected products include Firefox ESR and Firefox releases prior to 102.5, and Thunderbird prior to 102.5. Public sources in connected documents consistentl...

CVE-2022-42927

CVE-2022-42927 is a same-origin policy violation that could leak cross-origin URL entries and the redirect result via performance.getEntries(). Connected sources confirm impact on Firefox before version 106, Firefox ESR before 102.4, and Thunderbird before 102.4. Mitigations referenced include up...

CVE-2022-22753

CVE-2022-22753 affects Mozilla Firefox on Windows, with a Time-of-Check Time-of-Use bug in the Maintenance (Updater) Service that could grant a user write access to an arbitrary directory and escalate to SYSTEM. The umbrella set includes Firefox versions below 97 and affected Thunderbird ESR line...

CVE-2022-31736

CVE-2022-31736 is a cross-origin length disclosure in Mozilla products: a malicious site could learn the length of a cross-origin resource that supports Range requests. Affected are Thunderbird < 91.10, Firefox < 101, and Firefox ESR

CVE-2024-3864

A memory safety bug exists in Firefox , Firefox ESR , and Thunderbird , leading to memory corruption . With sufficient effort, this vulnerability could be exploited to execute arbitrary code . The issue affects Firefox < 125 , Firefox ESR < 115.10 , and Thunderbird

CVE-2022-1834

The CVE-2022-1834 vulnerability affects Thunderbird and is triggered when the sender name contains multiple Braille Pattern Blank space characters, causing all spaces to be displayed. An attacker could craft an email where the sender’s visible address appears to be the attacker’s while the signin...

CVE-2015-2716

CVE-2015-2716 is an Expat XML parser vulnerability described as an integer overflow that leads to a buffer overflow when processing large compressed XML data. Public advisories (ALAS-2020-1364, CESA-2020:1011) link this to expat, indicating a security update is required (update expat) to mitigate...

CVE-2019-11729

CVE-2019-11729 is confirmed in the connected documents as an NSS vulnerability: empty or malformed p256-ECDH public keys may cause a segmentation fault due to improper sanitization during memory copy. The issue affects NSS-related components used by Firefox ESR (<60.8), Firefox (<68), Thund...

CVE-2020-12399

CVE-2020-12399 involves NSS showing timing differences during DSA signatures, a vulnerability that could allow leakage of DSA private keys. The connected documents consistently state affected software as Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR

CVE-2020-26970

CVE-2020-26970 – Thunderbird SMTP handling stack overflow : The vulnerability occurs when reading SMTP server status codes, causing Thunderbird

CVE-2022-42932

CVE-2022-42932 involves memory safety bugs in Mozilla Firefox/Thunderbird. Affected products: Firefox 105 and ESR 102.3 (and older branches) with vulnerability present in Firefox < 106, ESR < 102.4, and Thunderbird

CVE-2021-29945

CVE-2021-29945 concerns the WebAssembly JIT: the JIT could miscalculate the size of a return type, causing a null read and a crash on x86-32. Affected products per the provided documents include Firefox ESR and Firefox releases prior to 78.10 and Thunderbird prior to 78.10 (Firefox

CVE-2022-45404

CVE-2022-45404 : The vulnerability is a fullscreen notification bypass caused by a sequence of popup/window.print() calls that lets a window go fullscreen without the user prompt. Affected products include Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox

CVE-2022-22746

CVE-2022-22746 describes a race condition that could bypass the fullscreen notification, potentially enabling a fullscreen window spoof in Firefox on Windows. The vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird

CVE-2022-45421

CVE-2022-45421 describes memory safety bugs reported in Thunderbird 102.4 (and related Gecko code paths) with evidence of memory corruption; the advisory notes these could be exploited to execute arbitrary code. Affected products include Thunderbird < 102.5, Firefox ESR < 102.5, and Firefox

CVE-2022-42929

Affects Firefox and Thunderbird: CVE-2022-42929 describes a denial-of-service vulnerability triggered by a particular handling of window.print(), with exploits leading to browser DoS that may persist across restarts depending on session restore. Public sources (CVE entry, Astra Linux advisory, De...

CVE-2022-45412

CVE-2022-45412 is a memory-unclear error that occurs when resolving the symlink file:///proc/self/fd/1, producing an error message with uninitialized memory content. The issue affects Thunderbird on Unix-based systems (Android, Linux, macOS) and also involves Firefox ESR <102.5 and Firefox

CVE-2022-45420

CVE-2022-45420 describes a phishing/spoofing risk where iframe content could be rendered outside the iframe boundaries in Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox

CVE-2021-29967

CVE-2021-29967 is a set of memory-safety bugs in Mozilla’s Firefox stack (affecting Firefox 88/ESR 78.11 path) that Mozilla indicated could be exploited to run arbitrary code. Affected products include Thunderbird < 78.11, Firefox < 89, and Firefox ESR

CVE-2017-7805

CVE-2017-7805 is a use-after-free vulnerability in the NSS TLS 1.2 implementation where handshake hashes can reference a freed buffer, potentially crashing the application and enabling arbitrary code execution. Public sources consistently tie the issue to NSS and Firefox/Thunderbird components, n...

CVE-2022-45408

Summary: CVE-2022-45408 describes a web/browser UI issue where a sequence of popups that reuse the same windowName can force a window into fullscreen mode without showing the notification prompt, enabling user confusion or spoofing. Affected products/versions: Firefox ESR and Firefox, Thunderbird...

