1477 matches found
CVE-2020-12420
CVE-2020-12420 describes a race-condition use-after-free when connecting to a STUN server, leading to memory corruption and potentially exploitable crashes. Affected products include Thunderbird and Firefox variants prior to versions 68.10.x (Thunderbird < 68.10.0; Firefox ESR < 68.10, Fire...
CVE-2020-26956
CVE-2020-26956 is an XSS issue caused by removing HTML elements during sanitization, which could leave SVG event handlers active. Affected: Firefox <83, Firefox ESR <78.5, Thunderbird
CVE-2024-9403
Memory safety bugs in Firefox < 131 and Thunderbird
CVE-2019-11763
The CVE-2019-11763 entry concerns a parsing defect in handling null bytes in HTML entities, causing Firefox to mis-parse entities and potentially treat HTML comments as code. This could enable XSS in web apps under certain conditions and allow masking of actual characters by filters. Public detai...
CVE-2019-17010
CVE-2019-17010 is a race-condition vulnerability that, during device orientation checks, can cause a use-after-free and a potentially exploitable crash in Thunderbird and Firefox products. It affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox
CVE-2020-6805
CVE-2020-6805 affects Thunderbird (and Firefox) with a use-after-free in the Quota manager when removing data about origins for a recently closed tab, potentially causing a crash. Affected versions include Thunderbird < 68.6 and Firefox < 74/ESR68.6/ESR
CVE-2019-11757
CVE-2019-11757 affects Mozilla Firefox (versions before 70) and Firefox ESR (before 68.2) as well as Thunderbird (before 68.2). The issue stems from following a value’s prototype chain, which allowed retaining a reference to a locale, deleting it, and then referencing it again, causing a use-afte...
CVE-2019-11759
CVE-2019-11759 describes a stack buffer overflow in the HKDF output that could allow code execution or a crash. Affected products include Firefox < 70, Thunderbird < 68.2, and Firefox ESR
CVE-2020-12419
CVE-2020-12419 describes a use-after-free in the browser/windowing code: during processing of callbacks in window flushing in the parent process, a window may die, leading to memory corruption and a potentially exploitable crash. Affected products in the provided docs include Thunderbird and Fire...
CVE-2020-26978
CVE-2020-26978 is a Firefox/Thunderbird remote-info-exposure vulnerability. A malicious webpage could probe an internal network and access services on the user’s device due to slipstream-based techniques. Affected: Firefox < 84, Thunderbird < 78.6, Firefox ESR
CVE-2021-43546
CVE-2021-43546 concerns cursor spoofing that could overlay the UI when a native cursor is zoomed. Affected products mentioned across connected documents include Thunderbird < 91.4.0 and Firefox < 95 (including Firefox ESR
CVE-2018-12405
The CVE-2018-12405 entry is supported by connected advisories showing memory safety bugs in Firefox 63/ESR 60.3 with potential for arbitrary code execution. Affected products include Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox
CVE-2020-35111
CVE-2020-35111 covers a proxy.onRequest handling flaw: when an extension with proxy privileges registers for , view-source URLs fail to trigger the proxy.onRequest callback, potentially leaking the user’s IP when viewing source. Affected: Firefox < 84, Thunderbird < 78.6, Firefox ESR
CVE-2019-11758
CVE-2019-11758 is a memory-safety bug in Mozilla Firefox that can lead to arbitrary code execution when 360 Total Security is installed. The advisory notes it affects Firefox versions before 69, Thunderbird before 68.2, and Firefox ESR before 68.2. Public documentation in connected sources confir...
CVE-2019-11760
CVE-2019-11760 describes a fixed-size stack buffer overflow in nrappkit during WebRTC signaling that could lead to a potentially exploitable crash. The vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR
CVE-2022-31744
CVE-2022-31744 involves an CSS injection flaw that could let an attacker inject CSS into stylesheets accessible via internal URIs (e.g., resource:) and bypass a page's Content Security Policy. Affected products include Firefox ESR < 91.11, Thunderbird < 102, Thunderbird < 91.11, and Fire...
CVE-2019-9793
CVE-2019-9793 describes an issue where, if Spectre mitigations are disabled, bounds checking is loosened for string/array/typed array accesses, enabling an attacker to cause the range analysis to infer controlled, incorrect values in JavaScript. Connected advisories confirm affected products and ...
