1914 matches found
CVE-2020-12405
The CVE-2020-12405 issue is a race condition in Thunderbird/Firefox SharedWorkerService that could cause a crash. It affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR
CVE-2020-26956
CVE-2020-26956 is an XSS issue caused by removing HTML elements during sanitization, which could leave SVG event handlers active. Affected: Firefox <83, Firefox ESR <78.5, Thunderbird
CVE-2021-43543
CVE-2021-43543 is a CSP sandbox bypass where documents loaded with the CSP sandbox directive could escape restrictions by embedding additional content. Affected products include Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox
CVE-2020-15659
CVE-2020-15659 concerns memory safety bugs in Firefox 78 and Firefox ESR 78.x, with potential to run arbitrary code. The entry affects Firefox < 79 and Firefox ESR < 68.11/78.1, and Thunderbird
CVE-2020-26958
The CVE-2020-26958 issue is a MIME-type handling flaw: Firefox did not block script execution when responses with incorrect MIME types were intercepted and cached via a ServiceWorker, enabling a cross-site script inclusion or CSP bypass. Affected products are Firefox (non-ESR) < 83, Firefox ES...
CVE-2025-0241
CVE-2025-0241 is a memory-corruption vulnerability in Mozilla Firefox/Thunderbird caused by faulty text segmentation. Affected products include Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird
CVE-2019-11762
The CVE-2019-11762 issue is a cross-origin origin isolation bug where two same-origin documents setting document.domain differently could allow calling arbitrary DOM methods/getters/setters on the now-cross-origin window. Affected products include Firefox (<70) and Firefox ESR (<68.2), and ...
CVE-2020-15673
CVE-2020-15673 refers to memory-safety bugs reported in Mozilla Firefox (including ESR) and Thunderbird. Affected products and versions include Firefox <81, Firefox ESR <78.3, and Thunderbird
CVE-2020-26951
CVE-2020-26951 involves a parsing and event loading mismatch in Firefox’s SVG code that could allow load events to fire after sanitization, potentially bypassing a built-in sanitizer. Affected products include Firefox < 83, Firefox ESR < 78.5, and Thunderbird
CVE-2020-26961
CVE-2020-26961 describes a DoH-related issue where IPv4 addresses mapped through IPv6 bypass RFC1918 filtering, enabling a DNS rebinding-like condition in Firefox/Thunderbird before versions 83/78.5. Connected sources (CentOS advisories) confirm Mozilla patches addressing multiple issues includin...
CVE-2021-43545
CVE-2021-43545: Denial of Service via the Location API loop in Firefox/Thunderbird. Affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox
CVE-2024-7525
CVE-2024-7525 is linked to a vulnerability in Mozilla Firefox/Thunderbird where a web extension with minimal permissions could create a StreamFilter, enabling reading and modification of response bodies on any site due to a missing permission check when creating the StreamFilter. Affected product...
CVE-2018-18493
CVE-2018-18493 describes a buffer overflow in the Skia library used for hardware-accelerated 2D canvas, caused by 32-bit offset calculations where 64-bit calculations were needed. Affected products include Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox
CVE-2019-11764
CVE-2019-11764 refers to memory safety bugs in Mozilla Firefox (including ESR) and Thunderbird. The issues show evidence of memory corruption and, with sufficient effort, could be exploited to run arbitrary code. Affected products/versions (as stated): Firefox versions before 70, Thunderbird befo...
CVE-2020-6805
CVE-2020-6805 affects Thunderbird (and Firefox) with a use-after-free in the Quota manager when removing data about origins for a recently closed tab, potentially causing a crash. Affected versions include Thunderbird < 68.6 and Firefox < 74/ESR68.6/ESR
CVE-2019-11763
The CVE-2019-11763 entry concerns a parsing defect in handling null bytes in HTML entities, causing Firefox to mis-parse entities and potentially treat HTML comments as code. This could enable XSS in web apps under certain conditions and allow masking of actual characters by filters. Public detai...
CVE-2019-17010
CVE-2019-17010 is a race-condition vulnerability that, during device orientation checks, can cause a use-after-free and a potentially exploitable crash in Thunderbird and Firefox products. It affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox
CVE-2020-12419
CVE-2020-12419 describes a use-after-free in the browser/windowing code: during processing of callbacks in window flushing in the parent process, a window may die, leading to memory corruption and a potentially exploitable crash. Affected products in the provided docs include Thunderbird and Fire...
