1883 matches found
CVE-2026-8946
The CVE-2026-8946 entry concerns the Audio/Video: Web Codecs component and its boundary-condition handling. Affected software is Firefox (and ESR releases) where the vulnerability was addressed by fixes in Firefox 151, Firefox ESR 115.36, and Firefox ESR 140.11. The underlying issue is described ...
CVE-2004-2226
This CVE affects Mozilla Mail 1.7.1/1.7.3 and Thunderbird before 0.9. When HTML-Mails is enabled, an attacker can cause an HTML e‑mail to reference a CSS document on the attacker's server, enabling a remote attacker to determine valid e‑mail addresses. The core issue is an information-disclosure ...
CVE-2005-3402
CVE-2005-3402 affects Mozilla Thunderbird SMTP client (notably 1.0.5 BETA and 1.0.7). The issue is that Thunderbird does not notify users when it cannot establish a secure channel with the SMTP server, enabling a MITM to obtain authentication information by bypassing TLS or downgrading CRAM-MD5 t...
CVE-2010-0161
CVE-2010-0161 affects Thunderbird (before 2.0.0.24) and SeaMonkey (before 1.1.19) on Windows, where the nsAuthSSPI::Unwrap function in extensions/auth/nsAuthSSPI.cpp can be triggered by data from a remote SMTP/IMAP/POP server using SSPI. This may cause heap memory corruption and application crash...
CVE-2012-1943
CVE-2012-1943 involves an untrusted search path vulnerability in Updater.exe of the Mozilla Updater Service on Windows, affecting Firefox 12.0, Thunderbird 12.0, and SeaMonkey 2.9. The issue allows local privilege escalation through loading a Trojan horse wsock32.dll located in an application dir...
CVE-2026-8954
CVE-2026-8954 affects Mozilla Firefox’s Audio/Video component. The issue is described as incorrect boundary conditions and an integer overflow, with a fix implemented in Firefox 151 and Firefox ESR 140.11. The available sources do not provide additional technical specifics such as the exact vulne...
CVE-2011-3654
CVE-2011-3654 : The browser engine in Mozilla Firefox before 8.0 and Thunderbird before 8.0 mishandles links from SVG mpath elements to non-SVG elements, enabling memory corruption and application crash and possibly arbitrary code execution via unspecified vectors. Impact is a high-severity memor...
CVE-2025-10527
The CVE-2025-10527 entry corresponds to a sandbox escape via use-after-free in the Graphics: Canvas2D component. Affected products include Firefox <143, Firefox ESR <140.3, Thunderbird <143, and Thunderbird
CVE-2026-16381
CVE-2026-16381 affects Mozilla Firefox (Networking: DNS component). It is a same-origin policy bypass vulnerability with a CVSS v3.1 base score of 9.1 (CRITICAL). The description indicates the issue was fixed in Firefox 153 and Firefox ESR 140.13. The connected sources confirm the fix versions; n...
CVE-2009-4629
Mozilla Necko DNS Information Disclosure (CVE-2009-4629) affects Thunderbird 3.0.1, SeaMonkey, and related apps. The issue is DNS prefetching triggered even for APP_TYPE_MAIL/APP_TYPE_EDITOR, enabling an attacker to infer a user’s network location by logging DNS requests (e.g., when reading text/...
CVE-2011-3664
Affected software: Mozilla Firefox, Thunderbird, and SeaMonkey on Mac OS X. Vulnerable behavior: plugins can delete a DOM frame, triggering an incorrect pointer dereference that may crash the application (DoS) and potentially other unspecified impacts. Severity: base CVSS 2.0 score 6.8 (MEDIUM). ...
CVE-2026-16365
CVE-2026-16365 affects the DOM: Workers component. The vulnerability is fixed in Firefox 153 and Thunderbird 153. The available data include a CVSS v3.1 base score of 8.8 (HIGH) with network attack vector, low attack complexity, no privileges required, user interaction required, and total impact ...
CVE-2026-2761
CVE-2026-2761 is a sandbox-escape vulnerability in the Graphics: WebRender component of Mozilla Firefox/Thunderbird. The issue is fixed in Firefox 148, Firefox ESR 115.33 and 140.8, as well as Thunderbird 148 and Thunderbird 140.8 per the provided advisories. Connected documents confirm this exac...
CVE-2026-6782
This CVE (CVE-2026-6782) affects the IP Protection component and is addressed by upgrading Firefox to version 150 and Thunderbird to version 150 (per multiple advisories). Public records in Fedora/Nessus notes indicate an information disclosure vulnerability resolved by these upgrades; no detaile...
CVE-2026-8953
CVE-2026-8953 describes a sandbox escape caused by a use-after-free in the Disability Access APIs component. Affected products include Firefox (fixed in Firefox 151) and Firefox ESR (115.36, 140.11), as well as Thunderbird (151, 140.11). The public records indicate a memory-unsafe defect in the D...
