CVE-2012-3960

CVE-2012-3960 is a use-after-free in mozSpellChecker::SetCurrentDictionary that affects Mozilla Firefox <15.0, Firefox ESR <10.0.7, Thunderbird <15.0 / ESR, and SeaMonkey

CVE-2013-5613

Mode C: Detailed vulnerability note for CVE-2013-5613. Affected product/variant: Mozilla Firefox components shipped in MiracleLinux 3 (firefox-24.4.0-1.0.1.AXS3) per AXSA:2014-233:01. Root cause: Use-after-free in PresShell::DispatchSynthMouseMove, linked to RestyleManager::GetHoverGeneration, en...

CVE-2023-6864

CVE-2023-6864 affects Mozilla Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. The issue is described as memory safety bugs with evidence of memory corruption; with sufficient effort these could be exploited to execute arbitrary code. Impact is high (CVE base score 8.8; confidentiality, int...

CVE-2025-1936

CVE-2025-1936 is a Firefox/Thunderbird vulnerability where jar: URLs used to retrieve local ZIP contents could misclassify content due to a null-termination issue in the archive, potentially enabling disguised code in a web extension. Affected: Firefox before 136, Firefox ESR before 128.8, Thunde...

CVE-2013-0780

CVE-2013-0780 is a use-after-free vulnerability in Mozilla Firefox related to the nsOverflowContinuationTracker::Finish function. It affects Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. An attacker c...

CVE-2009-3983

CVE-2009-3983 affects Mozilla Firefox before 3.0.16 and Firefox 3.5.x before 3.5.6, and SeaMonkey before 2.0.1. The issue allows remote attackers to replay NTLM credentials from a browser user, enabling authenticated requests to arbitrary applications. The vulnerability is described as a credenti...

CVE-2013-0768

Technical details for CVE-2013-0768 are not publicly available in the provided documents. Monitor for updates.

CVE-2017-5467

CVE-2017-5467 affects Mozilla Firefox and Thunderbird, with memory corruption when drawing Skia content outside the clipping region. Affected: Firefox (<53) and Thunderbird (

CVE-2017-5472

CVE-2017-5472 is a use-after-free in Mozilla's frameloader during CSS layout regeneration, leading to potential crash. Concrete details in connected docs show impact on Firefox versions <54, Firefox ESR <52.2, and Thunderbird

CVE-2025-1935

CVE-2025-1935 is described in connected advisories as a UI/protocol-handler spoof affecting Firefox and Thunderbird before versions 136 (Firefox) / 128.8 (Firefox ESR) and before 136 (Thunderbird) / 128.8 (Thunderbird). The issue allows a malicious web page to coax a user into setting that site a...

CVE-2018-18499

CVE-2018-18499 is a same-origin policy vulnerability in Mozilla Firefox and Thunderbird where a page using a meta http-equiv="refresh" redirects to another site and allows theft of cross-origin URL entries via performance.getEntries(). Affected: Firefox < 62, Firefox ESR < 60.2, Thunderbird

CVE-2013-0760

CVE-2013-0760 describes a buffer overflow in Mozilla Firefox’s CharDistributionAnalysis::HandleOneChar, allowing remote code execution via a crafted document. Affected products per the description: Firefox before 18.0, Thunderbird before 17.0.2, and SeaMonkey before 2.15. Root cause is a memory c...

CVE-2013-0776

CVE-2013-0776 affects Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. The flaw allows a man-in-the-middle attacker to spoof the address bar by using a proxy server that returns a 407 HTTP status...

CVE-2013-0791

The connected Nessus advisories confirm CVE-2013-0791 affects Mozilla NSS and upstream products via CERT_DecodeCertPackage, allowing remote doS through out-of-bounds reads and memory corruption when processing crafted certificates. Affected: NSS libraries and apps (Firefox before 20.0, ESR 17.x b...

CVE-2017-5451

CVE-2017-5451 describes an address bar spoofing vulnerability via the onblur event, enabling a script to affect text display and make the loaded site appear different from what’s in the address bar. The issue affects Mozilla products including Thunderbird < 52.1, Firefox ESR < 52.1, and Fir...

CVE-2011-1187

CVE-2011-1187 affects Google Chrome prior to 10.0.648.127, allowing remote attackers to bypass the Same Origin Policy via an unspecified error-message leak vector. The vulnerability targets the browser’s SOP checks, enabling cross-origin access that should be restricted. Public sources within the...

CVE-2012-4185

CVE-2012-4185 describes a buffer overflow in Mozilla Firefox’s nsCharTraits::length function that could allow remote code execution or a heap memory corruption in Firefox <16.0, ESR 10.x <10.0.8, Thunderbird <16.0/ESR 10.x <10.0.8, and SeaMonkey

CVE-2013-0749

CVE-2013-0749 describes multiple unspecified vulnerabilities in the Mozilla Firefox browser engine (before 18.0) and related products (Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2 and ESR 17.x before 17.0.1, SeaMonkey before 2.15). The description states that remote attackers could c...

