CVE-2013-6673

Technical details about CVE-2013-6673 are not publicly available in the provided connected documents; monitor for updates.

CVE-2017-7754

CVE-2017-7754 is an out-of-bounds read in WebGL when processing a malicious ImageInfo object during WebGL operations. Affected products/versions per connected docs: Firefox versions prior to 54 and Firefox ESR prior to 52.2, and Thunderbird prior to 52.2. The vulnerability stems from an improper ...

CVE-2013-6671

CVE-2013-6671 affects Mozilla Firefox before 26.0 (and corresponding ESR/Thunderbird/SeaMonkey releases listed) where nsGfxScrollFrameInner::IsLTR can be abused by crafted JavaScript used with ordered list elements to trigger remote code execution. The vulnerability is a browser-engine issue that...

CVE-2026-7320

CVE-2026-7320 involves an information disclosure in the Firefox Audio/Video component caused by incorrect boundary conditions. Affected products are Firefox desktop browser (and ESR branches). The vulnerability allows information disclosure with high confidentiality impact (per CVSS: AV:N/AC:L/PR...

CVE-2013-0762

CVE-2013-0762 is a use-after-free in imgRequest::OnStopFrame affecting Mozilla Firefox prior to 18.0 (and ESR 10.x before 10.0.12, ESR 17.x before 17.0.1), Thunderbird prior to 17.0.2, and SeaMonkey prior to 2.15. It can allow remote code execution or a denial of service via heap memory corruptio...

CVE-2018-5161

The CVE-2018-5161 issue affects Mozilla Thunderbird (including ESR branches) and is caused by crafted message headers that can cause the Thunderbird process to hang when receiving a message. Public records identify affected versions as Thunderbird ESR < 52.8 and Thunderbird

CVE-2026-2447

CVE-2026-2447 describes a heap buffer overflow in libvpx that affects components used by Firefox and Thunderbird. The Initial Description notes fixes in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2. Connected documents corroborate the sa...

CVE-2012-3989

CVE-2012-3989 affects Mozilla Firefox (and related Mozilla products) prior to version 16.0, Thunderbird prior to 16.0, and SeaMonkey prior to 2.13. The vulnerability is a crash caused by an invalid cast when using the instanceof operator on certain JavaScript objects, which could allow remote att...

CVE-2017-7804

CVE-2017-7804 involves the WindowsDllDetourPatcher destructor, which can be repurposed by malicious code in conjunction with other flaws to write arbitrary data to memory under attacker control on Windows. Public advisories for Mozilla Thunderbird and Firefox (MFSA 2017-18/19, MFSA 2017-20) descr...

CVE-2017-7846

CVE-2017-7846 affects Mozilla Thunderbird. The issue arises in parsing RSS feeds when viewed via website or default feed format, allowing JavaScript execution from the parsed feed (feed origin mailbox://). Published mitigations indicate Thunderbird versions up to 52.5.2 are affected, with fixes i...

CVE-2018-5162

CVE-2018-5162 is a Thunderbird information-disclosure vulnerability where plaintext of decrypted emails can leak through the src attribute of remote images or links. Affected products include Thunderbird ESR and Thunderbird before version 52.8. The root cause is plaintext leakage via image/src ha...

CVE-2025-3523

Vulnerability in Thunderbird where the X-Mozilla-External-Attachment-URL header is processed such that only the last external link is shown on hover for multi-attachment messages. The hover text can mislead users into downloading content from untrusted sources, while the correct link is used on c...

CVE-2008-4060

CVE-2008-4060 affects Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12). The flaw, exploitable via document.loadBindingDocument and XSLT processing, could allow remote attackers to execute arbitrary code with chrome privileges. Th...

CVE-2012-4187

CVE-2012-4187 is listed in the MiracleLinux/Miracle Linux AXSA advisory as affecting Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13. The vulnerability is described as an issue with managing a cert...

CVE-2021-4127

CVE-2021-4127 concerns an out-of-date Angle graphics library used by Mozilla Thunderbird and Firefox ESR, affecting Thunderbird < 78.9 and Firefox ESR

CVE-2024-8394

CVE-2024-8394 affects Mozilla Thunderbird prior to version 128.2. The issue is a use-after-free triggered when aborting the verification of an OTR chat session, potentially causing a crash. A fix is available in Thunderbird 128.2 and later; affected users should upgrade. This vulnerability is con...

CVE-2025-3909

Thunderbird (email client) is affected by CVE-2025-3909 via the X-Mozilla-External-Attachment-URL header. An attacker could craft a nested message/rfc822 attachment with content type application/pdf, causing Thunderbird to render it as HTML and execute JavaScript in the file:/// context after aut...

