Advisories · Technology

Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2024-1547 CVE record

CVSS 6.5 Medium

Authentication bypass by spoofing in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Authentication bypass
Not analysed yet 20 Feb 2024
CVE-2024-1546 CVE record

CVSS 7.5 High

Out-of-bounds read in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 20 Feb 2024
CVE-2024-0743 CVE record

CVSS 7.5 High

Unchecked return value in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-252
Not analysed yet 23 Jan 2024
CVE-2024-0755 CVE record

CVSS 8.8 High

Code injection in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Code injection
Not analysed yet 23 Jan 2024
CVE-2024-0753 CVE record

CVSS 6.5 Medium

In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 23 Jan 2024
CVE-2024-0751 CVE record

CVSS 8.8 High

Improper privilege management in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Privilege escalation
Not analysed yet 23 Jan 2024
CVE-2024-0750 CVE record

CVSS 8.8 High

Mozilla Firefox: A bug in popup notifications delay calculation could have made it possible for an…
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-451
Not analysed yet 23 Jan 2024
CVE-2024-0749 CVE record

CVSS 4.3 Medium

Origin validation error in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 23 Jan 2024
CVE-2024-0747 CVE record

CVSS 6.5 Medium

Protection mechanism failure in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-693
Not analysed yet 23 Jan 2024
CVE-2024-0746 CVE record

CVSS 6.5 Medium

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 23 Jan 2024
CVE-2024-0742 CVE record

CVSS 4.3 Medium

Mozilla Firefox: It was possible for certain browser prompts and dialogs to be activated or dismissed…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 23 Jan 2024
CVE-2024-0741 CVE record

CVSS 6.5 Medium

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 23 Jan 2024
CVE-2023-6864 CVE record

Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5.
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 19 Dec 2023
CVE-2023-6863 CVE record

Mozilla Firefox ESR: The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its…
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 19 Dec 2023
CVE-2023-6862 CVE record

A use-after-free was identified in the `nsDNSService::Init`.
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 19 Dec 2023
CVE-2023-6861 CVE record

Mozilla Firefox ESR: The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when…
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 19 Dec 2023
CVE-2023-6860 CVE record

The `VideoBridge` allowed any content process to use textures produced by remote decoders.
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 19 Dec 2023
CVE-2023-6859 CVE record

A use-after-free condition affected TLS socket creation when under memory pressure.
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 19 Dec 2023
CVE-2023-6858 CVE record

CVSS 8.8 High

Out-of-bounds write in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 19 Dec 2023
CVE-2023-6857 CVE record

Mozilla Firefox ESR: When resolving a symlink, a race may occur where the buffer passed to `readlink` may…
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 19 Dec 2023
CVE-2023-6856 CVE record

Mozilla Firefox ESR: The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when…
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 19 Dec 2023
CVE-2023-50761 CVE record

Mozilla Thunderbird: The signature of a digitally signed S/MIME email message may optionally specify the…
- Mozilla Thunderbird
Not analysed yet 19 Dec 2023
CVE-2023-50762 CVE record

Mozilla Thunderbird: When processing a PGP/MIME payload that contains digitally signed text…
- Mozilla Thunderbird
Not analysed yet 19 Dec 2023
CVE-2023-6212 CVE record

Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 21 Nov 2023
CVE-2023-6209 CVE record

Mozilla Firefox: Relative URLs starting with three slashes were incorrectly parsed…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 21 Nov 2023
CVE-2023-6208 CVE record

Mozilla Firefox: When using X11, text selected by the page using the Selection API was erroneously copied…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 21 Nov 2023
CVE-2023-6207 CVE record

Mozilla Firefox: Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 21 Nov 2023
CVE-2023-6206 CVE record

Mozilla Firefox: The black fade animation when exiting fullscreen is roughly the length of the…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 21 Nov 2023
CVE-2023-6205 CVE record

Mozilla Firefox: It was possible to cause the use of a MessagePort after it had already been freed…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 21 Nov 2023
CVE-2023-6204 CVE record

Mozilla Firefox: On some systems—depending on the graphics settings and drivers—it was possible to force…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 21 Nov 2023
CVE-2023-5732 CVE record

Address bar spoofing via bidirectional characters
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 24 Oct 2023
CVE-2023-5730 CVE record

Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 24 Oct 2023
CVE-2023-5728 CVE record

CVSS 7.5 High

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 24 Oct 2023
CVE-2023-5727 CVE record

Mozilla Firefox: The executable file warning was not presented when downloading .msix, .msixbundle, .appx…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 24 Oct 2023
CVE-2023-5726 CVE record

A website could have obscured the full screen notification by using the file open dialog.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 24 Oct 2023
CVE-2023-5725 CVE record

Mozilla Firefox: A malicious installed WebExtension could open arbitrary URLs…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 24 Oct 2023
CVE-2023-5724 CVE record

CVSS 7.5 High

Uncontrolled resource consumption in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Denial of service
Not analysed yet 24 Oct 2023
CVE-2023-5721 CVE record

Mozilla Firefox: It was possible for certain browser prompts and dialogs to be activated or dismissed…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 24 Oct 2023
CVE-2023-5176 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 27 Sept 2023
CVE-2023-5174 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 27 Sept 2023
CVE-2023-5171 CVE record

Mozilla Firefox: During Ion compilation, a Garbage Collection could have resulted in a use-after-free…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 27 Sept 2023
CVE-2023-5169 CVE record

Mozilla Firefox: A compromised content process could have provided malicious data in a `PathRecording`…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 27 Sept 2023
CVE-2023-5168 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 27 Sept 2023
CVE-2023-4585 CVE record

CVSS 8.8 High

Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 11 Sept 2023
CVE-2023-4584 CVE record

Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Sept 2023
CVE-2023-4583 CVE record

CVSS 7.5 High

Browsing Context potentially not cleared when closing Private Window
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-754
Not analysed yet 11 Sept 2023
CVE-2023-4582 CVE record

CVSS 8.8 High

Buffer Overflow in WebGL glGetProgramiv
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 11 Sept 2023
CVE-2023-4581 CVE record

XLL file extensions were downloadable without warnings
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Sept 2023
CVE-2023-4580 CVE record

Push notifications saved to disk unencrypted
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Sept 2023
CVE-2023-4578 CVE record

Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Sept 2023
CVE-2023-4577 CVE record

Memory corruption in JIT UpdateRegExpStatics
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Sept 2023
CVE-2023-4576 CVE record

Integer Overflow in RecordedSourceSurfaceCreation
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Sept 2023
CVE-2023-4575 CVE record

Memory corruption in IPC FilePickerShownCallback
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Sept 2023
CVE-2023-4574 CVE record

Memory corruption in IPC ColorPickerShownCallback
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Sept 2023
CVE-2023-4573 CVE record

Memory corruption in IPC CanvasTranslator
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Sept 2023
CVE-2023-4057 CVE record

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 1 Aug 2023
CVE-2023-4054 CVE record

Mozilla Firefox: When opening appref-ms files, Firefox did not warn the user that these files may contain…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 1 Aug 2023
CVE-2023-4053 CVE record

Full screen notification obscured by external program
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 1 Aug 2023
CVE-2023-4052 CVE record

The Firefox updater created a directory writable by non-privileged users.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 1 Aug 2023
CVE-2023-4051 CVE record

Full screen notification obscured by file open dialog
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 1 Aug 2023