CVE-2020-26966

CVE-2020-26966 affects Mozilla Firefox (Windows only) and Thunderbird; the issue arises from a memory leak via broadcasting of single-word search queries as mDNS requests on the local network. Affected products include Firefox before version 83, Firefox ESR before 78.5, and Thunderbird before 78....

CVE-2021-43542

CVE-2021-43542 is a information-disclosure vulnerability involving XMLHttpRequest: error messages could reveal the existence of an external protocol handler, enabling an attacker to identify installed applications. Connected sources indicate the issue affects Thunderbird < 91.4.0, Firefox ESR ...

CVE-2020-15677

CVE-2020-15677 is an Open Redirect vulnerability affecting Firefox < 81, Thunderbird < 78.3, and Firefox ESR

CVE-2012-0444

CVE-2012-0444 describes a heap-based memory corruption vulnerability in the libvorbis Ogg Vorbis parser that could allow remote code execution or a crash when processing crafted Ogg Vorbis files. Affected products across Mozilla ecosystem (Firefox, Thunderbird, Seamonkey and related XULRunner/Ice...

CVE-2013-0753

CVE-2013-0753 is a Use‑after‑free vulnerability in Mozilla Firefox’s XMLSerializer.serializeToStream, affecting Firefox before 18.0 (and ESR/Thunderbird/SeaMonkey variants) and allowing remote code execution via crafted content. The issue is exploitable as part of Firefox 17.x lineage; Metasploit...

CVE-2020-26973

The provided connected sources confirm CVE-2020-26973 affects Mozilla Firefox and Thunderbird, tied to the CSS Sanitizer. Affected versions include Firefox prior to 84 and Thunderbird prior to 78.6 (Firefox ESR

CVE-2022-45403

CVE-2022-45403 describes a vulnerability where Service Workers could infer the size of cross-origin media by correlating timing information with Range requests, potentially exposing presence/length of a media file. Affected: Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox

CVE-2023-4584

CVE-2023-4584 relates to memory safety bugs in Firefox and Thunderbird affecting multiple versions (e.g., Firefox 116/ESR 102.x/ Thunderbird 102.x/115.x). Connected advisories confirm the issue and map to Firefox/Thunderbird versions and the remediation path: upgrade to Firefox 117 or ESR 102.15/...

CVE-2023-4585

CVE-2023-4585 describes memory safety bugs in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1, with evidence of memory corruption and the potential for arbitrary code execution. Affected versions are Firefox < 117, Firefox ESR < 115.2, and Thunderbird

CVE-2020-15654

CVE-2020-15654 affects Mozilla Firefox and Thunderbird where a site-based CSS-override cursor can overlay the UI, causing a perceived broken state and interfering with dialogs. Affected: Firefox ESR earlier than 78.1, Firefox earlier than 79, and Thunderbird earlier than 78.1. Root cause: an erro...

CVE-2021-29957

Thunderbird

CVE-2023-4581

CVE-2023-4581 covers a blocklist gap where Excel .xll add-in files could be downloaded without warnings due to Firefox’s executable blocklist lacking an entry. Affected products/versions shown in the documents: Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 10...

CVE-2019-11755

CVE-2019-11755 affects Mozilla Thunderbird. A crafted S/MIME message can be shown as having a valid signature when the inner encryption layer is present and the signer did not access the message contents, enabling spoofing of the message author. The issue is tied to Thunderbird versions prior to ...

CVE-2020-15670

CVE-2020-15670 involves memory safety bugs in Mozilla Firefox components, affecting Firefox for Android 79 and other Firefox variants prior to 80, including Firefox ESR < 78.2 and Thunderbird

CVE-2020-35112

CVE-2020-35112 is a Windows-specific issue in Mozilla Firefox (affecting Firefox <84, Thunderbird <78.6, and Firefox ESR

CVE-2020-15676

CVE-2020-15676 affects Firefox (and related Mozilla products) where the onload handler for SVG elements could run after the DOM sanitizer removed content, enabling JavaScript execution when pasting attacker-controlled data into a contenteditable area. Affected versions: Firefox < 81, Thunderbi...

CVE-2023-5169

CVE-2023-5169 (Firefox/Thunderbird) involves a compromised content process that could feed malicious data into PathRecording, causing an out-of-bounds write and potentially a crash in a privileged process. Affected products include Firefox <118, Firefox ESR <115.3, and Thunderbird

CVE-2018-12392

CVE-2018-12392 is a vulnerability affecting Firefox (pre-63 and ESR pre-60.3) and Thunderbird (pre-60.3) where manipulating user events in nested loops while opening a document via script can trigger a crash due to poor event handling. Public advisories list the impact as a potentially exploitabl...

