1477 matches found
CVE-2025-8030
Insufficient escaping in the "Copy as cURL" feature in Mozilla Firefox and Thunderbird could be used to trick users into executing unexpected code. This vulnerability affects Firefox versions prior to 141, Firefox ESR versions prior to 128.13 and 140.1, and Thunderbird versions prior to 141, 128....
CVE-2026-16381
A Same-origin policy bypass exists in the Networking: DNS component of the Firefox and Thunderbird web browser and mail client. This vulnerability was resolved in Firefox 153 , Firefox ESR 140.13 , Thunderbird 153 , and Thunderbird 140.13 . Exploitation details are not provided in the documents, ...
CVE-2026-74940
CVE-2026-74940 is a use-after-free vulnerability in the Graphics: Text component of Mozilla Firefox and Thunderbird . It carries a CVSS 3.1 score of 9.8 (Critical) with a network attack vector requiring no privileges or user interaction. The Debian advisory notes that the vulnerability could pote...
CVE-2026-74979
A mitigation bypass vulnerability exists in the Add-ons Manager component of the Mozilla suite. This issue affects Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR products. The vulnerability has been addressed in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 ...
CVE-2012-5841
CVE-2012-5841 affects Mozilla Firefox (before 17.0), Firefox ESR (10.x before 10.0.11), Thunderbird (before 17.0), Thunderbird ESR (before 10.0.11) and SeaMonkey (before 2.14). The issue arises from cross-origin wrappers with a filtering behavior that fails to restrict write actions, enabling rem...
CVE-2016-5294
CVE-2016-5294 : The Mozilla Updater can select an arbitrary target working directory for update-output files, requiring local access and restricting impact to Windows. Affected: Thunderbird < 45.5, Firefox ESR < 45.5, Firefox
CVE-2017-5414
CVE-2017-5414 affects Mozilla Firefox (and Thunderbird) prior to version 52. The file picker dialog can instantiate and display the wrong local default directory, potentially disclosing OS or local account name. Remediation from connected docs: upgrade to Firefox 52.0+ (and Thunderbird 52.0+ as a...
CVE-2025-3875
The Thunderbird email client contains a vulnerability (CVE-2025-3875) where it incorrectly parses addresses, allowing for sender spoofing if the mail server permits an invalid From header. For instance, if the header contains an invalid value like "Spoofed Name ", Thunderbird may treat "spoofed@e...
CVE-2026-74970
CVE-2026-74970 is a site-isolation bypass vulnerability in the Graphics: WebRender component of Firefox. The issue stems from a missing PipelineId namespace check in the WebRenderBridgeParent::AddPipelineIdForCompositable function within the GPU process. Because this check is missing, a compromis...
CVE-2026-84128
A privilege escalation vulnerability exists in the WebDriver BiDi component of Firefox and Thunderbird . This issue was addressed in versions 155 of both products. While the exact root cause is not detailed, the vulnerability allows for elevated privileges. Exploitation details are not provided i...
CVE-2012-1938
CVE-2012-1938 affects Mozilla's browser engine and is described in the MiracleLinux AXSA:2012-857 advisory as multiple vulnerabilities in Firefox (and related components) that could allow memory corruption and remote code execution. Specifically, it impacts Mozilla Firefox before 13.0, Thunderbir...
CVE-2012-3995
CVE-2012-3995 affects Mozilla Firefox and related Mozilla applications. The vulnerability arises from the IsCSSWordSpacingSpace function in Firefox (and Firefox ESR 10.x, Thunderbird, SeaMonkey as listed) where an out-of-bounds read could be exploited to run arbitrary code or trigger a denial-of-...
CVE-2012-4187
CVE-2012-4187 is listed in the MiracleLinux/Miracle Linux AXSA advisory as affecting Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13. The vulnerability is described as an issue with managing a cert...
CVE-2013-0762
CVE-2013-0762 is a use-after-free in imgRequest::OnStopFrame affecting Mozilla Firefox prior to 18.0 (and ESR 10.x before 10.0.12, ESR 17.x before 17.0.1), Thunderbird prior to 17.0.2, and SeaMonkey prior to 2.15. It can allow remote code execution or a denial of service via heap memory corruptio...
CVE-2013-0774
CVE-2013-0774 affects Mozilla Firefox
CVE-2024-8394
CVE-2024-8394 affects Mozilla Thunderbird prior to version 128.2. The issue is a use-after-free triggered when aborting the verification of an OTR chat session, potentially causing a crash. A fix is available in Thunderbird 128.2 and later; affected users should upgrade. This vulnerability is con...
CVE-2025-3909
Mozilla Thunderbird's handling of the X-Mozilla-External-Attachment-URL header allows for JavaScript execution in the file:/// context. An attacker can craft a nested email attachment (message/rfc822 ) with a content type of application/pdf . Thunderbird may incorrectly render this as HTML when o...
