CVE-2012-4202

CVE-2012-4202 describes a heap-based buffer overflow in Firefox’s image::RasterImage::DrawFrameTo, exploitable via a crafted GIF image to execute arbitrary code. Affected products include Mozilla Firefox before 17.0, Firefox ESR before 10.0.11 (10.x), Thunderbird before 17.0, Thunderbird ESR befo...

CVE-2017-5413

CVE-2017-5413 : A segmentation fault can occur during bidirectional layout operations in Mozilla Firefox and Thunderbird. Affected products include Firefox and Thunderbird versions earlier than 52 (Firefox 52.x, Thunderbird 52.x) with the root cause described as a crash in bidirectional processin...

CVE-2017-7758

CVE-2017-7758 describes an out-of-bounds read in the Opus encoder when the number of channels in an audio stream changes during encoding. Affected products include Firefox < 54, Firefox ESR < 52.2, and Thunderbird

CVE-2018-5170

CVE-2018-5170 is a vulnerability in Mozilla Thunderbird (including ESR) where an attacker can spoof the filename of an attachment, causing a user to open a remote attachment with an arbitrary file type. Affected products include Thunderbird/Thunderbird ESR before version 52.8. The underlying issu...

CVE-2018-5184

CVE-2018-5184 describes a vulnerability in Mozilla Thunderbird (affecting Thunderbird ESR < 52.8 and Thunderbird

CVE-2012-3967

CVE-2012-3967 is a Firefox/WebGL vulnerability on Linux where the WebGL implementation fails to interact correctly with Mesa drivers when a large number of sampler uniforms are used. This can let remote attackers execute arbitrary code or cause a denial of service (stack memory corruption) via a ...

CVE-2012-5836

CVE-2012-5836 affects Mozilla Firefox (before 17.0), Mozilla Thunderbird (before 17.0), and SeaMonkey (before 2.14). The issue can allow remote code execution or an application crash when CSS properties are combined with SVG text, due to the root cause described by MFSA 2012-94. Public advisories...

CVE-2012-5842

CVE-2012-5842 is a Mozilla Firefox browser engine vulnerability described as multiple unspecified vulnerabilities that can cause memory corruption leading to a crash or possibly remote code execution. Affected products/versions per description: Mozilla Firefox before 17.0, Firefox ESR 10.x before...

CVE-2009-1309

CVE-2009-1309 affects Mozilla Firefox (pre-3.0.9) and its related Mozilla suite components (Thunderbird, SeaMonkey). The issue arises from improper Same Origin Policy handling for XMLHttpRequest (document principal mismatch) and XPCNativeWrapper.toString (incorrect proto scope), enabling cross-si...

CVE-2013-0747

Technical details for CVE-2013-0747 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2013-5615

CVE-2013-5615 concerns GetElementIC typed array stubs being generated outside observed typesets in the Mozilla JavaScript engine. The connected vendor notes identify affected products as Mozilla Firefox (and related Firefox ESR/Thunderbird/SeaMonkey lines in the 2013 MFSA bundle) with fixes imple...

CVE-2018-12368

CVE-2018-12368 describes a policy bypass where Windows 10 does not warn before opening SettingContent-ms files, enabling a WebExtension with downloads.open to execute arbitrary code without user interaction. Connected advisories confirm the issue affects Windows 10 and Mozilla products (Thunderbi...

CVE-2025-5986

CVE-2025-5986 affects Thunderbird. A crafted HTML email that uses mailbox:/// links can trigger automatic, unsolicited downloads of PDF files to the user’s desktop or home directory without prompting, even if auto-saving is disabled. This can lead to disk-space exhaustion and potential credential...

CVE-2012-3992

CVE-2012-3992 affects Mozilla Firefox (and related Firefox-based apps) where history data is not properly handled. The flaw lets remote attackers perform cross-site scripting (XSS) or obtain sensitive POST content via a location.hash write operation combined with history navigation that loads a U...

CVE-2017-5406

CVE-2017-5406 is a memory/segmentation fault in the Skia graphics library triggered during certain canvas operations due to issues with mask/clip intersection and empty masks. Affected products include Mozilla Firefox and Mozilla Thunderbird (Firefox/Thunderbird versions earlier than 52). The roo...

CVE-2025-2830

Thunderbird vulnerability CVE-2025-2830: By crafting a malformed attachment filename in a multipart message, an attacker can coax Thunderbird into exposing a directory listing of /tmp when the message is forwarded or edited as a new message. This can lead to information disclosure from the victim...