CVE-2019-11758

CVE-2019-11758 is a memory-safety bug in Mozilla Firefox that can lead to arbitrary code execution when 360 Total Security is installed. The advisory notes it affects Firefox versions before 69, Thunderbird before 68.2, and Firefox ESR before 68.2. Public documentation in connected sources confir...

CVE-2020-12398

CVE-2020-12398 affects Mozilla Thunderbird when STARTTLS is used for IMAP and the server sends PREAUTH, causing Thunderbird to proceed with an unencrypted connection and expose email data. Impact is described as information leakage due to unencrypted transmission; affected versions are Thunderbir...

CVE-2013-0758

CVE-2013-0758 affects Mozilla Firefox (pre-18.0), Firefox ESR (pre-10.0.12 and pre-17.0.2), Thunderbird (pre-17.0.2, including ESR 10.x pre-10.0.12 and pre-17.0.2), and SeaMonkey (pre-2.15). It allows remote attackers to execute arbitrary JavaScript with chrome privileges due to improper interact...

CVE-2020-15655

CVE-2020-15655 affects Mozilla Firefox (including ESR) and Thunderbird, where a redirected HTTP request observed or modified through a web extension could bypass Same-Origin Policy via extension APIs, potentially disclosing cross-origin information. Affected versions include Firefox ESR <78.1,...

CVE-2023-4573

The CVE-2023-4573 issue is a memory corruption/use-after-free in Mozilla's IPC path (mStream) that can be triggered when rendering data is received via IPC. Connected documents confirm affected products include Firefox and Thunderbird (multiple ESR branches) with vulnerable components tied to IPC...

CVE-2023-4580

CVE-2023-4580 : Pushed notifications stored on disk in private browsing mode were not encrypted, potentially leaking sensitive information. Affected: Firefox < 117, Firefox ESR < 115.2, Thunderbird

CVE-2023-5168

CVE-2023-5168 refers to a vulnerability in Firefox on Windows where a compromised content process could supply malicious data to FilterNodeD2D1, causing an out-of-bounds write and potentially crashing a privileged process. The entry notes a high/critical risk with a base score of 9.8 (CVSSv3.1) a...

CVE-2023-4583

CVE-2023-4583 concerns a logic issue in the HTTP/Browsing Context handling within Mozilla Firefox/Thunderbird. The flaw occurs when HttpBaseChannel checks whether a Browsing Context has been discarded; if the load group is unavailable, it may assume discard even for private channels after a priva...

CVE-2023-3417

CVE-2023-3417 affects Mozilla Thunderbird. The issue arises from the Text Direction Override Unicode Character in filenames, which could cause an email attachment to appear as a non-executable document when it was actually an executable. Affected: Thunderbird versions before 115.0.1 and before 10...

CVE-2019-9801

CVE-2019-9801 affects Mozilla Firefox and Thunderbird on Windows. The issue allows Firefox/Thunderbird to treat any registered Program ID as an external protocol handler and offer to launch a local application when a matching URL is opened, even if the program is not intended as a URL handler. Ro...

CVE-2019-9818

CVE-2019-9818 is a use-after-free in the crash generation server used by Mozilla Firefox/Thunderbird on Windows. The issue, described as a race condition in the crash reporter server, can lead to a potentially exploitable crash and sandbox escape. Public references indicate the vulnerability affe...

CVE-2023-4574

CVE-2023-4574 involves a use-after-free in the IPC ColorPickerShownCallback: creating multiple identical callbacks for the Color Picker over IPC, then destroying them all when one finishes. Affected: Firefox < 117, Firefox ESR < 102.15/115.2, Thunderbird

CVE-2021-38498

The CVE-2021-38498 entry describes a use-after-free of the nsLanguageAtomService (languages service object) during process shutdown, causing memory corruption and potentially a crash. Affected products include Firefox < 93, Thunderbird < 91.2, and Firefox ESR

CVE-2023-25751

CVE-2023-25751 affects Firefox and Thunderbird: root cause is incorrect code generation during JIT code invalidation when following an iterator, which could lead to a potentially exploitable crash. Affected: Firefox <=111 and Firefox ESR <=102.8/9, Thunderbird

CVE-2023-4578

CVE-2023-4578 affects Firefox and Thunderbird: a failure in JS::CheckRegExpSyntax could mishandle an out-of-memory (OOM) condition as a Syntax Error, potentially leading to crashes. Affected versions are Firefox < 117, Firefox ESR < 115.2, and Thunderbird

CVE-2019-11739

CVE-2019-11739 affects Mozilla Thunderbird; encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a HTML reply/forward. Affected versions: Thunderbird < 68.1 and Thunderbird

CVE-2021-29981

CVE-2021-29981 affects Firefox < 91 and Thunderbird

CVE-2009-2408

CVE-2009-2408 affects Mozilla NSS up to 3.12.2/Firefox up to 3.0.12/ Thunderbird up to 2.0.0.22 and SeaMonkey up to 1.1.17. The issue is improper handling of a '\0' character in the domain name present in the certificate subject’s Common Name (CN) field of an X.509 certificate. This enables a man...

