2028 matches found
CVE-2024-11696
This vulnerability affects Firefox versions < 133 , Firefox ESR < 128.5 , Thunderbird < 133 , and Thunderbird
CVE-2024-5693
The Offscreen Canvas component in Firefox and Thunderbird failed to properly track cross-origin tainting . This flaw could allow an attacker to access image data from another site, violating the same-origin policy . Affected versions include Firefox < 127 , Firefox ESR < 115.12 , and Thunde...
CVE-2019-11693
CVE-2019-11693 describes a Linux-specific buffer overflow in WebGL’s bufferdata, affecting Thunderbird and Firefox (Thunderbird <60.7, Firefox <67, ESR
CVE-2019-11743
CVE-2019-11743 describes cross-origin access to unload event attributes, enabling timing-side-channel exposure of history in certain browsers. Connected docs confirm affected products and versions, with fixes noted in Thunderbird updates (e.g., Thunderbird 60.9.0) and Firefox/ESR advisories addre...
CVE-2020-15683
CVE-2020-15683 : Mozilla Firefox and Thunderbird memory-safety issues reported affecting Firefox ESR < 78.4, Firefox < 82, and Thunderbird
CVE-2021-29969
Thunderbird is affected by CVE-2021-29969: when STARTTLS is used for IMAP, an attacker injecting IMAP responses before TLS completion could cause Thunderbird to display spoofed information (e.g., folders that don’t exist). Affects Thunderbird versions older than 78.12. The issue originates from n...
CVE-2021-29988
The CVE-2021-29988 issue is a memory safety vulnerability in Mozilla code where Firefox incorrectly treated an inline list-item as a block element, leading to an out-of-bounds read or memory corruption and a potentially exploitable crash. Affected products and versions: Thunderbird < 78.13 and...
CVE-2024-11693
This vulnerability affects Firefox versions prior to 133, Firefox ESR prior to 128.5, Thunderbird versions prior to 133, and Thunderbird prior to 128.5. The issue is specifically restricted to Windows operating systems , where the executable file warning is not presented during the download of .l...
CVE-2024-4777
CVE-2024-4777 concerns memory-safety bugs in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10, potentially allowing arbitrary code execution. Public sources in connected documents confirm affected products and versions: Firefox < 126, Firefox ESR < 115.11, and Thunderbird
CVE-2024-6610
The CVE-2024-6610 issue is disclosed across multiple sources as a UI vulnerability in Mozilla Firefox and Thunderbird prior to version 128, caused by form validation popups that can capture escape key presses and block exiting full-screen mode. Affected products: Firefox <128 and Thunderbird
CVE-2019-11715
CVE-2019-11715: HTML parsing error can contribute to content XSS. Affected: Firefox ESR <60.8, Firefox <68, Thunderbird
CVE-2019-9813
CVE-2019-9813 describes an IonMonkey JIT type confusion caused by incorrect handling of proto mutations, enabling potential arbitrary memory read/write. Affected products include Firefox prior to 66.0.1, Firefox ESR prior to 60.6.1, and Thunderbird prior to 60.6.1. The underlying issue is a type-...
CVE-2021-23984
The CVE-2021-23984 entry describes a vulnerability in which a malicious extension could open a popup window without an address bar, allowing spoofing of a site and credential theft. Affected products include Firefox ESR < 78.9, Firefox < 87, and Thunderbird
CVE-2024-7526
The ANGLE component in Firefox and Thunderbird fails to initialize parameters correctly, leading to a read from uninitialized memory . This vulnerability could be exploited to leak sensitive data from memory. Affected versions include Firefox < 129 , Firefox ESR < 115.14 , Firefox ESR < ...
CVE-2025-0243
Mozilla Firefox and Thunderbird are affected by memory safety bugs in versions 133 and 128.5 (ESR). The root cause involves copying buffers without checking the size of the input data , which may lead to memory corruption . A remote attacker could potentially exploit these flaws to execute arbitr...
