CVE-2023-6864

CVE-2023-6864 affects Mozilla Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. The issue is described as memory safety bugs with evidence of memory corruption; with sufficient effort these could be exploited to execute arbitrary code. Impact is high (CVE base score 8.8; confidentiality, int...

CVE-2013-0780

CVE-2013-0780 is a use-after-free vulnerability in Mozilla Firefox related to the nsOverflowContinuationTracker::Finish function. It affects Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. An attacker c...

CVE-2014-1487

CVE-2014-1487 affects Mozilla Firefox (Web workers) and related Mozilla suite components. The issue allows remote attackers to bypass Same Origin Policy and obtain sensitive authentication data via error-message handling in Web workers, affecting Firefox versions before 27.0 (and ESR 24.x before ...

CVE-2023-50762

CVE-2023-50762 affects Thunderbird≤115.5 (specifically Thunderbird

CVE-2013-0768

Technical details for CVE-2013-0768 are not publicly available in the provided documents. Monitor for updates.

CVE-2013-0791

The connected Nessus advisories confirm CVE-2013-0791 affects Mozilla NSS and upstream products via CERT_DecodeCertPackage, allowing remote doS through out-of-bounds reads and memory corruption when processing crafted certificates. Affected: NSS libraries and apps (Firefox before 20.0, ESR 17.x b...

CVE-2017-5451

CVE-2017-5451 describes an address bar spoofing vulnerability via the onblur event, enabling a script to affect text display and make the loaded site appear different from what’s in the address bar. The issue affects Mozilla products including Thunderbird < 52.1, Firefox ESR < 52.1, and Fir...

CVE-2018-5174

CVE-2018-5174 involves Windows Defender SmartScreen honoring the SEE_MASK_FLAG_NO_UI flag, allowing downloaded files to run without UI prompts on Windows 10 April 2018 Update and later. The issue, as documented in NVD and reflected in the connected Nessus/SUSE advisories, notes that Firefox and T...

CVE-2023-37207

The provided connected documents confirm CVE-2023-37207 affects Firefox and Thunderbird (Firefox < 115, ESR < 102.13, Thunderbird

CVE-2025-1936

CVE-2025-1936 is a Firefox/Thunderbird vulnerability where jar: URLs used to retrieve local ZIP contents could misclassify content due to a null-termination issue in the archive, potentially enabling disguised code in a web extension. Affected: Firefox before 136, Firefox ESR before 128.8, Thunde...

CVE-2025-4093

CVE-2025-4093 involves a memory safety bug in Firefox ESR 128.9 and Thunderbird 128.9 that showed memory corruption with potential to enable arbitrary code execution. The vulnerability is fixed in Firefox ESR 128.10 and Thunderbird 128.10. The provided connected documents confirm affected product...

CVE-2013-0760

CVE-2013-0760 describes a buffer overflow in Mozilla Firefox’s CharDistributionAnalysis::HandleOneChar, allowing remote code execution via a crafted document. Affected products per the description: Firefox before 18.0, Thunderbird before 17.0.2, and SeaMonkey before 2.15. Root cause is a memory c...

CVE-2025-4087

Summary: CVE-2025-4087 is a Mozilla Thunderbird/Firefox memory-safety issue in XPath parsing caused by missing null checks during attribute access, leading to undefined behavior and potential out-of-bounds reads. Affected versions: Firefox < 138, Firefox ESR < 128.10, Thunderbird < 138, ...

CVE-2012-0449

CVE-2012-0449 affects Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7. Description: remote attackers can cause memory corruption and application crash, or possibly execute arbitrary code via a malformed XSLT stylesheet emb...

CVE-2018-5144

CVE-2018-5144 describes an integer overflow during Unicode text conversion caused by an unchecked length parameter. Affected products: Firefox ESR and Thunderbird (pre-52.7). Root cause: overflow during Unicode conversion. Impact: potential remote code execution or memory issues as implied by the...

CVE-2009-3983

CVE-2009-3983 affects Mozilla Firefox before 3.0.16 and Firefox 3.5.x before 3.5.6, and SeaMonkey before 2.0.1. The issue allows remote attackers to replay NTLM credentials from a browser user, enabling authenticated requests to arbitrary applications. The vulnerability is described as a credenti...

CVE-2011-1187

CVE-2011-1187 affects Google Chrome prior to 10.0.648.127, allowing remote attackers to bypass the Same Origin Policy via an unspecified error-message leak vector. The vulnerability targets the browser’s SOP checks, enabling cross-origin access that should be restricted. Public sources within the...