CVE-2021-23968

CVE-2021-23968 describes a disclosure risk where, if a Content Security Policy blocked frame navigation, the violation report could reveal the destination of a redirect instead of the original frame URI. This could leak sensitive information contained in those URIs. Affected products include Fire...

CVE-2024-2608

The Firefox browser and Thunderbird email client are affected by an integer overflow vulnerability in the functions AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding(), and AppendEncodedCharacters(). This flaw can lead to the underallocation of an output buffer , subsequently resulti...

CVE-2020-12387

CVE-2020-12387 is a use-after-free vulnerability caused by a race condition during Web Worker shutdown in Mozilla Firefox/Thunderbird. Affected products include Firefox ESR < 68.8, Firefox < 76, and Thunderbird

CVE-2025-1013

A race condition in Mozilla Firefox and Thunderbird could allow private browsing tabs to be opened in normal browsing windows, potentially leading to a privacy leak . The vulnerability affects Firefox versions prior to 135 , Firefox ESR prior to 128.7 , Thunderbird prior to 128.7 , and Thunderbir...

CVE-2018-5146

CVE-2018-5146 describes an out-of-bounds memory write in Vorbis audio data processing. Affected are Mozilla Firefox (<59.0.1), Firefox ESR (<52.7.2), and Thunderbird (

CVE-2023-28176

CVE-2023-28176 corresponds to memory safety bugs in Firefox 110 and Firefox ESR 102.8, with potential to cause memory corruption and possible arbitrary code execution. Affected products include Firefox <111, Firefox ESR <102.9, and Thunderbird

CVE-2020-26974

CVE-2020-26974 is a Firefox/Thunderbird vulnerability where using flex-basis on a table wrapper could cause a StyleGenericFlexBasis object to be cast to the wrong type, leading to a heap use-after-free and memory corruption, potentially crashing the browser. Affected: Firefox <84, Thunderbird ...

CVE-2021-29980

CVE-2021-29980 is a memory safety issue caused by uninitialized memory in a canvas object, potentially enabling memory corruption and a crash. Documents show affected products include Thunderbird and Firefox variants: Thunderbird 78.x/91.x and Firefox ESR 78.x as well as Firefox

CVE-2020-6800

CVE-2020-6800 involves memory safety bugs identified in Firefox 72 and Firefox ESR 68.4, with potential to corrupt memory and enable arbitrary code execution in browser-like contexts. Affected products include Thunderbird and Firefox versions older than 68.5/73 respectively (Thunderbird < 68.5...

CVE-2024-9400

A potential memory corruption vulnerability exists in Firefox and Thunderbird when an attacker can trigger an Out of Memory (OOM) condition during JIT compilation . This issue affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 131, and Thunderbird

CVE-2023-32205

CVE-2023-32205 affects Firefox (versions < 113), Firefox ESR (< 102.11), and Thunderbird (

CVE-2019-9791

CVE-2019-9791 affects Thunderbird and Firefox (including Firefox ESR) and stems from the IonMonkey JIT: type confusion for constructors entered via on-stack replacement. The advisory notes that the vulnerability can enable arbitrary reading/writing of objects during an exploitable crash, with fix...

CVE-2024-4767

The Firefox browser and Thunderbird email client are affected by a vulnerability where IndexedDB files are not properly deleted when a window is closed, provided the browser.privatebrowsing.autostart preference is enabled. This configuration is disabled by default in Firefox. The issue impacts Fi...

CVE-2010-1205

CVE-2010-1205 is a buffer overflow in libpng (pngpread.c) that could allow remote code execution via a crafted PNG image. Affected libpng versions are prior to 1.2.44 and prior to 1.4.3. The overflow is tied to the internal copy in pngpread.c and is described across advisories mentioning memory c...

CVE-2021-38493

CVE-2021-38493 covers memory-safety bugs in Mozilla Firefox 91/ESR 78.13 (and Thunderbird <78.14) that could lead to memory corruption and potentially arbitrary code execution. Affected: Firefox ESR <78.14, Thunderbird <78.14, and Firefox

CVE-2023-3600

CVE-2023-3600 affects Firefox (all channels) < 115.0.2, Firefox ESR < 115.0.2, and Thunderbird

CVE-2024-11699

Mozilla products, including Firefox 132 , Firefox ESR 128.4 , and Thunderbird 128.4 , contain memory safety bugs that can lead to memory corruption . These flaws could potentially be exploited with significant effort to execute arbitrary code . The vulnerabilities affect versions of Firefox earli...

CVE-2024-11704

A double-free issue exists in the sec_pkcs7_decoder_start_decrypt() function when handling an error path. Under specific conditions, the same symmetric key could be freed twice, potentially leading to memory corruption . This vulnerability affects Firefox < 133 , Thunderbird < 133 , Firefox...

CVE-2019-11740

CVE-2019-11740 corresponds to memory-safety bugs in Firefox 68/ESR 68 and Firefox 60.8, with potential for arbitrary code execution. According to the consolidated sources, affected products include Firefox < 69, Thunderbird < 68.1/60.9, and Firefox ESR

CVE-2024-2610

A markup injection vulnerability in Firefox , Firefox ESR , and Thunderbird allows an attacker to steal nonce values . This can be leveraged to bypass strict content security policies (CSP). The vulnerability affects Firefox < 124 , Firefox ESR < 115.9 , and Thunderbird