1883 matches found
CVE-2012-1941
CVE-2012-1941 corresponds to a heap-based buffer overflow in Mozilla Firefox/Thunderbird/SeaMonkey components (nsHTMLReflowState::CalculateHypotheticalBox) that can be triggered when resizing a window displaying absolutely positioned and relatively positioned elements in nested columns. Affected ...
CVE-2014-1496
CVE-2014-1496 affects Mozilla Firefox (up to 28.0) and related Mozilla suite components (Firefox ESR 24.x up to 24.4, Thunderbird up to 24.4, SeaMonkey up to 2.25). The vulnerability allows local users to gain privileges by modifying the extracted Mar contents during an update, constituting a loc...
CVE-2016-1953
CVE-2016-1953 affects Mozilla Firefox before 45.0, tied to memory safety issues in the browser engine (notably js/src/jit/arm.cpp) that can cause memory corruption leading to remote code execution or denial of service. Public advisories (e.g., openSUSE/SUSE MFSA entries) relate this CVE to multip...
CVE-2026-12304
CVE-2026-12304 involves a Same-origin policy bypass in the Networking: Cookies component affecting Mozilla products. The vulnerability is documented for Firefox and Thunderbird (including firefox-esr and Thunderbird ESR variants) with fixes implemented in Firefox 152, Firefox ESR 140.12, Thunderb...
CVE-2005-0399
CVE-2005-0399 describes a heap-based buffer overflow in GIF2.cpp used by Firefox (before 1.0.2), Mozilla (before 1.7.6), Thunderbird (before 1.0.2), and other apps sharing the same library. The vulnerability is triggered by a crafted GIF image containing a Netscape extension 2 block, allowing rem...
CVE-2014-1551
CVE-2014-1551 is a concrete use-after-free vulnerability in Mozilla Firefox’s FontTableRec destructor that can be triggered by crafted fonts in MathML content. Root cause: improper handling of a DirectWrite font-face object, allowing remote attackers to execute arbitrary code. Affected products/v...
CVE-2025-3031
CVE-2025-3031 : A vulnerability in Mozilla’s JIT-compiled code allows reading 32 bits spilled onto the stack. Affected products are Firefox and Thunderbird prior to version 137. Root cause, impact, and affected components are stated, but no exploitation details are provided in the documents. Reme...
CVE-2026-6760
Mitigation bypass in the Networking: Cookies component (CVE-2026-6760) affects Firefox and Thunderbird; root cause is a bypass of cookie-related mitigations. The CVSSv3.1 metrics indicate network attack vector, no privileges required, no user interaction, with high impact to confidentiality, inte...
CVE-2026-6771
CVE-2026-6771 is a mitigation bypass in the DOM: Security component. The affected products include Firefox and Thunderbird; the vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Actionability: update to the listed versions to remediate. Connected...
CVE-2004-0903
CVE-2004-0903 describes a stack-based buffer overflow in the writeGroup function of nsVCardObj.cpp, affecting Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8. An attacker could remotely execute arbitrary code by processing malformed VCard attachments d...
CVE-2006-0236
The CVE-2006-0236 entry concerns Mozilla Thunderbird 1.0.2, 1.0.6, and 1.0.7. A GUI display truncation allows user-assisted attackers to execute arbitrary code via an attachment whose filename contains a large number of spaces and ends with a dangerous extension that Thunderbird does not display,...
CVE-2006-1045
The CVE affects Mozilla Thunderbird 1.5. When Block loading of remote images in mail messages is enabled, Thunderbird’s HTML rendering engine does not fully block external images in inline HTML attachments. This could allow a remote attacker to obtain sensitive information (e.g., application vers...
CVE-2006-3812
CVE-2006-3812 affects Mozilla Firefox prior to 1.5.0.5, Thunderbird prior to 1.5.0.5, and SeaMonkey prior to 1.0.3. The flaw allows a remote attacker to trick a user into copying or dragging a link to reference remote files and potentially load chrome: URLs, leading to partial confidentiality/int...
CVE-2007-4038
Technical details for CVE-2007-4038 are not present in the provided Connected documents. The initial description mentions a mailto: argument-injection issue in Firefox/Thunderbird but lacks product/version/patch specifics. Monitor for updates.
CVE-2008-0413
CVE-2008-0413 affects the JavaScript engine in Mozilla Firefox < 2.0.0.12, Thunderbird < 2.0.0.12, and SeaMonkey
CVE-2010-0167
CVE-2010-0167 affects Mozilla Firefox and related Mozilla products (Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, 3.6.x before 3.6.2; Thunderbird before 3.0.2; SeaMonkey before 2.0.3). The issue is a remote memory corruption vulnerability in the browser engine, tied to layout/nsBlockFrame.cpp ...