CVE-2012-3982

CVE-2012-3982 affects Mozilla Firefox before 16.0, Firefox ESR before 10.0.8, Thunderbird before 16.0, Thunderbird ESR before 10.0.8, and SeaMonkey before 2.13. The description notes multiple unspecified vulnerabilities in the browser engine that can cause memory corruption and application crashe...

CVE-2013-0761

CVE-2013-0761 is a use-after-free vulnerability in Firefox’s mozilla::TrackUnionStream::EndTrack that could allow remote code execution or a denial of service via heap memory corruption. Affected products include Firefox before 18.0 (and ESR 17.x before 17.0.1), Thunderbird before 17.0.2 (and ESR...

CVE-2013-0776

CVE-2013-0776 affects Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. The flaw allows a man-in-the-middle attacker to spoof the address bar by using a proxy server that returns a 407 HTTP status...

CVE-2014-1529

CVE-2014-1529 affects Mozilla Firefox and related Mozilla products (Firefox before 29.0, ESR 24.x before 24.5, Thunderbird before 24.5, SeaMonkey before 2.26). The Web Notification API vulnerability allows remote attackers to bypass source-component restrictions and run arbitrary JavaScript in a ...

CVE-2023-50761

Affected software: Mozilla Thunderbird. Issue: S/MIME signature may be accepted despite mismatching signature creation date with message date/time, enabling impression of a different send date. Root cause: Thunderbird

CVE-2011-3659

CVE-2011-3659 is a use-after-free in Mozilla Firefox (before 3.6.26 and 4.x through 9.0), Thunderbird (before 3.1.18 and 5.0 through 9.0), and SeaMonkey (before 2.7). The root cause is premature notification of AttributeChildRemoved that affects access to removed nsDOMAttribute child nodes, enabl...

CVE-2012-3991

CVE-2012-3991 affects Mozilla Firefox and related Mozilla products: Firefox and Firefox ESR before the 16.0 line, Thunderbird before 16.0, and SeaMonkey before 2.13 did not properly restrict JSAPI GetProperty access, bypassing the Same Origin Policy. This vulnerability could allow remote attacker...

CVE-2013-0749

CVE-2013-0749 describes multiple unspecified vulnerabilities in the Mozilla Firefox browser engine (before 18.0) and related products (Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2 and ESR 17.x before 17.0.1, SeaMonkey before 2.15). The description states that remote attackers could c...

CVE-2013-5618

CVE-2013-5618 is a use-after-free in Mozilla Firefox’s table-editing UI (nsNodeUtils::LastRelease). Affected: Firefox < 26.0, Firefox ESR < 24.2, Thunderbird < 24.2, SeaMonkey

CVE-2017-5403

CVE-2017-5403 affects Mozilla Firefox and Thunderbird prior to version 52.0 (Firefox <52, Thunderbird

CVE-2017-5419

CVE-2017-5419 is a denial-of-service vulnerability affecting Mozilla Firefox and Thunderbird prior to version 52. The issue arises when a malicious page repeatedly triggers a modal authentication prompt, causing the browser UI to become unresponsive. Public references describe this as a DOS condi...

CVE-2018-5145

CVE-2018-5145 concerns memory safety bugs in Mozilla Firefox ESR 52.6 that could lead to memory corruption and potential arbitrary code execution. The vulnerability affects Firefox ESR versions before 52.7 and Thunderbird versions before 52.7. Several distributions document fixes in Thunderbird a...

CVE-2012-4185

CVE-2012-4185 describes a buffer overflow in Mozilla Firefox’s nsCharTraits::length function that could allow remote code execution or a heap memory corruption in Firefox <16.0, ESR 10.x <10.0.8, Thunderbird <16.0/ESR 10.x <10.0.8, and SeaMonkey

CVE-2017-5416

CVE-2017-5416 is a null dereference crash in HttpChannel caused by premature release of a networking event listener in certain Firefox/Thunderbird environments. Concrete details from connected docs show the issue as a memory-access crash stemming from a premature release, affecting Firefox/Firefo...

CVE-2011-3062

CVE-2011-3062 : An off-by-one error in the OpenType Sanitizer used by Google Chrome prior to 18.0.1025.142 allows remote attackers to cause a denial of service or possibly other impact via a crafted OpenType file. The MiracleLinux/OpenSUSE/Oracle Solaris advisories reference this CVE as part of C...

CVE-2012-4188

CVE-2012-4188 is a heap-based buffer overflow in Mozilla Firefox’s Convolve3x3 path, affecting Firefox before 16.0 (and ESR 10.x before 10.0.8), Thunderbird before 16.0 (and ESR 10.x before 10.0.8), and SeaMonkey before 2.13. The vulnerability allows remote code execution via unspecified vectors;...