CVE-2020-12420
CVE-2020-12420 describes a race-condition use-after-free when connecting to a STUN server, leading to memory corruption and potentially exploitable crashes. Affected products include Thunderbird and Firefox variants prior to versions 68.10.x (Thunderbird < 68.10.0; Firefox ESR < 68.10, Fire...
CVE-2021-43542
CVE-2021-43542 is a information-disclosure vulnerability involving XMLHttpRequest: error messages could reveal the existence of an external protocol handler, enabling an attacker to identify installed applications. Connected sources indicate the issue affects Thunderbird < 91.4.0, Firefox ESR ...
CVE-2019-11759
CVE-2019-11759 describes a stack buffer overflow in the HKDF output that could allow code execution or a crash. Affected products include Firefox < 70, Thunderbird < 68.2, and Firefox ESR
CVE-2021-43536
CVE-2021-43536: The connected advisories confirm an information-disclosure/URL leakage flaw triggered when navigating asynchronously in Firefox/Thunderbird prior to fixed releases. Affected: Thunderbird < 91.4.0, Firefox ESR < 91.4.0, Firefox
CVE-2019-11757
CVE-2019-11757 affects Mozilla Firefox (versions before 70) and Firefox ESR (before 68.2) as well as Thunderbird (before 68.2). The issue stems from following a value’s prototype chain, which allowed retaining a reference to a locale, deleting it, and then referencing it again, causing a use-afte...
CVE-2021-43546
CVE-2021-43546 concerns cursor spoofing that could overlay the UI when a native cursor is zoomed. Affected products mentioned across connected documents include Thunderbird < 91.4.0 and Firefox < 95 (including Firefox ESR
CVE-2023-5176
CVE-2023-5176 concerns memory safety bugs in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2, with affected range Firefox <118, ESR <115.3, and Thunderbird
CVE-2010-3765
CVE-2010-3765 is a remote code execution/memory corruption vulnerability in Mozilla’s browser stack (Firefox, SeaMonkey, Thunderbird) triggered when JavaScript runs. Technical root cause involves DOM/frame construction logic, including nsCSSFrameConstructor::ContentAppended, the appendChild path,...
CVE-2020-26978
CVE-2020-26978 is a Firefox/Thunderbird remote-info-exposure vulnerability. A malicious webpage could probe an internal network and access services on the user’s device due to slipstream-based techniques. Affected: Firefox < 84, Thunderbird < 78.6, Firefox ESR
CVE-2018-12405
The CVE-2018-12405 entry is supported by connected advisories showing memory safety bugs in Firefox 63/ESR 60.3 with potential for arbitrary code execution. Affected products include Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox
CVE-2019-11758
CVE-2019-11758 is a memory-safety bug in Mozilla Firefox that can lead to arbitrary code execution when 360 Total Security is installed. The advisory notes it affects Firefox versions before 69, Thunderbird before 68.2, and Firefox ESR before 68.2. Public documentation in connected sources confir...
CVE-2020-35111
CVE-2020-35111 covers a proxy.onRequest handling flaw: when an extension with proxy privileges registers for , view-source URLs fail to trigger the proxy.onRequest callback, potentially leaking the user’s IP when viewing source. Affected: Firefox < 84, Thunderbird < 78.6, Firefox ESR
CVE-2019-11760
CVE-2019-11760 describes a fixed-size stack buffer overflow in nrappkit during WebRTC signaling that could lead to a potentially exploitable crash. The vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR
CVE-2022-31744
CVE-2022-31744 involves an CSS injection flaw that could let an attacker inject CSS into stylesheets accessible via internal URIs (e.g., resource:) and bypass a page's Content Security Policy. Affected products include Firefox ESR < 91.11, Thunderbird < 102, Thunderbird < 91.11, and Fire...
CVE-2019-9793
CVE-2019-9793 describes an issue where, if Spectre mitigations are disabled, bounds checking is loosened for string/array/typed array accesses, enabling an attacker to cause the range analysis to infer controlled, incorrect values in JavaScript. Connected advisories confirm affected products and ...
CVE-2024-9403
CVE-2024-9403 involves memory safety bugs in Firefox 130 that could lead to memory corruption; Mozilla notes these bugs could potentially be exploited to run arbitrary code. The issue affects Firefox versions earlier than 131 and Thunderbird versions earlier than 131. The connected advisories ind...