CVE-2010-1201
CVE-2010-1201 affects Mozilla Firefox 3.5.x before 3.5.10, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5. The vulnerability is described as an unspecified memory corruption in the browser engine that could allow a remote attacker to cause a denial of service or potentially execute arbitrar...
CVE-2013-1706
CVE-2013-1706 is a stack-based buffer overflow in the Mozilla Maintenance Service (maintenanceservice.exe) used by Mozilla Firefox/Thunderbird. Affects Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, and Thunderbird ESR 17.x before 17.0.8. The root cause is...
CVE-2026-12294
CVE-2026-12294 concerns a Sandbox escape in the DOM: Workers component found in Mozilla products. The vulnerability affects Firefox (including Firefox 152 and ESR branches 140.12 and 115.37) and Thunderbird (152 and 140.12). The underlying issue is a sandbox escape in the Workers component, with ...
CVE-2026-2796
CVE-2026-2796 describes a JIT miscompilation in the JavaScript: WebAssembly component that affects Firefox and Thunderbird prior to version 148. The root cause is a JIT miscompilation in the WebAssembly pathway within the JavaScript engine, leading to a high-severity impact (as reflected by the C...
CVE-2004-0757
CVE-2004-0757 describes a heap-based buffer overflow in the POP3 SendUidl capability of Mozilla < 1.7, Firefox < 0.9, and Thunderbird
CVE-2004-0902
The CVE-2004-0902 entry refers to multiple heap-based buffer overflows in Mozilla Firefox and Mozilla suite components (Firefox before the Preview Release, Mozilla before 1.7.3, Thunderbird before 0.8). The issues allow remote attackers to cause an application crash (DoS) or execute arbitrary cod...
CVE-2008-2808
Vulnerability CVE-2008-2808 affects Mozilla Firefox <2.0.0.15 and SeaMonkey
CVE-2010-3181
CVE-2010-3181 pertains to an untrusted search path (DLL loading) vulnerability in Mozilla Firefox (pre-3.5.14), Firefox 3.6.x (pre-3.6.11), Thunderbird (pre-3.0.9 and pre-3.1.5), and SeaMonkey (pre-2.0.9) on Windows. The root cause is Trojan horse DLLs loaded from the current working directory, e...
CVE-2012-4217
CVE-2012-4217 is a use-after-free in Mozilla Firefox <17.0, Thunderbird <17.0, and SeaMonkey
CVE-2013-1726
CVE-2013-1726 affects Mozilla Updater in Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21. The issue is failure to ensure exclusive access to a MAR file, allowing a local attacker to gain privileges by plac...
CVE-2025-8038
CVE-2025-8038 corresponds to a Mozilla framing/navigation vulnerability where Thunderbird ignored path checks when validating navigations in a frame. Affected products include Firefox before 141 and Firefox ESR before 140.1, and Thunderbird before 141 and before 140.1. Root cause per the sources ...
CVE-2026-2797
CVE-2026-2797 is a use-after-free in the JavaScript: GC component affecting Firefox and Thunderbird. The issue was fixed in Firefox 148 and Thunderbird 148. Public exploits are noted in some sources; CVSS metrics indicate a high-severity, memory-safety class vulnerability with network attack vect...
CVE-2026-6784
CVE-2026-6784 covers memory safety bugs in Mozilla Firefox 149 and Thunderbird 149 that could lead to memory corruption and, with sufficient effort, potentially arbitrary code execution. The vulnerability is evidenced across multiple feeds and is mitigated by upgrading to Firefox 150 and Thunderb...
CVE-2007-2868
This CVE-2007-2868 entry concerns memory corruption in the JavaScript engine of Mozilla-derived products. Affected software includes Mozilla Firefox 1.5.x up to 1.5.0.12 and 2.x up to 2.0.0.4, Thunderbird 1.5.x up to 1.5.0.12 and 2.x up to 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2. Exploitation coul...
CVE-2010-0163
CVE-2010-0163 affects SeaMonkey before 1.1.19 and Mozilla Thunderbird before 2.0.0.24. The issue stems from a mail-attachment parser that performs casts and line termination incorrectly, enabling a remote attacker to crash the application or potentially execute arbitrary code via a crafted messag...
CVE-2012-0443
CVE-2012-0443 affects Mozilla Firefox (4.x–9.0), Thunderbird (5.0–9.0) and SeaMonkey prior to 2.7. The browser engine vulnerabilities allow remote attackers to cause memory corruption, crash the application, or potentially execute arbitrary code via unknown vectors; several advisories reference t...
CVE-2012-3974
CVE-2012-3974 is an Untrusted search path vulnerability in the installer for Mozilla Firefox (pre-15.0) and Thunderbird (pre-15.0; ESR 10.x) on Windows. Root cause: Trojan horse executable in a root directory enables local privilege escalation. Affected: Firefox before 15.0, Firefox ESR before 10...