CVE-2017-7825

The CVE-2017-7825 entry describes an OS X–specific issue where several fonts render Tibetan and Arabic characters as whitespace. When such characters appear in an IDN in the address bar, they enable domain name spoofing. Affected products include Mozilla Firefox versions earlier than 56 and Firef...

CVE-2007-0777

CVE-2007-0777 affects Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, as well as Thunderbird before 1.5.0.10 and SeaMonkey before 1.0.8. The issue is a memory corruption vulnerability in the JavaScript engine that can be triggered by crafted JavaScript, resulting in a crash and possibly a...

CVE-2013-0766

CVE-2013-0766 is a use-after-free in the ~nsHTMLEditRules implementation affecting Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15. The vulnerabili...

CVE-2013-0778

CVE-2013-0778 affects Mozilla Firefox (pre-19.0), Thunderbird (pre-17.0.3), and SeaMonkey (pre-2.16). The issue stems from use-after-free and out-of-bounds/read vulnerabilities in the browser components (notably flagged in MFSA 2013-28), enabling remote code execution or denial of service via uns...

CVE-2017-5399

CVE-2017-5399 is a memory-safety vulnerability affecting Firefox and Thunderbird prior to version 52. Several connected advisories (e.g., Arch Linux ASA-201703-3, DEBIAN CVE tracker, MFSA2017-09) describe memory-safety bugs that could lead to arbitrary code execution or crashes. The documented re...

CVE-2014-1511

CVE-2014-1511 affects Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25. The issue is described as a remote bypass of the popup blocker via unspecified vectors. Public security advisories in 2014 consolidate Firefox/Thunderbird/SeaMonkey...

CVE-2017-7756

CVE-2017-7756 is a use-after-free/use-after-scope vulnerability affecting Firefox <54, Firefox ESR <52.2, and Thunderbird

CVE-2017-7848

CVE-2017-7848 affects Mozilla Thunderbird prior to 52.5.2. The issue allows RSS fields to inject new lines into the created email structure, altering the message body. Public entries and advisories confirm Thunderbird upgrades to 52.5.2 as the fix (e.g., CentOS/RHSA-2018:0061, Debian DSA-4075-1 a...

CVE-2012-3961

CVE-2012-3961 is a use-after-free in the RangeData implementation affecting Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0/ESR 10.x before 10.0.7, and SeaMonkey before 2.12. Exploitation could allow remote code execution or a denial of service via heap memory...

CVE-2012-4205

CVE-2012-4205 affects Mozilla Firefox (prior to 17.0), Mozilla Thunderbird (prior to 17.0), and SeaMonkey (prior to 2.14). The root cause, per the description, is that XMLHttpRequest objects created in sandboxes are assigned the system principal rather than the sandbox principal, enabling CSRF ag...

CVE-2012-4209

Mode C: The CVE-2012-4209 issue affects Mozilla-based components used in MiracleLinux 4 (firefox-10.0.11-1.0.1.AXS4, xulrunner-10.0.11-1.0.1.AXS4) and is described as allowing cross-site scripting by abusing top frame name and location access. Affected products include Mozilla Firefox and Firefox...

CVE-2017-7829

CVE-2017-7829 is a Thunderbird vulnerability in which the sender’s address can be spoofed. The real sender is hidden if a null character precedes the display string, causing the recipient to see an arbitrary address. Affected product is Mozilla Thunderbird prior to 52.5.2. The issue is described ...

CVE-2013-0770

CVE-2013-0770 affects Mozilla Firefox (pre-18.0), Thunderbird (pre-17.0.2), and SeaMonkey (pre-2.15). The issue is described as multiple unspecified vulnerabilities in the browser engine that can cause memory corruption and application crashes, with potential for arbitrary code execution via unkn...

CVE-2012-1973

CVE-2012-1973 is a use-after-free vulnerability in Mozilla Firefox family components. The issue arises in nsObjectLoadingContent::LoadObject, affecting Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. Expl...

CVE-2025-26695

CVE-2025-26695 is a Thunderbird vulnerability where an incorrect padding size is used when requesting an OpenPGP key from a WKD server, enabling a network observer to learn the length of the requested email address. Affected: Thunderbird versions prior to 136 and prior to 128.8. Remediation: upgr...

CVE-2025-8032

CVE-2025-8032 involves an XSLT loading flaw where the source document was not propagated, allowing a CSP bypass in Mozilla components. Affected products/versions (per provided sources): Firefox and Thunderbird lines including Firefox < 141, Firefox ESR < 128.13 and < 140.1, Thunderbird &...

CVE-2006-6501

CVE-2006-6501 affects Mozilla Firefox 2.x before 2.0.0.1, Firefox 1.5.x before 1.5.0.9, SeaMonkey before 1.0.7, and Thunderbird/SeaMonkey-family components as noted in connected advisories. The issue is a privilege-escalation via the watch Javascript function that could allow remote code executio...

