Advisories · Technology

Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2024-7526 CVE record

CVSS 7.5 High

Use of uninitialized resource in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 6 Aug 2024
CVE-2024-7525 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Improper access control in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Broken access control
Not analysed yet 6 Aug 2024
CVE-2024-7522 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Out-of-bounds read in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 6 Aug 2024
CVE-2024-7521 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Improper handling of exceptional conditions in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-755
Not analysed yet 6 Aug 2024
CVE-2024-7520 CVE record

CVSS 8.8 High

Code injection in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Code injection
Not analysed yet 6 Aug 2024
CVE-2024-7519 CVE record

CVSS 8.8 High

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 6 Aug 2024
CVE-2024-7518 CVE record

CVSS 6.5 Medium

Clickjacking in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-1021
Not analysed yet 6 Aug 2024
CVE-2024-6615 CVE record

CVSS 8.8 High

Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 9 Jul 2024
CVE-2024-6614 CVE record

CVSS 4.3 Medium

Incorrect listing of stack frames
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 9 Jul 2024
CVE-2024-6613 CVE record

CVSS 5.5 Medium

Incorrect listing of stack frames
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 9 Jul 2024
CVE-2024-6612 CVE record

CVSS 5.3 Medium

CSP violation leakage when using devtools
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 9 Jul 2024
CVE-2024-6611 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect handling of SameSite cookies
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1275
Not analysed yet 9 Jul 2024
CVE-2024-6610 CVE record

CVSS 6.3 Medium

Form validation popups could block exiting full-screen mode
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-451
Not analysed yet 9 Jul 2024
CVE-2024-6609 CVE record

CVSS 8.8 High

Memory corruption in NSS
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 9 Jul 2024
CVE-2024-6608 CVE record

CVSS 4.3 Medium

Cursor could be moved out of the viewport using pointerlock.
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 9 Jul 2024
CVE-2024-6607 CVE record

CVSS 8.8 High

Leaving pointerlock by pressing the escape key could be prevented
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 9 Jul 2024
CVE-2024-6606 CVE record

CVSS 8.2 High

Out-of-bounds read in clipboard component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 9 Jul 2024
CVE-2024-6604 CVE record

CVSS 7.5 High

Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 9 Jul 2024
CVE-2024-6603 CVE record

CVSS 7.4 High

Memory corruption in thread creation
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-823
Not analysed yet 9 Jul 2024
CVE-2024-6602 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory corruption in NSS
- Mozilla Firefox
- Mozilla Firefox ESR
- Code injection
Not analysed yet 9 Jul 2024
CVE-2024-6601 CVE record

CVSS 4.7 Medium

Race condition in permission assignment
- Mozilla Firefox
- Mozilla Firefox ESR
- Race condition
Not analysed yet 9 Jul 2024
CVE-2024-6600 CVE record

CVSS 6.3 Medium

Memory corruption in WebGL API
- Mozilla Firefox
- Mozilla Firefox ESR
- Denial of service
Not analysed yet 9 Jul 2024
CVE-2024-5700 CVE record

CVSS 7.0 High

Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11.
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
- CWE-786
Not analysed yet 11 Jun 2024
CVE-2024-5696 CVE record

CVSS 8.6 High

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 11 Jun 2024
CVE-2024-5693 CVE record

CVSS 6.1 Medium

Mozilla Firefox: Offscreen Canvas did not properly track cross-origin tainting…
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-829
Not analysed yet 11 Jun 2024
CVE-2024-5692 CVE record

CVSS 6.5 Medium

Mozilla Firefox: On Windows 10, when using the 'Save As' functionality…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2024
CVE-2024-5691 CVE record

CVSS 4.7 Medium

Protection mechanism failure in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-693
Not analysed yet 11 Jun 2024
CVE-2024-5690 CVE record

CVSS 4.3 Medium

Observable discrepancy in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Information disclosure
Not analysed yet 11 Jun 2024
CVE-2024-5688 CVE record

CVSS 8.1 High

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 11 Jun 2024
CVE-2024-5702 CVE record

CVSS 7.5 High

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 11 Jun 2024
CVE-2024-4777 CVE record

CVSS 7.5 High

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 14 May 2024
CVE-2024-4770 CVE record