CVE-2026-6754
A Use-after-free vulnerability exists in the JavaScript Engine component of Mozilla Firefox and the Thunderbird email client. This flaw allows an attacker to compromise the accessibility of protected information . The vulnerability has been addressed in Firefox 150 , Firefox ESR 115.35 , Firefox ...
CVE-2026-6766
The NSS library contains a vulnerability caused by incorrect boundary conditions in its Libraries component . This flaw allows a remote attacker to cause a service failure . Affected software includes Mozilla Firefox , Firefox ESR , and Thunderbird . Remediation is available in Firefox 150 , Fire...
CVE-2026-6769
This vulnerability involves a privilege escalation within the Debugger component of the Mozilla Firefox browser and the Thunderbird email client. Deficiencies in access control could allow a malicious actor to enhance their privileges remotely. The issue is fixed in Firefox 150 , Firefox ESR 140....
CVE-2026-6777
Mozilla Firefox and Thunderbird are vulnerable in versions prior to 150 due to an issue in the Networking: DNS component . The root cause involves insufficient validation of input data , which could allow an attacker to compromise the accessibility of protected information . The vulnerability has...
CVE-2017-7754
CVE-2017-7754 is an out-of-bounds read in WebGL when processing a malicious ImageInfo object during WebGL operations. Affected products/versions per connected docs: Firefox versions prior to 54 and Firefox ESR prior to 52.2, and Thunderbird prior to 52.2. The vulnerability stems from an improper ...
CVE-2026-12290
A memory safety bug has been identified and fixed in Mozilla Firefox and Mozilla Thunderbird products. The vulnerability affected Firefox 152 , Firefox ESR 140.12 , Firefox ESR 115.37 , Thunderbird 152 , and Thunderbird 140.12 . No specific root cause or exploitation details are provided in the d...
CVE-2026-74946
A privilege escalation vulnerability exists in the Graphics: CanvasWebGL component of Mozilla Firefox and Thunderbird due to incorrect boundary conditions . Impacting multiple versions, the vulnerability was addressed in Firefox 154 , Firefox ESR 115.39 , Firefox ESR 140.14 , Firefox ESR 153.1 , ...
CVE-2012-3989
CVE-2012-3989 affects Mozilla Firefox (and related Mozilla products) prior to version 16.0, Thunderbird prior to 16.0, and SeaMonkey prior to 2.13. The vulnerability is a crash caused by an invalid cast when using the instanceof operator on certain JavaScript objects, which could allow remote att...
CVE-2017-5412
CVE-2017-5412 is a buffer overflow read in SVG filter color value processing that results in data exposure. Affected products are Firefox and Thunderbird versions older than 52. The root cause is a memory safety/overflow issue in SVG filter handling. Remediation is to update to Firefox 52.0+ and ...
CVE-2017-5426
CVE-2017-5426: On Linux, when seccomp-bpf is active as Gecko Media Plugin sandbox starts, the sandbox may fail to initialize, leaving code that would run in the sandbox only protected by a weaker filter. Affected products are Firefox < 52 and Thunderbird < 52 (Linux only). This can enable s...
CVE-2018-5162
CVE-2018-5162 is a Thunderbird information-disclosure vulnerability where plaintext of decrypted emails can leak through the src attribute of remote images or links. Affected products include Thunderbird ESR and Thunderbird before version 52.8. The root cause is plaintext leakage via image/src ha...
CVE-2025-4092
Memory safety bugs in Mozilla Firefox and Thunderbird (versions prior to 138 ) can lead to memory corruption . A remote attacker could potentially exploit these vulnerabilities to execute arbitrary code . This issue was addressed and fixed in Firefox 138 and Thunderbird 138 . No specific exploit ...
CVE-2025-8035
Mozilla Firefox and Thunderbird products are affected by CVE-2025-8035 , which involves multiple memory safety bugs . These vulnerabilities can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial of service (service failure) on a vulnerable syst...
CVE-2026-16396
A privilege escalation vulnerability exists in the WebExtensions component of the Mozilla Firefox and Thunderbird browsers. This flaw impacts various versions of the software, including Firefox 153 and Thunderbird 153, as well as the ESR 140.13 release. The vulnerability has been addressed in the...
CVE-2017-5399
CVE-2017-5399 is a memory-safety vulnerability affecting Firefox and Thunderbird prior to version 52. Several connected advisories (e.g., Arch Linux ASA-201703-3, DEBIAN CVE tracker, MFSA2017-09) describe memory-safety bugs that could lead to arbitrary code execution or crashes. The documented re...