CVE-2005-4809
CVE-2005-4809 affects Mozilla Firefox 1.0.1 (and possibly other Mozilla products such as Mozilla and Thunderbird) and describes a UI spoofing issue where an attacker can spoof the URL shown in the Status Bar. The root cause is a crafted A HREF tag that includes a TABLE tag containing another A ta...
CVE-2025-10533
CVE-2025-10533 describes an integer overflow in the SVG component affecting Firefox before 143, Firefox ESR before 115.28 and 140.3, Thunderbird before 143 and 140.3. Connected sources confirm the same vulnerability details. The Astra Linux security bulletin echoes this issue and lists the affect...
CVE-2026-12310
CVE-2026-12310 is a memory-safety bug in Mozilla Firefox/Thunderbird fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The CVSSv3.1 base score is 7.5 (HIGH) with network attack vector, no user interaction required, and impact limited to confidentiality. The connec...
CVE-2026-12324
CVE-2026-12324 concerns an issue in the Graphics: CanvasWebGL component caused by incorrect boundary conditions. Public sources indicate the vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The available documents do not provide exploit vectors ...
CVE-2026-12325
CVE-2026-12325 is a denial-of-service vulnerability in the Graphics: ImageLib component. Affected products include Mozilla Firefox and Thunderbird; root cause and impact are described as DoS in ImageLib. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbir...
CVE-2026-0877
CVE-2026-0877 is a mitigation bypass in the DOM: Security component, affecting Firefox versions below 147, including Firefox ESR <115.32 and ESR
CVE-2026-12299
CVE-2026-12299 is a JIT miscompilation vulnerability in the DOM: Core & HTML component that affects Firefox and Thunderbird products. The issue is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. The CVSSv3.1 vector is CVSS:3.1/AV:N/AC:H/PR:N/...
CVE-2026-16396
CVE-2026-16396 is a privilege-escalation issue in WebExtensions that affects Mozilla Firefox and Thunderbird components. Public advisories indicate the vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The CVSS data from the initial document show...
CVE-2026-2758
CVE-2026-2758 is a memory-safety use-after-free in the Mozilla Firefox JavaScript GC component. Public details show it affects Firefox and Thunderbird families and was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Multiple connected advisorie...
CVE-2008-5430
CVE-2008-5430 affects Mozilla Thunderbird 2.0.14 and is tied to handling of multipart/mixed e-mails with many MIME parts and possibly many headers of the form Content-type: message/rfc822;. The root cause is improper processing leading to denial of service through large messages (resource/stack c...
CVE-2026-16389
CVE-2026-16389 affects the Libraries component of NSS. The root cause is described as incorrect boundary conditions that lead to an integer overflow. The vulnerability is rated high (CVSS v3.1 base score 9.8; CRITICAL; network attack vector, no privileges, no user interaction) and would impact sy...
CVE-2026-14899
The CVE-2026-14899 issue is a memory-safe vulnerability in Thunderbird’s MIME header parser when forwarding messages with headers visible. An off-by-one error could allow reading a byte beyond the header buffer, potentially causing a crash. Affected component: Thunderbird MIME header parsing duri...
CVE-2026-2765
CVE-2026-2765 is a memory-safety issue described in the connected Astra/Amazon advisories as a use-after-free in the JavaScript Engine component. Affected products include Firefox (and ESR) and Thunderbird, with fixed versions noted as Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderb...
CVE-2026-8950
CVE-2026-8950 is a reported same-origin policy bypass in the Networking: HTTP component, with root cause not explicitly detailed in the provided documents. Affected software includes Firefox (fixed in version 151) and Firefox ESR (140.11), as well as Thunderbird (fixed in 151 and 140.11). The CVS...
CVE-2006-0836
CVE-2006-0836 : Affected product is Mozilla Thunderbird 1.5. The issue allows user-assisted attackers to cause an unspecified denial of service by convincing a user to import an LDIF file containing a long field (demonstrated by a long homePhone field) into the address book. The available connect...
CVE-2026-12315
The CVE-2026-12315 issue is a mitigation bypass in the DOM: Security component affecting Firefox and Thunderbird. According to the sources, it is fixed in Firefox 152 and Firefox ESR 140.12, as well as Thunderbird 152 and Thunderbird 140.12. The Debian/Red Hat/OSV/NVD entries corroborate a broad ...
CVE-2026-16410
CVE-2026-16410: A JIT miscompilation in the JavaScript Engine's JIT component of Firefox was fixed in Firefox 153. Affected versions are prior to 153; use of the vulnerable JIT code could lead to high-severity impact per reported CVSS metrics (CRITICAL, HIGH confidentiality, integrity, availabili...
CVE-2026-74939
Mozilla Firefox's DOM: Navigation component contains a privilege escalation flaw (CVSS 8.8 HIGH). Exploitation requires a network-based attacker to lure a user into visiting a crafted page. Affected versions must be upgraded to Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, or Firefox ESR 1...