CVE-2013-0781
CVE-2013-0781 is a use-after-free in Mozilla’s nsPrintEngine::CommonPrint that affects Firefox, Thunderbird, and SeaMonkey versions prior to their listed fixes (Firefox before 19.0, Thunderbird before 17.0.3, SeaMonkey before 2.16). The underlying issue is a heap memory corruption/use-after-free ...
CVE-2017-7763
CVE-2017-7763 : On macOS OS X, default fonts render some Tibetan characters as whitespace, enabling spoofing when used in an IDN in the address bar. Affected products/versions (per connected docs): Firefox versions before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The issue is spec...
CVE-2025-4089
CVE-2025-4089 is a vulnerability in Mozilla Firefox and Thunderbird related to insufficient escaping in the copy as cURL feature. The impact is local code execution on the user’s system if an attacker lures the user to run a crafted command. Affected software is Firefox and Thunderbird before 138...
CVE-2025-6435
CVE-2025-6435 corresponds to a Mozilla Firefox/Thunderbird issue where saving a response from Devtools Network tab via the Save As menu may fail to preserve the .download extension. This could allow a user to inadvertently run a malicious executable. The FreeBSD advisory also notes memory safety ...
CVE-2026-6751
CVE-2026-6751 is a vulnerability described as an uninitialized memory issue in the Audio/Video: Web Codecs component. The primary CVE entry references Firefox (fixed in Firefox 150 and Firefox ESR 140.10), Thunderbird (fixed in Thunderbird 150 and Thunderbird 140.10). Connected advisories confirm...
CVE-2026-6768
CVE-2026-6768 is a mitigation bypass in Mozilla’s Networking: Cookies component. Connected advisories confirm the vulnerability affects Mozilla products and is mitigated by upgrades to Firefox 150 and Thunderbird 150. Fedora/NSS/Firefox plugins list this CVE among a batch (CVE-2026-6768 included)...
CVE-2009-3982
The CVE-2009-3982 entry concerns Mozilla Firefox 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird, where exposure is via the JavaScript engine. The connected documents confirm a memory-corruption impact in the JS engine that could allow remote code execution or a crash, caused by unspe...
CVE-2011-2997
CVE-2011-2997 affects Mozilla Firefox (browser engine) versions on Windows/Linux/macOS as Firefox 6, Thunderbird before 7.0, and SeaMonkey before 2.4. Root cause: memory corruption in the browser engine that can cause denial of service or potentially allow arbitrary code execution via unknown vec...
CVE-2012-1964
CVE-2012-1964 corresponds to the certificate-warning clickjacking issue in Mozilla Firefox (4.x–12.0), Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–12.0, and SeaMonkey before 2.10. The vulnerability arises from improper handling of clickjacking on the about:certerror page, allowing a MITM atta...
CVE-2026-6748
CVE-2026-6748 concerns uninitialized memory in Mozilla’s Audio/Video: Web Codecs component. The Initial CVE page notes fixes in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Connected advisories from Debian (DSA-6225/DSA-6229) and DLA-4549/4546/NASL entries confirm mul...
CVE-2006-1723
CVE-2006-1723 affects Firefox and Thunderbird prior to 1.5.0.2, and SeaMonkey prior to 1.0.1. The issue is described as an unspecified vulnerability that can cause a remote denial of service (crash) and possibly arbitrary code execution via unknown DHTML attack vectors. The initial document does ...
CVE-2009-2535
CVE-2009-2535 affects Mozilla Firefox before 2.0.0.19 and 3.x before 3.0.5, SeaMonkey, and Thunderbird, enabling remote attackers to trigger memory consumption and a crash (DoS) by supplying a large integer as the length property of a Select element. Root cause and exploit details are not expande...
CVE-2025-4085
CVE-2025-4085 affects Mozilla Firefox (earlier than 138.0) and Mozilla Thunderbird (earlier than 138.0). The issue arises when a content process could abuse the privileged UITour actor to leak sensitive information or escalate privileges. The description consistently identifies the root cause as ...
CVE-2026-6752
CVE-2026-6752 is a WebRTC boundary-conditions vulnerability in Mozilla Firefox/Thunderbird. The issue is caused by incorrect boundary conditions in the WebRTC component, leading to potential impact as described in the advisory. The connected sources confirm fixed versions: Firefox 150, Firefox ES...
CVE-2026-6764
CVE-2026-6764 is an issue described as incorrect boundary conditions in the DOM: Device Interfaces component, affecting Firefox/Thunderbird. Public references in the connected advisories show fixes for this CVE in Firefox 150 (and ESR 140.10) and Thunderbird 150 (and Thunderbird 140.10). The root...
CVE-2006-1529
CVE-2006-1529 affects Firefox and Thunderbird up to versions prior to 1.5.0.2 and SeaMonkey up to 1.0.1, with exploitation possible via DHTML. The entry notes no public details as of 2006-04-13, and exact attack vectors, root cause, and fix status are not fully disclosed in the provided documents...