CVE-2017-5472

CVE-2017-5472 is a use-after-free in Mozilla's frameloader during CSS layout regeneration, leading to potential crash. Concrete details in connected docs show impact on Firefox versions <54, Firefox ESR <52.2, and Thunderbird

CVE-2023-29545

CVE-2023-29545 describes a Windows Save As issue where Firefox/Thunderbird could resolve environment-variable-like names in suggested filenames to the current user context. Affected: Firefox and Thunderbird on Windows; versions affected per the entry are Firefox < 112, Firefox ESR < 102.10,...

CVE-2025-2817

The CVE-2025-2817 issue describes a vulnerability in Thunderbird’s update mechanism where a medium-integrity user process could interfere with the SYSTEM updater by manipulating file-locking, enabling privilege escalation via code injection into a user-privileged process. Affected products includ...

CVE-2009-3984

CVE-2009-3984 affects Mozilla Firefox up to 3.0.16 and Firefox 3.5.x up to 3.5.6, as well as SeaMonkey up to 2.0.1. Root cause: spoofing of the SSL indicator by navigating a document.location to an HTTPS URL that serves a 204 No Content with an empty body, enabling a user-facing location-bar spoo...

CVE-2012-3959

CVE-2012-3959 describes a use-after-free in Mozilla Firefox’s nsRangeUpdater::SelAdjDeleteNode, affecting Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. The vulnerability allows remote attackers to execu...

CVE-2013-0764

CVE-2013-0764 affects Mozilla Firefox (before 18.0), Firefox ESR (before 17.0.2), Thunderbird (before 17.0.2 and ESR 17.x before 17.0.2), and SeaMonkey (before 2.15). The vulnerability is a thread-safety issue in nsSOCKSSocketInfo::ConnectToProxy that can allow remote code execution through craft...

CVE-2017-5421

CVE-2017-5421 is reported as a print preview spoofing issue affecting Mozilla Firefox and Mozilla Thunderbird when popup windows are enabled. The vulnerability description states that a malicious site could spoof the contents of the print preview window, causing user confusion about which site is...

CVE-2017-7749

This CVE-2017-7749 is a use-after-free in the docshell reload path that affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird

CVE-2021-29949

CVE-2021-29949 concerns Thunderbird and the OTR protocol library loading. The issue: during startup, Thunderbird may load a shared OTR library using a filename not distributed by Thunderbird. If a system already hosts a malicious copy of that alternative filename and the library is on the executa...

CVE-2025-5269

CVE-2025-5269 is a memory-safety bug reported in Firefox ESR 128.10 and Thunderbird 128.10 that shows memory corruption and could potentially be exploited to run arbitrary code. Affected products: Firefox ESR < 128.11 and Thunderbird

CVE-2012-4201

CVE-2012-4201 is a concrete Firefox/XULRunner/Thunderbird/SeaMonkey vulnerability: the evalInSandbox path mishandles the context when processing JavaScript that sets location.href, enabling remote XSS or read access to arbitrary files via a sandboxed add-on. Affected software includes Mozilla Fir...

CVE-2012-4207

CVE-2012-4207 affects Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0 / ESR 10.x, and SeaMonkey before 2.14. The flaw in the HZ-GB-2312 charset implementation allows remote attackers to perform cross-site scripting (XSS) via a crafted document, due to imprope...

CVE-2012-4214

CVE-2012-4214 is a use-after-free in Mozilla Firefox’s nsTextEditorState::PrepareEditor, affecting Firefox before 17.0 and ESR 10.x before 10.0.11, Thunderbird before 17.0/ESR 10.x before 10.0.11, and SeaMonkey before 2.14. The vulnerability can allow remote attackers to execute arbitrary code or...

CVE-2013-0745

This CVE (CVE-2013-0745) affects Mozilla Firefox prior to 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. It is caused by the AutoWrapperChanger not interacting correctly with garbage collection, enabling remote code ...

CVE-2018-5185

CVE-2018-5185 is a vulnerability in Mozilla Thunderbird where plaintext of decrypted emails can leak through when a user submits an embedded form. The public descriptions specify the affected products as Thunderbird ESR < 52.8 and Thunderbird

CVE-2023-37208

CVE-2023-37208 affects Firefox (<115), Firefox ESR (<102.13), and Thunderbird (

CVE-2012-4202

CVE-2012-4202 describes a heap-based buffer overflow in Firefox’s image::RasterImage::DrawFrameTo, exploitable via a crafted GIF image to execute arbitrary code. Affected products include Mozilla Firefox before 17.0, Firefox ESR before 10.0.11 (10.x), Thunderbird before 17.0, Thunderbird ESR befo...