CVE-2021-38506
CVE-2021-38506 describes a UI spoofing risk in Mozilla products where, after a series of navigations, Firefox could enter fullscreen mode without user notification. Affected: Firefox < 94, Thunderbird < 91.3, and Firefox ESR
CVE-2018-18498
CVE-2018-18498 is an integer overflow vulnerability in image buffer size calculations that can cause out-of-bounds writes. The description in connected advisories ties this CVE to Thunderbird and Firefox families (Thunderbird < 60.4, Firefox ESR < 60.4, Firefox
CVE-2020-6795
The CVE-2020-6795 issue is documented in multiple sources as a bug in Thunderbird’s MIME handling: when processing a message with multiple S/MIME signatures, a bug in the MIME processing code caused a null pointer dereference, resulting in a crash. Affected product: Thunderbird, version range bef...
CVE-2021-23964
CVE-2021-23964 corresponds to memory-safety bugs in Mozilla Firefox 84 and Firefox ESR 78.6 that could enable memory corruption and potentially arbitrary code execution. Affected products include Firefox <85, Thunderbird <78.7, and Firefox ESR
CVE-2021-38498
The CVE-2021-38498 entry describes a use-after-free of the nsLanguageAtomService (languages service object) during process shutdown, causing memory corruption and potentially a crash. Affected products include Firefox < 93, Thunderbird < 91.2, and Firefox ESR
CVE-2023-5721
CVE-2023-5721 describes a UX vulnerability where certain browser prompts and dialogs could be activated or dismissed unintentionally by users due to an insufficient activation-delay. Affected products/versions per provided documents: Firefox prior to 119, Firefox ESR prior to 115.4, and Thunderbi...
CVE-2018-18494
CVE-2018-18494 is a same-origin policy violation in Thunderbird/Firefox components caused by using the location property with performance.getEntries to steal cross-origin URL entries. Affected: Thunderbird < 60.4, Firefox ESR < 60.4, Firefox
CVE-2020-15654
This vulnerability affects Firefox ESR < 78.1 , Firefox < 79 , and Thunderbird
CVE-2020-26953
CVE-2020-26953 : A vulnerability allowing a browser to enter fullscreen mode without displaying the security UI, enabling potential phishing or user confusion. Affected: Firefox < 83, Firefox ESR < 78.5, Thunderbird
CVE-2021-43528
CVE-2021-43528 : Thunderbird before 91.4.0 enables JavaScript in the composition area. The JS context is restricted to that area with no chrome privileges but could serve as a stepping stone to further attacks involving other vulnerabilities. Affected: Thunderbird
CVE-2020-6793
Thunderbird is affected by CVE-2020-6793 (memory read bug) in processing emails with an ill-formed envelope, impacting versions older than 68.5. The issue involves reading data from a random memory location due to a memory-safety flaw in envelope handling. Affected product: Thunderbird pre-68.5. ...
CVE-2020-12393
CVE-2020-12393 affects Firefox on Windows (and related Mozilla products) where the Devtools Network tab’s Copy as cURL feature failed to properly escape the HTTP method, allowing a website-controlled method to be injected into a pasted terminal command and potentially leading to arbitrary command...
CVE-2020-35113
CVE-2020-35113 concerns memory safety bugs in Mozilla Firefox and Firefox ESR that could allow memory corruption and potential arbitrary code execution. Public docs indicate affected versions include Firefox below 84, Firefox ESR below 78.6, and Thunderbird below 78.6, with fixes coordinated in F...
CVE-2020-15653
CVE-2020-15653 concerns bypassing an iframe sandbox when the sandbox allows popups, via noopener links in affected Firefox ESR < 78.1, Firefox < 79, and Thunderbird
CVE-2023-4584
CVE-2023-4584 relates to memory safety bugs in Firefox and Thunderbird affecting multiple versions (e.g., Firefox 116/ESR 102.x/ Thunderbird 102.x/115.x). Connected advisories confirm the issue and map to Firefox/Thunderbird versions and the remediation path: upgrade to Firefox 117 or ESR 102.15/...