CVE-2012-4213

The CVE-2012-4213 issue is a concrete use-after-free vulnerability in Mozilla codepath: nsEditor::FindNextLeafNode affects Firefox and related products. Affected components per the initial description are Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14, with remote...

CVE-2013-0773

CVE-2013-0773 corresponds to a vulnerability in the Chrome Object Wrapper (COW) and System Only Wrapper (SOW) security wrappers in Mozilla-based products. The issue allowed modifications to a prototype, enabling a non-specified remote site to access chrome objects or potentially execute JavaScrip...

CVE-2017-5418

CVE-2017-5418 is an out-of-bounds read error in parsing HTTP digest authorization responses, leading to information leakage. Affected products are Mozilla Firefox and Thunderbird prior to version 52.0. The issue is fixed in Firefox 52.0+ (and related Thunderbird updates per advisories), with reme...

CVE-2017-7752

CVE-2017-7752 is a use-after-free vulnerability triggered by specific user interactions with the input method editor (IME) in certain languages. The flaw is reported to affect Mozilla Firefox versions before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The impacted component is tied ...

CVE-2021-4126

The CVE-2021-4126 issue affects Thunderbird: when receiving an OpenPGP/MIME signed email with an outer MIME layer (e.g., mailing list footer), Thunderbird incorrectly treated inner content as signed. The root cause is that the displayed signature status was based on the inner part; since 91.4.1, ...

CVE-2025-3522

Summary of CVE-2025-3522 (Thunderbird) : Thunderbird improperly processes the X-Mozilla-External-Attachment-URL header used for external attachments. When opening an email, Thunderbird fetches the URL to determine file size and may navigate to it when attaching is clicked. The URL is not validate...

CVE-2012-3994

Mode C: CVE-2012-3994 affects Mozilla Firefox family and related Mozilla components (e.g., Firefox, Firefox ESR, Thunderbird, SeaMonkey). Root cause: use of Object.defineProperty to shadow the top object and interaction with top.location, enabling remote XSS via a binary plugin. Affected versions...

CVE-2012-4181

CVE-2012-4181 is a use-after-free in Mozilla Firefox's nsSMILAnimationController::DoSample that can lead to remote code execution or a denial of service (heap memory corruption). Affected products include Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunde...

CVE-2017-5422

CVE-2017-5422 describes a denial-of-service crash triggered by repeatedly using the view-source: protocol within a single hyperlink. The issue affects Mozilla Firefox and Thunderbird prior to version 52. The root cause is tied to how the view-source: protocol was handled in a chained hyperlink, a...

CVE-2017-7751

CVE-2017-7751 is a use-after-free vulnerability in Mozilla Firefox and Thunderbird associated with content viewer listeners, affecting Firefox versions before 54, ESR before 52.2, and Thunderbird before 52.2. The underlying issue is a memory safety flaw that can lead to a potentially exploitable ...

CVE-2013-0752

Technical details for CVE-2013-0752 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2015-0797

CVE-2015-0797 affects GStreamer up to 1.4.4 (GStreamer 1.4.x) when used by Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux. The flaw is a buffer over-read in H.264 video data processing in the GStreamer pipeline (m4v files) that can cause a denial o...

CVE-2013-0756

CVE-2013-0756 corresponds to a use-after-free in Mozilla Firefox’s obj_toSource path that can be triggered by a crafted web page referencing JavaScript Proxy objects, allowing remote code execution via standard web-visit attack vectors. Affected products include Firefox (pre-18.0), Firefox ESR 17...

CVE-2017-7782

CVE-2017-7782 affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox

CVE-2022-3155

CVE-2022-3155 affects Mozilla Thunderbird and is described as: when saving or opening a mail attachment on macOS, Thunderbird failed to set the com.apple.quarantine attribute on the received file. If the file was an application, opening it could launch the application immediately without user con...

CVE-2012-5841

CVE-2012-5841 affects Mozilla Firefox (before 17.0), Firefox ESR (10.x before 10.0.11), Thunderbird (before 17.0), Thunderbird ESR (before 10.0.11) and SeaMonkey (before 2.14). The issue arises from cross-origin wrappers with a filtering behavior that fails to restrict write actions, enabling rem...

CVE-2016-5294

CVE-2016-5294 : The Mozilla Updater can select an arbitrary target working directory for update-output files, requiring local access and restricting impact to Windows. Affected: Thunderbird < 45.5, Firefox ESR < 45.5, Firefox

CVE-2012-3984

CVE-2012-3984 affects Mozilla Firefox (<16.0), Mozilla Thunderbird (<16.0), and SeaMonkey (

CVE-2017-5426

CVE-2017-5426: On Linux, when seccomp-bpf is active as Gecko Media Plugin sandbox starts, the sandbox may fail to initialize, leaving code that would run in the sandbox only protected by a weaker filter. Affected products are Firefox < 52 and Thunderbird < 52 (Linux only). This can enable s...