CVE-2018-5144

CVE-2018-5144 describes an integer overflow during Unicode text conversion caused by an unchecked length parameter. Affected products: Firefox ESR and Thunderbird (pre-52.7). Root cause: overflow during Unicode conversion. Impact: potential remote code execution or memory issues as implied by the...

CVE-2023-37207

The provided connected documents confirm CVE-2023-37207 affects Firefox and Thunderbird (Firefox < 115, ESR < 102.13, Thunderbird

CVE-2025-2817

The CVE-2025-2817 issue describes a vulnerability in Thunderbird’s update mechanism where a medium-integrity user process could interfere with the SYSTEM updater by manipulating file-locking, enabling privilege escalation via code injection into a user-privileged process. Affected products includ...

CVE-2011-3659

CVE-2011-3659 is a use-after-free in Mozilla Firefox (before 3.6.26 and 4.x through 9.0), Thunderbird (before 3.1.18 and 5.0 through 9.0), and SeaMonkey (before 2.7). The root cause is premature notification of AttributeChildRemoved that affects access to removed nsDOMAttribute child nodes, enabl...

CVE-2012-0449

CVE-2012-0449 affects Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7. Description: remote attackers can cause memory corruption and application crash, or possibly execute arbitrary code via a malformed XSLT stylesheet emb...

CVE-2012-3982

CVE-2012-3982 affects Mozilla Firefox before 16.0, Firefox ESR before 10.0.8, Thunderbird before 16.0, Thunderbird ESR before 10.0.8, and SeaMonkey before 2.13. The description notes multiple unspecified vulnerabilities in the browser engine that can cause memory corruption and application crashe...

CVE-2012-3991

CVE-2012-3991 affects Mozilla Firefox and related Mozilla products: Firefox and Firefox ESR before the 16.0 line, Thunderbird before 16.0, and SeaMonkey before 2.13 did not properly restrict JSAPI GetProperty access, bypassing the Same Origin Policy. This vulnerability could allow remote attacker...

CVE-2017-7751

CVE-2017-7751 is a use-after-free vulnerability in Mozilla Firefox and Thunderbird associated with content viewer listeners, affecting Firefox versions before 54, ESR before 52.2, and Thunderbird before 52.2. The underlying issue is a memory safety flaw that can lead to a potentially exploitable ...

CVE-2018-5145

CVE-2018-5145 concerns memory safety bugs in Mozilla Firefox ESR 52.6 that could lead to memory corruption and potential arbitrary code execution. The vulnerability affects Firefox ESR versions before 52.7 and Thunderbird versions before 52.7. Several distributions document fixes in Thunderbird a...

CVE-2018-5174

CVE-2018-5174 involves Windows Defender SmartScreen honoring the SEE_MASK_FLAG_NO_UI flag, allowing downloaded files to run without UI prompts on Windows 10 April 2018 Update and later. The issue, as documented in NVD and reflected in the connected Nessus/SUSE advisories, notes that Firefox and T...

CVE-2023-50761

Affected software: Mozilla Thunderbird. Issue: S/MIME signature may be accepted despite mismatching signature creation date with message date/time, enabling impression of a different send date. Root cause: Thunderbird

CVE-2012-4202

CVE-2012-4202 describes a heap-based buffer overflow in Firefox’s image::RasterImage::DrawFrameTo, exploitable via a crafted GIF image to execute arbitrary code. Affected products include Mozilla Firefox before 17.0, Firefox ESR before 10.0.11 (10.x), Thunderbird before 17.0, Thunderbird ESR befo...

CVE-2012-4214

CVE-2012-4214 is a use-after-free in Mozilla Firefox’s nsTextEditorState::PrepareEditor, affecting Firefox before 17.0 and ESR 10.x before 10.0.11, Thunderbird before 17.0/ESR 10.x before 10.0.11, and SeaMonkey before 2.14. The vulnerability can allow remote attackers to execute arbitrary code or...

CVE-2013-5618

CVE-2013-5618 is a use-after-free in Mozilla Firefox’s table-editing UI (nsNodeUtils::LastRelease). Affected: Firefox < 26.0, Firefox ESR < 24.2, Thunderbird < 24.2, SeaMonkey

CVE-2014-1529

CVE-2014-1529 affects Mozilla Firefox and related Mozilla products (Firefox before 29.0, ESR 24.x before 24.5, Thunderbird before 24.5, SeaMonkey before 2.26). The Web Notification API vulnerability allows remote attackers to bypass source-component restrictions and run arbitrary JavaScript in a ...