CVE-2012-4191

Technical details about CVE-2012-4191 (affected products, root cause, impact, or fixes) are not provided in the connected documents. Please monitor for updates.

CVE-2013-0769

CVE-2013-0769 refers to multiple unspecified vulnerabilities in the Mozilla browser engine that could cause memory corruption and application crashes, potentially enabling remote code execution. Affected products and versions cited in connected docs include Mozilla Firefox before 18.0, Firefox ES...

CVE-2017-7764

CVE-2017-7764 concerns a domain spoofing issue in the address bar caused by mixing Canadian Syllabics with Latin characters in IDN rendering. Affected products include Firefox before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The vulnerability arises from the Unicode handling that ...

CVE-2026-7322

CVE-2026-7322 affects Mozilla Firefox: memory safety bugs in Firefox 150.0.0 and Firefox ESR 115.35.0, 140.10.0. Some bugs showed evidence of memory corruption and, with enough effort, could be exploited to run arbitrary code. Affected components include Firefox core/browser memory handling acros...

CVE-2012-3985

CVE-2012-3985 is a vulnerability in Mozilla Firefox, Thunderbird, and SeaMonkey where the HTML5 Same Origin Policy could be violated, allowing initial-origin access after document.domain is set and potentially enabling cross-site scripting (XSS). Affected versions are Firefox/Thunderbird/SeaMonke...

CVE-2013-0763

CVE-2013-0763 is a use-after-free vulnerability in Mozilla Firefox (pre-18.0) and Firefox ESR 17.x (pre-17.0.1), Thunderbird (pre-17.0.2/ESR 17.x pre-17.0.1), and SeaMonkey (pre-2.15). It is triggered via Mesa driver interactions and a resized WebGL canvas, potentially allowing remote attackers t...

CVE-2026-12318

CVE-2026-12318 concerns the Mozilla NSS Libraries component. The vulnerability is described as incorrect boundary conditions in the NSS Libraries, with the fixed versions identified as Firefox 152 and Thunderbird 152. Connected sources confirm this fix and cite Firefox/Thunderbird 152 as the reme...

CVE-2026-16367

CVE-2026-16367 affects Mozilla Firefox versions earlier than 153.0. The Sandboxing escape is due to an invalid pointer in the Disability Access APIs component, with the vulnerability fixed in Firefox 153. The CVSS v3.1 base score is 10.0 (CRITICAL), with Network attack vector, Low attack complexi...

CVE-2012-1975

CVE-2012-1975 is a Use-after-free vulnerability in PresShell::CompleteMove affecting Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. It potentially allows remote code execution or a denial of serv...

CVE-2012-3957

Affected components: Mozilla Firefox before 15.0 (and Firefox ESR 10.x before 10.0.7), Thunderbird before 15.0 (and Thunderbird ESR 10.x before 10.0.7), SeaMonkey before 2.12.** Vulnerability and root cause: Heap-based buffer overflow in nsBlockFrame::MarkLineDirty, enabling remote code execution...

CVE-2013-0782

CVE-2013-0782 is a heap-based buffer overflow in Mozilla’s nsSaveAsCharset::DoCharsetConversion that affects Firefox before 19.0, ESR 17.x before 17.0.3, Thunderbird before 17.0.3, and SeaMonkey before 2.16. The connected documents confirm this vulnerability and show affected components include F...

CVE-2025-1943

CVE-2025-1943 covers memory-safety bugs in Mozilla Firefox 135 and Thunderbird 135, affecting Firefox < 136 and Thunderbird

CVE-2025-9179

CVE-2025-9179 describes a memory corruption vulnerability in the GMP process used by Firefox/Thunderbird for encrypted media handling, with privileges that are sandboxed yet could allow total impact (CVE-2025-9179). Affected products include Firefox < 142, Firefox ESR < 115.27/128.14/140.2,...

CVE-2026-2757

CVE-2026-2757 (FF/Thunderbird) is confirmed with root cause: incorrect boundary conditions in the WebRTC: Audio/Video component, fixed in Firefox 148, Firefox ESR 115.33/140.8 ESR, Thunderbird 148/140.8. Affected products explicitly include Firefox and Thunderbird lines in multiple advisories (AL...

CVE-2012-1974

CVE-2012-1974 is a use-after-free vulnerability in gfxTextRun::CanBreakLineBefore affecting Mozilla Firefox (and related apps like Thunderbird/SeaMonkey) prior to version 15.0, with remote code execution or a denial of service via unspecified vectors. The connected Nessus entries confirm the CVE ...

CVE-2024-11159

CVE-2024-11159 : A vulnerability in Mozilla Thunderbird where using remote content in OpenPGP encrypted messages can disclose plaintext. Affected products include Thunderbird versions prior to 128.4.3 and prior to 132.0.1 (per multiple advisories). The root cause is exposure of OpenPGP ciphertext...