CVE-2024-2616

The CVE-2024-2616 entry describes a vulnerability in ICU handling for out-of-memory conditions that causes a crash instead of continued operation. Affected products include Firefox ESR and Thunderbird versions prior to 115.9. The change is intended to harden against exploitation, with the impact ...

CVE-2021-29948

Thunderbird prior to 78.10.0 is affected by CVE-2021-29948, where signatures are written to disk before verification and may be at risk of a race condition if a local attacker replaces the file. Impact includes potential signature forgery; remediation is to upgrade Thunderbird to 78.10.0 or newer...

CVE-2012-1945

CVE-2012-1945 affects Mozilla Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The issue occurs when an HTML document loads a shortcut file (.lnk) inside an IFRAME, demonstrated by a network share on Windows or ...

CVE-2012-0475

The CVE-2012-0475 issue affects Mozilla Firefox 4.x–11.0, Thunderbird 5.0–11.0, and SeaMonkey before 2.9, caused by improper construction of Origin and Sec-WebSocket-Origin HTTP headers that could allow bypassing an IPv6 literal ACL via cross-site XMLHttpRequest or WebSocket on a nonstandard port...

CVE-2008-5503

CVE-2008-5503 affects Mozilla Firefox 2.x up to 2.0.0.19, Mozilla Thunderbird 2.x up to 2.0.0.19, and SeaMonkey 1.x up to 1.1.14. The vulnerability arises from the loadBindingDocument function failing to enforce same-domain policy checks, enabling remote attackers to read or access data from othe...

CVE-2006-4567

CVE-2006-4567 affects Firefox < 1.5.0.7 and Thunderbird

CVE-2006-2786

CVE-2006-2786 is an HTTP response smuggling vulnerability affecting Mozilla Firefox and Thunderbird prior to 1.5.0.4. According to connected advisories, an attacker could craft responses that a proxy or header formatting could fool the client into treating as responses from two different sites, p...

CVE-2006-4570

CVE-2006-4570 affects Mozilla Thunderbird and SeaMonkey. With Load Images enabled, a remote XBL file loaded when viewing/forwarding/replying to a message can bypass the user’s JavaScript-disabled settings, enabling remote JavaScript execution. Affected versions in public advisories are Thunderbir...

CVE-2006-1736

Technical details (affected product/version/root cause/impact) are not publicly provided in the connected documents. Monitor for updates.

CVE-2005-2353

CVE-2005-2353 affects Mozilla Thunderbird. The advisory notes that the script run-mozilla.sh, when Thunderbird is built with debugging enabled, can be exploited by local users to create or overwrite arbitrary files via a symlink attack on temporary files. Debian security notices (DSA-1046/DSA-105...

CVE-2004-1449

CVE-2004-1449 affects Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7. The root cause is a user interaction trap where a malicious site obscures a file upload control and tricks the user into dragging text into it, enabling an attacker to determine the location of files on the ...

CVE-2006-1740

CVE-2006-1740 affects Mozilla-derived browsers, allowing remote attackers to spoof secure site indicators (e.g., the lock icon) by abusing a popup window that loads the trusted site and then navigates to a malicious site. Affected products include Firefox 1.x prior to 1.5 and 1.0.x prior to 1.0.8...

CVE-2006-3812

CVE-2006-3812 affects Mozilla Firefox prior to 1.5.0.5, Thunderbird prior to 1.5.0.5, and SeaMonkey prior to 1.0.3. The flaw allows a remote attacker to trick a user into copying or dragging a link to reference remote files and potentially load chrome: URLs, leading to partial confidentiality/int...

CVE-2006-1045

The CVE affects Mozilla Thunderbird 1.5. When Block loading of remote images in mail messages is enabled, Thunderbird’s HTML rendering engine does not fully block external images in inline HTML attachments. This could allow a remote attacker to obtain sensitive information (e.g., application vers...

CVE-2014-1595

Affected software: Mozilla Firefox (non-ESR) < 34.0 and Firefox ESR < 31.3, plus Mozilla Thunderbird

CVE-2005-0142

Vulnerability CVE-2005-0142 affects Firefox 0.9, Thunderbird 0.6 and older Mozilla line up to Mozilla 1.7.x prior to 1.7.5. The root cause described across connected advisories is that temporary files are saved with world-readable permissions, enabling a local user to read web content or attachme...

CVE-2005-2602

Technical details about CVE-2005-2602 are not publicly provided in the supplied documents. Monitor for updates from vendors and vulnerability trackers.

CVE-2011-3649

CVE-2011-3649 affects Mozilla Firefox 7.0 and Thunderbird 7.0 on Windows when using Direct2D with the Azure graphics backend, allowing cross-origin image data to be read via a manipulated canvas (Same Origin Policy bypass). The issue stems from a regression introduced by CVE-2011-2986. According ...

CVE-2005-3402

CVE-2005-3402 affects Mozilla Thunderbird SMTP client (notably 1.0.5 BETA and 1.0.7). The issue is that Thunderbird does not notify users when it cannot establish a secure channel with the SMTP server, enabling a MITM to obtain authentication information by bypassing TLS or downgrading CRAM-MD5 t...

CVE-2006-0836

CVE-2006-0836 : Affected product is Mozilla Thunderbird 1.5. The issue allows user-assisted attackers to cause an unspecified denial of service by convincing a user to import an LDIF file containing a long field (demonstrated by a long homePhone field) into the address book. The available connect...