CVE-2017-5419

CVE-2017-5419 is a denial-of-service vulnerability affecting Mozilla Firefox and Thunderbird prior to version 52. The issue arises when a malicious page repeatedly triggers a modal authentication prompt, causing the browser UI to become unresponsive. Public references describe this as a DOS condi...

CVE-2011-3062

CVE-2011-3062 : An off-by-one error in the OpenType Sanitizer used by Google Chrome prior to 18.0.1025.142 allows remote attackers to cause a denial of service or possibly other impact via a crafted OpenType file. The MiracleLinux/OpenSUSE/Oracle Solaris advisories reference this CVE as part of C...

CVE-2012-4188

CVE-2012-4188 is a heap-based buffer overflow in Mozilla Firefox’s Convolve3x3 path, affecting Firefox before 16.0 (and ESR 10.x before 10.0.8), Thunderbird before 16.0 (and ESR 10.x before 10.0.8), and SeaMonkey before 2.13. The vulnerability allows remote code execution via unspecified vectors;...

CVE-2013-0764

CVE-2013-0764 affects Mozilla Firefox (before 18.0), Firefox ESR (before 17.0.2), Thunderbird (before 17.0.2 and ESR 17.x before 17.0.2), and SeaMonkey (before 2.15). The vulnerability is a thread-safety issue in nsSOCKSSocketInfo::ConnectToProxy that can allow remote code execution through craft...

CVE-2023-29545

CVE-2023-29545 describes a Windows Save As issue where Firefox/Thunderbird could resolve environment-variable-like names in suggested filenames to the current user context. Affected: Firefox and Thunderbird on Windows; versions affected per the entry are Firefox < 112, Firefox ESR < 102.10,...

CVE-2023-37208

CVE-2023-37208 affects Firefox (<115), Firefox ESR (<102.13), and Thunderbird (

CVE-2012-3959

CVE-2012-3959 describes a use-after-free in Mozilla Firefox’s nsRangeUpdater::SelAdjDeleteNode, affecting Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. The vulnerability allows remote attackers to execu...

CVE-2012-4207

CVE-2012-4207 affects Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0 / ESR 10.x, and SeaMonkey before 2.14. The flaw in the HZ-GB-2312 charset implementation allows remote attackers to perform cross-site scripting (XSS) via a crafted document, due to imprope...

CVE-2013-0745

This CVE (CVE-2013-0745) affects Mozilla Firefox prior to 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. It is caused by the AutoWrapperChanger not interacting correctly with garbage collection, enabling remote code ...

CVE-2013-0761

CVE-2013-0761 is a use-after-free vulnerability in Firefox’s mozilla::TrackUnionStream::EndTrack that could allow remote code execution or a denial of service via heap memory corruption. Affected products include Firefox before 18.0 (and ESR 17.x before 17.0.1), Thunderbird before 17.0.2 (and ESR...

CVE-2017-5403

CVE-2017-5403 affects Mozilla Firefox and Thunderbird prior to version 52.0 (Firefox <52, Thunderbird

CVE-2017-5421

CVE-2017-5421 is reported as a print preview spoofing issue affecting Mozilla Firefox and Mozilla Thunderbird when popup windows are enabled. The vulnerability description states that a malicious site could spoof the contents of the print preview window, causing user confusion about which site is...

CVE-2012-3992

CVE-2012-3992 affects Mozilla Firefox (and related Firefox-based apps) where history data is not properly handled. The flaw lets remote attackers perform cross-site scripting (XSS) or obtain sensitive POST content via a location.hash write operation combined with history navigation that loads a U...

CVE-2012-4201

CVE-2012-4201 is a concrete Firefox/XULRunner/Thunderbird/SeaMonkey vulnerability: the evalInSandbox path mishandles the context when processing JavaScript that sets location.href, enabling remote XSS or read access to arbitrary files via a sandboxed add-on. Affected software includes Mozilla Fir...

CVE-2017-5416

CVE-2017-5416 is a null dereference crash in HttpChannel caused by premature release of a networking event listener in certain Firefox/Thunderbird environments. Concrete details from connected docs show the issue as a memory-access crash stemming from a premature release, affecting Firefox/Firefo...

CVE-2009-1309

CVE-2009-1309 affects Mozilla Firefox (pre-3.0.9) and its related Mozilla suite components (Thunderbird, SeaMonkey). The issue arises from improper Same Origin Policy handling for XMLHttpRequest (document principal mismatch) and XPCNativeWrapper.toString (incorrect proto scope), enabling cross-si...

CVE-2012-3967

CVE-2012-3967 is a Firefox/WebGL vulnerability on Linux where the WebGL implementation fails to interact correctly with Mesa drivers when a large number of sampler uniforms are used. This can let remote attackers execute arbitrary code or cause a denial of service (stack memory corruption) via a ...