CVE-2019-11746
CVE-2019-11746 is a use-after-free in video element handling that can cause a crash. Public sources in connected advisories confirm impact on Firefox versions below 69, Thunderbird <68.1 and <60.9 (and ESR branches
CVE-2019-17011
CVE-2019-17011 : A race condition in DocShell antitracking can cause a use-after-free and potentially crash the process. Affected: Thunderbird < 68.3, Firefox ESR < 68.3, Firefox
CVE-2021-29976
CVE-2021-29976 is a memory-safety issue affecting Mozilla code shared by Firefox and Thunderbird. The advisory details indicate memory-safety bugs that could be exploited to run arbitrary code, impacting Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox
CVE-2024-10460
The CVE-2024-10460 issue is a data: URL-based spoofing vulnerability in an iframe that obscures the origin of an external protocol handler prompt. Affected: Firefox <132, Firefox ESR <128.4, Thunderbird <128.4, and Thunderbird
CVE-2024-7518
CVE-2024-7518 describes that select options could obscure the fullscreen notification dialog, enabling spoofing by a malicious site. Affected products and versions identified in connected docs include Mozilla Firefox (older builds: Firefox < 129 and Firefox ESR < 128.1) and Mozilla Thunderb...
CVE-2024-7527
The CVE-2024-7527 issue (use-after-free at the start of sweeping) affects Firefox <129 and Thunderbird
CVE-2024-11706
A null pointer dereference vulnerability exists in the pk12util component, specifically within the SEC_ASN1DecodeItem_Util function. This issue occurs when the software processes malformed or improperly formatted input files. The vulnerability impacts Firefox versions prior to 133 and Thunderbird...
CVE-2024-6613
The frame iterator in Firefox and Thunderbird can become stuck in a loop when processing certain WebAssembly (WASM) frames. This flaw leads to the generation of incorrect stack traces . This vulnerability affects Firefox < 128 and Thunderbird
CVE-2024-7520
CVE-2024-7520 is a type confusion vulnerability in WebAssembly that could enable code execution. The available documents confirm impact on Mozilla Firefox (pre-129 and ESR pre-128.1) and Mozilla Thunderbird (pre-128.1). The underlying issue is a WebAssembly type confusion, with several advisories...
CVE-2025-0238
Mozilla Firefox and Thunderbird are affected by a use-after-free vulnerability triggered by a controlled failed memory allocation when breaking lines in text. This flaw could lead to a potentially exploitable crash or service interruption via a specially crafted web page. The vulnerability impact...
CVE-2020-26960
CVE-2020-26960 is a use-after-free vulnerability caused by reallocation during Compact() on nsTArray, affecting Firefox <83, Firefox ESR <78.5, and Thunderbird
CVE-2021-38508
CVE-2021-38508 is a vulnerability affecting Mozilla products where a form validity message shown in the same location as a permission prompt (e.g., geolocation) can obscure the prompt, potentially tricking users into granting permissions. Affected: Firefox < 94, Thunderbird < 91.3, and Fire...
CVE-2024-9396
A memory corruption vulnerability exists in Firefox and Thunderbird due to a condition where the structured clone of certain objects occurs. This vulnerability affects Firefox < 131 , Firefox ESR < 128.3 , Thunderbird < 128.3 , and Thunderbird
CVE-2024-9397
CVE-2024-9397 is a concrete issue: a missing delay in the directory upload UI could enable clickjacking to trick users into granting permissions. Affected products include Firefox (versions prior to 131 and ESR prior to 128.3) and Thunderbird (prior to 131/128.3). Connected advisories (ALSA/ALAS)...
CVE-2019-11712
CVE-2019-11712 describes a vulnerability where NPAPI plugins (e.g., Flash) performing POST requests that follow a 308 redirect can bypass CORS, enabling CSRF. Affected products include Mozilla Firefox ESR < 60.8, Firefox < 68, and Thunderbird
CVE-2019-9800
CVE-2019-9800 is supported by multiple connected advisories indicating memory safety bugs in Mozilla products (Thunderbird 60.x, Firefox ESR 60.x, Firefox 66–67 range) that could allow arbitrary code execution. The root cause is memory safety issues leading to memory corruption; affected versions...
CVE-2020-12392
CVE-2020-12392 is a local vulnerability in Mozilla products where the “Copy as cURL” feature in DevTools network tab could improperly escape HTTP POST data, enabling potential arbitrary local file disclosure when the generated curl command is pasted and run. Affected are Firefox ESR < 68.8, Fi...