CVE-2020-15657
CVE-2020-15657 is a Windows-specific DLL hijacking flaw in Mozilla Firefox (and Thunderbird) where attacker-controlled DLLs in the installation directory could be loaded. Affected: Firefox ESR < 78.1, Firefox < 79, Thunderbird
CVE-2023-4574
CVE-2023-4574 involves a use-after-free in the IPC ColorPickerShownCallback: creating multiple identical callbacks for the Color Picker over IPC, then destroying them all when one finishes. Affected: Firefox < 117, Firefox ESR < 102.15/115.2, Thunderbird
CVE-2020-12418
CVE-2020-12418 describes a flaw where manipulating individual parts of a URL object could cause an out-of-bounds read, leaking process memory to malicious JavaScript. Affected products per the provided data include Firefox ESR < 68.10, Firefox < 78, and Thunderbird
CVE-2023-25751
CVE-2023-25751 affects Firefox and Thunderbird: root cause is incorrect code generation during JIT code invalidation when following an iterator, which could lead to a potentially exploitable crash. Affected: Firefox <=111 and Firefox ESR <=102.8/9, Thunderbird
CVE-2012-0444
CVE-2012-0444 describes a heap-based memory corruption vulnerability in the libvorbis Ogg Vorbis parser that could allow remote code execution or a crash when processing crafted Ogg Vorbis files. Affected products across Mozilla ecosystem (Firefox, Thunderbird, Seamonkey and related XULRunner/Ice...
CVE-2022-2505
CVE-2022-2505 describes memory safety bugs in Firefox 102.x (and Thunderbird <102.1) with evidence of memory corruption. Affected: Firefox ESR < 102.1, Firefox < 103, and Thunderbird
CVE-2022-45403
CVE-2022-45403 describes a vulnerability where Service Workers could infer the size of cross-origin media by correlating timing information with Range requests, potentially exposing presence/length of a media file. Affected: Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox
CVE-2020-15655
CVE-2020-15655 affects Mozilla Firefox (including ESR) and Thunderbird, where a redirected HTTP request observed or modified through a web extension could bypass Same-Origin Policy via extension APIs, potentially disclosing cross-origin information. Affected versions include Firefox ESR <78.1,...
CVE-2020-15678
CVE-2020-15678 involves a use-after-free in the Gecko rendering stack due to improper iterator invalidation in APZCTreeManager::ComputeClippedCompositionBounds when recursing through graphical layers during scrolling. Affected products include Firefox (before 81), Thunderbird (before 78.3), and F...
CVE-2020-15658
The CVE-2020-15658 issue affects Mozilla Firefox (non-ESR < 79) and Firefox ESR < 78.1, and Thunderbird
CVE-2020-35112
CVE-2020-35112 is a Windows-specific issue in Mozilla Firefox (affecting Firefox <84, Thunderbird <78.6, and Firefox ESR
CVE-2020-26966
CVE-2020-26966 affects Mozilla Firefox (Windows only) and Thunderbird; the issue arises from a memory leak via broadcasting of single-word search queries as mDNS requests on the local network. Affected products include Firefox before version 83, Firefox ESR before 78.5, and Thunderbird before 78....
CVE-2021-38501
CVE-2021-38501 is a memory-safety issue affecting Firefox up to version 92/ESR 91.1 with memory-corruption risks; impacted products include Firefox <93, Thunderbird <91.2, and Firefox ESR
CVE-2024-0741
CVE-2024-0741 describes an out-of-bounds write in ANGLE that could corrupt memory and cause a potentially exploitable crash. Affected software includes Firefox up to version 121/122 and Firefox ESR up to 115.7, as well as Thunderbird up to 115.7. The connected advisories indicate the root cause i...
CVE-2018-12392
CVE-2018-12392 is a vulnerability affecting Firefox (pre-63 and ESR pre-60.3) and Thunderbird (pre-60.3) where manipulating user events in nested loops while opening a document via script can trigger a crash due to poor event handling. Public advisories list the impact as a potentially exploitabl...
CVE-2020-26973
The provided connected sources confirm CVE-2020-26973 affects Mozilla Firefox and Thunderbird, tied to the CSS Sanitizer. Affected versions include Firefox prior to 84 and Thunderbird prior to 78.6 (Firefox ESR
CVE-2023-4585
CVE-2023-4585 describes memory safety bugs in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1, with evidence of memory corruption and the potential for arbitrary code execution. Affected versions are Firefox < 117, Firefox ESR < 115.2, and Thunderbird