CVE-2026-8949
CVE-2026-8949 concerns an integer overflow in Firefox’s Widget: Win32 component. Affected software is Firefox 151 and Firefox ESR 140.11, which include the fix. The available documents do not specify explicit exploit details, impact scope beyond the overflow and version fixes, or whether active e...
CVE-2026-12297
CVE-2026-12297 describes a sandbox escape caused by incorrect boundary conditions in Mozilla Firefox/Thunderbird networking code. Affects Firefox and Thunderbird components; underlying fault is boundary-condition handling in the Networking component that allowed escape from the sandbox. Impact pe...
CVE-2026-16384
CVE-2026-16384 : Information disclosure caused by uninitialized memory in Firefox’s Graphics: WebGPU component. Affected product: Firefox (Graphics: WebGPU). Root cause: uninitialized memory leading to potential leakage. Impact per CVSS: Confidentiality High; no integrity/availability impact repo...
CVE-2026-16387
CVE-2026-16387 is a site isolation issue in the Mozilla Firefox Networking component. The vulnerability is fixed in Firefox 153 and Firefox ESR 140.13. The available documents do not specify the exact vulnerable versions beyond the fix, nor do they provide exploitation details. Affected software ...
CVE-2026-6783
CVE-2026-6783 involves an incorrect boundary handling and integer overflow in the Audio/Video Playback component. Affected software is Mozilla Firefox and Thunderbird; the issue is mitigated by upgrading to Firefox 150 and Thunderbird 150, which include the fix. The CVSS-based reports indicate a ...
CVE-2026-8955
CVE-2026-8955 describes a privilege-escalation flaw in the DOM: Workers component. The vulnerability is fixed in Firefox 151 and Firefox ESR 140.11, as well as Thunderbird 151 and Thunderbird 140.11. The core issue is in the Workers implementation of the DOM, leading to elevated permissions. Per ...
CVE-2026-2763
CVE-2026-2763 is a use-after-free in the JavaScript Engine component of Mozilla Firefox. The vulnerability affects Firefox and related ESR branches, and has been fixed in Firefox 148 and ESR versions 115.33, 140.8; Thunderbird 148/140.8 are also listed in fixed advisories. Connected sources corro...
CVE-2026-2792
CVE-2026-2792 involves memory safety bugs found in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some flaws showed memory corruption indicators and could potentially be exploited to run arbitrary code; Mozilla fixed these in Firefox 148, Firefox ESR 140.8, Thunderbird...
CVE-2026-6757
CVE-2026-6757 corresponds to an invalid pointer in the JavaScript: WebAssembly component. The connected advisories confirm affected products as Firefox (including Firefox 150 and Firefox ESR 140.10) and Thunderbird (150 and 140.10), with fixes in those respective versions. Several entries (ALSA p...
CVE-2026-0878
CVE-2026-0878 describes a sandbox escape caused by incorrect boundary conditions in the Graphics: CanvasWebGL component. Affected: Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, Thunderbird
CVE-2026-12298
CVE-2026-12298 is a memory-safety bug affecting Firefox and Thunderbird components, with fixes in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Connected advisories (ALSA/RLSA/SUSE/Fedora/Red Hat) enumerate the same CVE among a broader set of related issues and indicat...
CVE-2026-12313
CVE-2026-12313 affects Firefox and Thunderbird: Information disclosure and sandbox escape in the Security: Process Sandboxing component. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12 (per Mozilla advisories and downstream vendor trackers). ...
CVE-2026-16371
CVE-2026-16371: Privilege escalation in the DOM: Navigation component. The Mozilla advisories indicate this affects Firefox and Thunderbird products and is fixed in Firefox 153 / ESR 140.13 and Thunderbird 153 / 140.13. Remediation: upgrade to Firefox 153 (or ESR 140.13) and Thunderbird 153 (or 1...
CVE-2026-2778
CVE-2026-2778: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. Affected: Firefox (pre-148), Firefox ESR (pre-115.33/140.8); Thunderbird (pre-148, pre-140.8). Fixes: Firefox 148, ESR 115.33/140.8; Thunderbird 148/140.8. Practical impact: sandbox escape potent...
CVE-2026-16379
Technical details for CVE-2026-16379 are not provided in the supplied documents. The initial entry mentions privilege escalation in the DOM Content Processes component and fixes in Firefox/Thunderbird versions, but lacks root cause, affected products, or remediation specifics.
CVE-2026-2774
CVE-2026-2774 is an integer overflow in the Firefox Audio/Video component. Public sources indicate Firefox/ESR updates (Firefox 148, ESR 115.33, ESR 140.8) fix the flaw; affected products include Firefox and Thunderbird per accompanying advisories. The issue is rated high/critical by CVSS sources...