CVE-2018-5161

The CVE-2018-5161 issue affects Mozilla Thunderbird (including ESR branches) and is caused by crafted message headers that can cause the Thunderbird process to hang when receiving a message. Public records identify affected versions as Thunderbird ESR < 52.8 and Thunderbird

CVE-2013-0774

CVE-2013-0774 affects Mozilla Firefox

CVE-2013-6673

Technical details about CVE-2013-6673 are not publicly available in the provided connected documents; monitor for updates.

CVE-2017-5414

CVE-2017-5414 affects Mozilla Firefox (and Thunderbird) prior to version 52. The file picker dialog can instantiate and display the wrong local default directory, potentially disclosing OS or local account name. Remediation from connected docs: upgrade to Firefox 52.0+ (and Thunderbird 52.0+ as a...

CVE-2020-15685

CVE-2020-15685 affects Thunderbird prior to 78.7. During the plaintext phase of STARTTLS, protocol commands could be injected and evaluated within the encrypted session. Affected product: Thunderbird (before 78.7). Root cause: insufficient validation during STARTTLS plaintext phase. Impact: poten...

CVE-2013-0762

CVE-2013-0762 is a use-after-free in imgRequest::OnStopFrame affecting Mozilla Firefox prior to 18.0 (and ESR 10.x before 10.0.12, ESR 17.x before 17.0.1), Thunderbird prior to 17.0.2, and SeaMonkey prior to 2.15. It can allow remote code execution or a denial of service via heap memory corruptio...

CVE-2017-5412

CVE-2017-5412 is a buffer overflow read in SVG filter color value processing that results in data exposure. Affected products are Firefox and Thunderbird versions older than 52. The root cause is a memory safety/overflow issue in SVG filter handling. Remediation is to update to Firefox 52.0+ and ...

CVE-2017-7804

CVE-2017-7804 involves the WindowsDllDetourPatcher destructor, which can be repurposed by malicious code in conjunction with other flaws to write arbitrary data to memory under attacker control on Windows. Public advisories for Mozilla Thunderbird and Firefox (MFSA 2017-18/19, MFSA 2017-20) descr...

CVE-2017-7846

CVE-2017-7846 affects Mozilla Thunderbird. The issue arises in parsing RSS feeds when viewed via website or default feed format, allowing JavaScript execution from the parsed feed (feed origin mailbox://). Published mitigations indicate Thunderbird versions up to 52.5.2 are affected, with fixes i...

CVE-2008-4060

CVE-2008-4060 affects Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12). The flaw, exploitable via document.loadBindingDocument and XSLT processing, could allow remote attackers to execute arbitrary code with chrome privileges. Th...

CVE-2012-1938

CVE-2012-1938 affects Mozilla's browser engine and is described in the MiracleLinux AXSA:2012-857 advisory as multiple vulnerabilities in Firefox (and related components) that could allow memory corruption and remote code execution. Specifically, it impacts Mozilla Firefox before 13.0, Thunderbir...

CVE-2012-3988

CVE-2012-3988 is a use-after-free vulnerability in Mozilla Firefox (pre-16.0), Firefox ESR (pre-10.0.8), Thunderbird (pre-16.0), Thunderbird ESR (pre-10.0.8), and SeaMonkey (pre-2.13). It can be triggered via mozRequestFullScreen with full-screen mode and navigation via history.back, potentially ...

CVE-2012-3995

CVE-2012-3995 affects Mozilla Firefox and related Mozilla applications. The vulnerability arises from the IsCSSWordSpacingSpace function in Firefox (and Firefox ESR 10.x, Thunderbird, SeaMonkey as listed) where an out-of-bounds read could be exploited to run arbitrary code or trigger a denial-of-...

CVE-2013-0767

CVE-2013-0767 affects Mozilla Firefox (and related Mozilla components) with the nsSVGPathElement::GetPathLengthScale path handling. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service via an out-of-bounds read, reported for Firefox before 18.0, ESR 10....

CVE-2017-7750

CVE-2017-7750 describes a use-after-free in video control operations when a element holds a reference to an older window that has been replaced in the DOM, leading to a potentially exploitable crash. Affected products and versions from the connected records include Mozilla Firefox < 54, Firef...