CVE-2023-5171
CVE-2023-5171 describes a use-after-free in the Ion compiler’s garbage collection that could allow memory corruption and a potentially exploitable crash, by allowing an attacker to write two NUL bytes. Affected products include Firefox and Thunderbird: Firefox ≤ 117.x (with ESR ≤ 115.3) prior to ...
CVE-2020-6795
The CVE-2020-6795 issue is documented in multiple sources as a bug in Thunderbird’s MIME handling: when processing a message with multiple S/MIME signatures, a bug in the MIME processing code caused a null pointer dereference, resulting in a crash. Affected product: Thunderbird, version range bef...
CVE-2021-38498
The CVE-2021-38498 entry describes a use-after-free of the nsLanguageAtomService (languages service object) during process shutdown, causing memory corruption and potentially a crash. Affected products include Firefox < 93, Thunderbird < 91.2, and Firefox ESR
CVE-2018-18498
CVE-2018-18498 is an integer overflow vulnerability in image buffer size calculations that can cause out-of-bounds writes. The description in connected advisories ties this CVE to Thunderbird and Firefox families (Thunderbird < 60.4, Firefox ESR < 60.4, Firefox
CVE-2020-15663
CVE-2020-15663 targets Mozilla Firefox (and related Thunderbird/Firefox ESR components) on Windows when Firefox is installed in a user-writable directory. The Mozilla Maintenance Service could invoke updater.exe from the install location with SYSTEM privileges, potentially after rollback to a pre...
CVE-2023-5169
CVE-2023-5169 (Firefox/Thunderbird) involves a compromised content process that could feed malicious data into PathRecording, causing an out-of-bounds write and potentially a crash in a privileged process. Affected products include Firefox <118, Firefox ESR <115.3, and Thunderbird
CVE-2018-18494
CVE-2018-18494 is a same-origin policy violation in Thunderbird/Firefox components caused by using the location property with performance.getEntries to steal cross-origin URL entries. Affected: Thunderbird < 60.4, Firefox ESR < 60.4, Firefox
CVE-2020-15654
CVE-2020-15654 affects Mozilla Firefox and Thunderbird where a site-based CSS-override cursor can overlay the UI, causing a perceived broken state and interfering with dialogs. Affected: Firefox ESR earlier than 78.1, Firefox earlier than 79, and Thunderbird earlier than 78.1. Root cause: an erro...
CVE-2020-26953
CVE-2020-26953 : A vulnerability allowing a browser to enter fullscreen mode without displaying the security UI, enabling potential phishing or user confusion. Affected: Firefox < 83, Firefox ESR < 78.5, Thunderbird
CVE-2020-12393
CVE-2020-12393 affects Firefox on Windows (and related Mozilla products) where the Devtools Network tab’s Copy as cURL feature failed to properly escape the HTTP method, allowing a website-controlled method to be injected into a pasted terminal command and potentially leading to arbitrary command...
CVE-2020-6793
Thunderbird is affected by CVE-2020-6793 (memory read bug) in processing emails with an ill-formed envelope, impacting versions older than 68.5. The issue involves reading data from a random memory location due to a memory-safety flaw in envelope handling. Affected product: Thunderbird pre-68.5. ...
CVE-2021-23964
CVE-2021-23964 corresponds to memory-safety bugs in Mozilla Firefox 84 and Firefox ESR 78.6 that could enable memory corruption and potentially arbitrary code execution. Affected products include Firefox <85, Thunderbird <78.7, and Firefox ESR
CVE-2020-15657
CVE-2020-15657 is a Windows-specific DLL hijacking flaw in Mozilla Firefox (and Thunderbird) where attacker-controlled DLLs in the installation directory could be loaded. Affected: Firefox ESR < 78.1, Firefox < 79, Thunderbird
CVE-2020-15658
The CVE-2020-15658 issue affects Mozilla Firefox (non-ESR < 79) and Firefox ESR < 78.1, and Thunderbird
CVE-2020-12418
CVE-2020-12418 describes a flaw where manipulating individual parts of a URL object could cause an out-of-bounds read, leaking process memory to malicious JavaScript. Affected products per the provided data include Firefox ESR < 68.10, Firefox < 78, and Thunderbird