CVE-2017-7782
CVE-2017-7782 affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox
CVE-2026-6773
The Graphics: WebGPU component in Mozilla Firefox and Mozilla Thunderbird is vulnerable to a Denial-of-service (DoS) attack caused by an integer overflow . This numerical overflow condition can be exploited remotely by an attacker to induce service interruptions. The vulnerability has been addres...
CVE-2026-74950
A privilege escalation vulnerability exists in the Downloads API component of Firefox and Thunderbird . This issue was addressed in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . No specific technical root cause or in-the-wild exploitation details are provided in the ...
CVE-2026-84142
CVE-2026-84142 covers internally discovered bugs in Thunderbird 154 that showed evidence of memory corruption or other security-relevant defects. Mozilla presumes some could have been exploited with sufficient effort. The fix ships in Thunderbird 155 , Firefox 155 , and corresponding ESR releases...
CVE-2021-4127
CVE-2021-4127 concerns an out-of-date Angle graphics library used by Mozilla Thunderbird and Firefox ESR, affecting Thunderbird < 78.9 and Firefox ESR
CVE-2025-9180
A Same-origin policy bypass vulnerability exists in the Graphics: Canvas2D component of Firefox and Thunderbird . This flaw allows for a bypass of security boundaries, leading to potential cross-origin data access. The vulnerability has been addressed in Firefox 142 , Firefox ESR 115.27 , Firefox...
CVE-2026-16371
A privilege escalation vulnerability exists in the DOM: Navigation component of the Mozilla Firefox web browser and Thunderbird mail client. This flaw allows for potential unauthorized privilege gains within the browser environment. The vulnerability has been addressed in Firefox 153 , Firefox ES...
CVE-2026-74952
CVE-2026-74952 is a privilege escalation vulnerability affecting the Application Update component of Mozilla Thunderbird ESR and Mozilla Firefox . The flaw allows attackers to bypass security restrictions. Remediation is available in Thunderbird 153.2 , Firefox 154 , Firefox ESR 153.2 , and Thund...
CVE-2012-4209
Mode C: The CVE-2012-4209 issue affects Mozilla-based components used in MiracleLinux 4 (firefox-10.0.11-1.0.1.AXS4, xulrunner-10.0.11-1.0.1.AXS4) and is described as allowing cross-site scripting by abusing top frame name and location access. Affected products include Mozilla Firefox and Firefox...
CVE-2013-0767
CVE-2013-0767 affects Mozilla Firefox (and related Mozilla components) with the nsSVGPathElement::GetPathLengthScale path handling. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service via an out-of-bounds read, reported for Firefox before 18.0, ESR 10....
CVE-2013-0778
CVE-2013-0778 affects Mozilla Firefox (pre-19.0), Thunderbird (pre-17.0.3), and SeaMonkey (pre-2.16). The issue stems from use-after-free and out-of-bounds/read vulnerabilities in the browser components (notably flagged in MFSA 2013-28), enabling remote code execution or denial of service via uns...
CVE-2013-6671
CVE-2013-6671 affects Mozilla Firefox before 26.0 (and corresponding ESR/Thunderbird/SeaMonkey releases listed) where nsGfxScrollFrameInner::IsLTR can be abused by crafted JavaScript used with ordered list elements to trigger remote code execution. The vulnerability is a browser-engine issue that...
CVE-2017-7846
CVE-2017-7846 affects Mozilla Thunderbird. The issue arises in parsing RSS feeds when viewed via website or default feed format, allowing JavaScript execution from the parsed feed (feed origin mailbox://). Published mitigations indicate Thunderbird versions up to 52.5.2 are affected, with fixes i...
CVE-2025-8033
The JavaScript engine in Mozilla Firefox and Thunderbird contains a vulnerability where it fails to correctly handle closed generators. This flaw allows an attacker to resume these generators, leading to a nullptr dereference . Affected versions include Firefox < 141, Firefox ESR < 115.26, ...
CVE-2026-12292
The Web Audio component in Firefox and Thunderbird is vulnerable to incorrect boundary conditions . This flaw affects the following versions: Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . The vulnerability was addressed in the aforementioned releases. No specific e...
CVE-2026-2797
CVE-2026-2797 is a use-after-free in the JavaScript: GC component affecting Firefox and Thunderbird. The issue was fixed in Firefox 148 and Thunderbird 148. Public exploits are noted in some sources; CVSS metrics indicate a high-severity, memory-safety class vulnerability with network attack vect...
CVE-2026-84119
Mozilla Firefox and Thunderbird are affected by a sandbox escape vulnerability caused by a use-after-free in the DOM: Navigation component . This security issue can lead to the execution of arbitrary code or privilege escalation. Remediation includes updating to Firefox 155 , Firefox ESR 115.40 ,...