CVE-2023-5728

CVE-2023-5728 : In the Firefox/Thunderbird stack, during garbage collection extra operations on an object that should not be touched could lead to a potentially exploitable crash. Affected: Firefox < 119, Firefox ESR < 115.4, and Thunderbird

CVE-2019-11694

CVE-2019-11694 is a Windows-only vulnerability in the Mozilla Firefox/Thunderbird stack where an uninitialized memory value can leak from a broker into a renderer when accessing an otherwise unavailable file in the Windows sandbox. Affected products include Thunderbird < 60.7, Firefox < 67,...

CVE-2021-43528

CVE-2021-43528 : Thunderbird before 91.4.0 enables JavaScript in the composition area. The JS context is restricted to that area with no chrome privileges but could serve as a stepping stone to further attacks involving other vulnerabilities. Affected: Thunderbird

CVE-2023-4575

CVE-2023-4575 describes a memory safety risk in Mozilla components where IPC FilePickerShownCallback could suffer a use-after-free due to multiple identical callbacks being created and destroyed concurrently during File Picker window invocation. Affected products include Firefox (all listed varia...

CVE-2024-0741

CVE-2024-0741 describes an out-of-bounds write in ANGLE that could corrupt memory and cause a potentially exploitable crash. Affected software includes Firefox up to version 121/122 and Firefox ESR up to 115.7, as well as Thunderbird up to 115.7. The connected advisories indicate the root cause i...

CVE-2011-0084

CVE-2011-0084 affects Mozilla Firefox prior to 3.6.20 and 4.x–5, Thunderbird 3.x prior to 3.1.12 and other versions before 6, SeaMonkey 2.x before 2.3, and possibly other Mozilla products. The underlying issue is in SVGTextElement.getCharNumAtPosition where SVG text is not handled correctly, allo...

CVE-2021-38501

CVE-2021-38501 is a memory-safety issue affecting Firefox up to version 92/ESR 91.1 with memory-corruption risks; impacted products include Firefox <93, Thunderbird <91.2, and Firefox ESR

CVE-2017-5390

CVE-2017-5390 concerns the JSON viewer in Mozilla/Thunderbird Developer Tools that uses insecure methods to copy/view JSON or HTTP header data, enabling potential privilege escalation. Concrete details in connected docs show this affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox

CVE-2023-4577

CVE-2023-4577 is a memory-corruption issue in the Firefox/Thunderbird code path where UpdateRegExpStatics could access initialStringHeap after it had been garbage collected, potentially causing an exploitable crash. Connected advisories corroborate that affected products include Firefox versions ...

CVE-2018-12390

CVE-2018-12390 corresponds to memory-safety bugs in Mozilla Firefox and Thunderbird prior to patched versions. Affected: Firefox < 63, Firefox ESR < 60.3, Thunderbird

CVE-2023-29536

The CVE-2023-29536 entry applies to Mozilla products (Firefox, Focus, Thunderbird, Firefox ESR, and Firefox for Android) with memory-management weakness in freeing a pointer to attacker-controlled memory. Impacted versions include Firefox <112, Focus for Android <112, Firefox ESR <102.10...

CVE-2021-29948

Thunderbird prior to 78.10.0 is affected by CVE-2021-29948, where signatures are written to disk before verification and may be at risk of a race condition if a local attacker replaces the file. Impact includes potential signature forgery; remediation is to upgrade Thunderbird to 78.10.0 or newer...

CVE-2021-29951

CVE-2021-29951 involves the Mozilla Maintenance Service granting SERVICE_START access to BUILTIN|Users, enabling domain users to start/stop the browser update service. Affected: Windows systems older than Windows 10 build 1709; Firefox prior to 87 and Firefox ESR prior to 78.10.1, Thunderbird pri...

CVE-2023-0430

CVE-2023-0430 affects Thunderbird (68–102.7.0) where the OCSP revocation status of S/MIME certificates was not checked during signature verification, causing mail signed with a revoked certificate to appear valid. Public references in the provided documents confirm Thunderbird