CVSS 8.8 High

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 14 May 2024
CVE-2024-4769 CVE record

CVSS 5.9 Medium

Mozilla Firefox: When importing resources using Web Workers…
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-351
Not analysed yet 14 May 2024
CVE-2024-4768 CVE record

CVSS 6.1 Medium

Mozilla Firefox: A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to…
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-281
Not analysed yet 14 May 2024
CVE-2024-4767 CVE record

CVSS 4.3 Medium

Exposure of personal information in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Information disclosure
Not analysed yet 14 May 2024
CVE-2024-3864 CVE record

CVSS 8.1 High

Buffer overflow in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 16 Apr 2024
CVE-2024-3302 CVE record

CVSS 3.7 Low

Resource allocation without limits in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Denial of service
Not analysed yet 16 Apr 2024
CVE-2024-3863 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Unrestricted file upload in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Unrestricted file upload
Not analysed yet 16 Apr 2024
CVE-2024-3861 CVE record

CVSS 4.0 Medium

Mozilla Firefox: If an AlignedBuffer were assigned to itself…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 16 Apr 2024
CVE-2024-3859 CVE record

CVSS 5.9 Medium

Integer overflow in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 16 Apr 2024
CVE-2024-3857 CVE record

CVSS 7.8 High

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 16 Apr 2024
CVE-2024-3854 CVE record

CVSS 8.8 High

Out-of-bounds read in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 16 Apr 2024
CVE-2024-3852 CVE record

CVSS 7.5 High

GetBoundName could return the wrong version of an object when JIT optimizations were applied.
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-386
Not analysed yet 16 Apr 2024
CVE-2024-2616 CVE record

CVSS 2.7 Low

Mozilla Firefox ESR: To harden ICU against exploitation, the behavior for out-of-memory conditions was changed…
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 19 Mar 2024
CVE-2024-2614 CVE record

CVSS 8.8 High

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 19 Mar 2024
CVE-2024-2612 CVE record

CVSS 8.1 High

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 19 Mar 2024
CVE-2024-2611 CVE record

CVSS 5.5 Medium

Mozilla Firefox: A missing delay on when pointer lock was used could have allowed a malicious page to…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 19 Mar 2024
CVE-2024-2610 CVE record

CVSS 6.1 Medium

Code injection in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Code injection
Not analysed yet 19 Mar 2024
CVE-2024-2609 CVE record

CVSS 6.1 Medium

The permission prompt input delay could expire while the window is not in focus.
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-356
Not analysed yet 19 Mar 2024
CVE-2023-5388 CVE record

CVSS 6.5 Medium

NSS was susceptible to a timing side-channel attack when performing RSA decryption.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 19 Mar 2024
CVE-2024-2608 CVE record

CVSS 8.4 High

Mozilla Firefox: `AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and…
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 19 Mar 2024
CVE-2024-2607 CVE record

CVSS 8.1 High

Mozilla Firefox: Return registers were overwritten which could have allowed an attacker to execute…
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-123
Not analysed yet 19 Mar 2024
CVE-2024-2605 CVE record

CVSS 5.9 Medium

Mozilla Firefox: An attacker could have leveraged the Windows Error Reporter to run arbitrary code on the…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 19 Mar 2024
CVE-2024-1936 CVE record

CVSS 7.5 High

Insecure storage of sensitive information in Mozilla Thunderbird
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 4 Mar 2024
CVE-2024-1553 CVE record

CVSS 8.1 High

Buffer overflow in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 20 Feb 2024
CVE-2024-1552 CVE record

CVSS 7.5 High

Incorrect numeric conversion in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-681
Not analysed yet 20 Feb 2024
CVE-2024-1551 CVE record

CVSS 6.1 Medium

Set-Cookie response headers were being incorrectly honored in multipart HTTP responses.
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-565
Not analysed yet 20 Feb 2024
CVE-2024-1550 CVE record

CVSS 6.1 Medium

Clickjacking in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-1021
Not analysed yet 20 Feb 2024
CVE-2024-1549 CVE record

CVSS 6.1 Medium

Mozilla Firefox: If a website set a large custom cursor…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 20 Feb 2024
CVE-2024-1548 CVE record

CVSS 4.3 Medium

A website could have obscured the fullscreen notification by using a dropdown select input element.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 20 Feb 2024