CVE-2021-38504
The CVE-2021-38504 issue is a real vulnerability affecting Firefox < 94, Thunderbird < 91.3, and Firefox ESR
CVE-2024-10466
CVE-2024-10466: A specially crafted push message can hang the parent process, making the browser unresponsive. Affected: Firefox < 132, Firefox ESR < 128.4, Thunderbird
CVE-2019-11717
CVE-2019-11717 affects Firefox ESR <60.8, Firefox <68, and Thunderbird
CVE-2023-23601
CVE-2023-23601 is a browser navigation/vulnerability caused by dragging a URL from a cross-origin iframe into the same tab, enabling potential spoofing. Public records confirm impact on Firefox (less than 109) and Firefox ESR (less than 102.7) and Thunderbird (less than 102.7). Multiple advisorie...
CVE-2024-11705
The NSC_DeriveKey function in Firefox and Thunderbird (versions prior to 133) contains a NULL pointer dereference vulnerability. The function incorrectly assumes that the phKey parameter is always non-NULL; however, when passed as NULL, it triggers a segmentation fault (SEGV) , leading to applica...
CVE-2024-9402
Mozilla products, specifically Firefox , Firefox ESR , and Thunderbird , are impacted by memory safety bugs (CWE-119). These vulnerabilities affect versions of Firefox prior to 131, Firefox ESR prior to 128.3, and Thunderbird prior to 128.3 or 131. The flaws may lead to memory corruption , which ...
CVE-2019-11742
CVE-2019-11742 describes a same-origin policy violation enabling theft of cross-origin images via a combination of SVG filters and a element, due to an error in how cached image content is treated. Affected: Firefox versions before 69, Thunderbird before 68.1 (and before 60.9 for ESR branches), ...
CVE-2019-17008
CVE-2019-17008 describes a use-after-free vulnerability that can occur during the destruction of nested workers, leading to a potentially exploitable crash. Affected products include Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox
CVE-2019-9795
CVE-2019-9795 describes a vulnerability in the IonMonkey JIT compiler where a type-confusion could be exploited by malicious JavaScript to trigger a crash. Public references indicate affected products include Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox
CVE-2020-6792
CVE-2020-6792 affects Mozilla Thunderbird prior to 68.5. When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents, a memory-safety issue. The vulnerability is listed against Thunderbird
CVE-2020-6794
CVE-2020-6794 (Thunderbird) : The vulnerability occurs when a user who saved passwords before Thunderbird 60 later sets a master password; an unencrypted copy of those passwords remains accessible because the legacy password file isn’t deleted during data migration to the new format introduced in...
CVE-2020-6797
CVE-2020-6797 describes a macOS-specific issue where downloading a file with the .fileloc extension could cause a semi-privileged extension to launch an arbitrary application on the user’s Mac. The attacker is constrained by the ability to download only quarantined files and cannot pass command-l...
CVE-2024-10463
CVE-2024-10463 identifies a vulnerability where video frames could have been leaked between origins in certain situations. This flaw affects Firefox versions < 132, Firefox ESR < 128.4 (and < 115.17), Thunderbird < 128.4, and Thunderbird
CVE-2024-7522
The editor component in Mozilla products is vulnerable to an out-of-bounds read because the code failed to properly validate an attribute value. This vulnerability affects Firefox versions < 129, Firefox ESR < 115.14 and < 128.1, Thunderbird < 128.1, and Thunderbird
CVE-2024-9399
CVE-2024-9399 describes a denial-of-service in Firefox/Thunderbird caused by a website initiating a specially crafted WebTransport session that crashes the browser. Affected versions: Firefox before 131 and Firefox ESR before 128.3; Thunderbird before 128.3; Thunderbird before 131. The issue is t...
CVE-2020-12417
CVE-2020-12417 is a memory-corruption issue in Firefox/Thunderbird affecting ARM64 JavaScript ValueTags, permitting a cross-boundary pass for ARM64 objects. Affected: Firefox ESR < 68.10, Firefox < 78, and Thunderbird
CVE-2019-9817
CVE-2019-9817 describes cross-origin image access via canvas that can leak image data across domains. Publicly reported impact affects Mozilla products including Thunderbird and Firefox (non-ESR and ESR lines) prior to version thresholds: Thunderbird <60.7, Firefox <67, ESR