Advisories · Technology

Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-0247 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Memory safety bugs fixed in Firefox 134 and Thunderbird 134
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 7 Jan 2025
CVE-2025-0243 CVE record

CVSS 5.1 Medium

Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 7 Jan 2025
CVE-2025-0242 CVE record

CVSS 6.5 Medium

Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 7 Jan 2025
CVE-2025-0241 CVE record

CVSS 7.7 High

Memory corruption when using JavaScript Text Segmentation
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 7 Jan 2025
CVE-2025-0240 CVE record

CVSS 4.0 Medium

Compartment mismatch when parsing JavaScript JSON module
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 7 Jan 2025
CVE-2025-0239 CVE record

CVSS 4.0 Medium

Alt-Svc ALPN validation failure when redirected
- Mozilla Firefox
- Mozilla Thunderbird
- Weak cryptography or TLS
Not analysed yet 7 Jan 2025
CVE-2025-0238 CVE record

CVSS 5.3 Medium

Use-after-free when breaking lines in text
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 7 Jan 2025
CVE-2025-0237 CVE record

CVSS 5.4 Medium

WebChannel APIs susceptible to confused deputy attack
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
Not analysed yet 7 Jan 2025
CVE-2024-11699 CVE record

CVSS 8.8 High

Code injection in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Code injection
Not analysed yet 26 Nov 2024
CVE-2024-11708 CVE record

CVSS 6.5 Medium

Race condition in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
Not analysed yet 26 Nov 2024
CVE-2024-11706 CVE record

CVSS 6.5 Medium

NULL pointer dereference in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 26 Nov 2024
CVE-2024-11705 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

NULL pointer dereference in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 26 Nov 2024
CVE-2024-11698 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mozilla Firefox: A flaw in handling fullscreen transitions may have inadvertently caused the application…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 26 Nov 2024
CVE-2024-11704 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Double free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 26 Nov 2024
CVE-2024-11697 CVE record

CVSS 8.8 High

Code injection in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Code injection
Not analysed yet 26 Nov 2024
CVE-2024-11696 CVE record

CVSS 5.4 Medium

Improper signature verification in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Weak cryptography or TLS
Not analysed yet 26 Nov 2024
CVE-2024-11695 CVE record

CVSS 5.4 Medium

Clickjacking in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-1021
Not analysed yet 26 Nov 2024
CVE-2024-11694 CVE record

CVSS 6.1 Medium

Cross-site scripting in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Cross-site scripting (XSS)
Not analysed yet 26 Nov 2024
CVE-2024-11693 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mozilla Firefox: The executable file warning was not presented when downloading .library-ms files. *Note…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 26 Nov 2024
CVE-2024-11702 CVE record

CVSS 7.5 High

Mozilla Firefox: Copying sensitive information from Private Browsing tabs on Android, such as passwords…
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-838
Not analysed yet 26 Nov 2024
CVE-2024-11701 CVE record

CVSS 4.3 Medium

Authentication bypass by spoofing in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 26 Nov 2024
CVE-2024-11692 CVE record

CVSS 4.3 Medium

Authentication bypass by spoofing in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Authentication bypass
Not analysed yet 26 Nov 2024
CVE-2024-11700 CVE record

CVSS 8.1 High

Clickjacking in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
Not analysed yet 26 Nov 2024
CVE-2024-11691 CVE record

CVSS 8.8 High

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 26 Nov 2024
CVE-2024-11159 CVE record

CVSS 5.3 Medium

Cleartext storage of sensitive information in Mozilla Thunderbird
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 13 Nov 2024
CVE-2024-10468 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Resource allocation without limits in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 29 Oct 2024
CVE-2024-10467 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Out-of-bounds read in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 29 Oct 2024
CVE-2024-10466 CVE record

CVSS 7.5 High

Uncontrolled resource consumption in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Denial of service
Not analysed yet 29 Oct 2024
CVE-2024-10465 CVE record

CVSS 7.5 High

Authentication bypass by spoofing in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Authentication bypass
Not analysed yet 29 Oct 2024
CVE-2024-10464 CVE record

CVSS 7.5 High

Out-of-bounds read in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 29 Oct 2024
CVE-2024-10463 CVE record

CVSS 7.5 High

Observable discrepancy in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Information disclosure
Not analysed yet 29 Oct 2024
CVE-2024-10462 CVE record

CVSS 7.5 High

Authentication bypass by spoofing in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Authentication bypass
Not analysed yet 29 Oct 2024
CVE-2024-10461 CVE record

CVSS 6.1 Medium

Cross-site scripting in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Cross-site scripting (XSS)
Not analysed yet 29 Oct 2024
CVE-2024-10460 CVE record

CVSS 5.4 Medium

Origin validation error in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-346
Not analysed yet 29 Oct 2024
CVE-2024-10459 CVE record

CVSS 6.5 Medium

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 29 Oct 2024
CVE-2024-10458 CVE record

CVSS 6.5 Medium

Mozilla Firefox: A permission leak could have occurred from a trusted site to an untrusted site via…
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-281
Not analysed yet 29 Oct 2024
CVE-2024-9680 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 9 Oct 2024
CVE-2024-9403 CVE record

CVSS 7.3 High

Buffer overflow in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Oct 2024
CVE-2024-9402 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Buffer overflow in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 1 Oct 2024
CVE-2024-9401 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Buffer overflow in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 1 Oct 2024
CVE-2024-9400 CVE record

CVSS 8.8 High

Buffer overflow in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 1 Oct 2024
CVE-2024-9399 CVE record

CVSS 7.5 High

Improper resource shutdown in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Denial of service
Not analysed yet 1 Oct 2024
CVE-2024-9398 CVE record

CVSS 5.3 Medium

Observable discrepancy in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Information disclosure
Not analysed yet 1 Oct 2024
CVE-2024-9397 CVE record

CVSS 6.1 Medium

Clickjacking in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-1021
Not analysed yet 1 Oct 2024
CVE-2024-9396 CVE record

CVSS 8.8 High

Buffer overflow in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 1 Oct 2024
CVE-2024-9394 CVE record

CVSS 6.1 Medium

Cross-site scripting in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Cross-site scripting (XSS)
Not analysed yet 1 Oct 2024
CVE-2024-9393 CVE record

CVSS 7.5 High

Origin validation error in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-346
Not analysed yet 1 Oct 2024
CVE-2024-9392 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Origin validation error in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-346
Not analysed yet 1 Oct 2024
CVE-2024-8900 CVE record

CVSS 7.5 High

Incorrect permission assignment in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Broken access control
Not analysed yet 17 Sept 2024
CVE-2024-7652 CVE record

CVSS 7.5 High

Type Confusion in Async Generators in Javascript Engine
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 6 Sept 2024
CVE-2024-8394 CVE record

CVSS 6.5 Medium

Use after free in Mozilla Thunderbird
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 6 Sept 2024
CVE-2024-8387 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Buffer overflow in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 3 Sept 2024
CVE-2024-8386 CVE record

CVSS 6.1 Medium

Authentication bypass by spoofing in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Authentication bypass
Not analysed yet 3 Sept 2024
CVE-2024-8385 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Type confusion in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 3 Sept 2024
CVE-2024-8384 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 3 Sept 2024
CVE-2024-8382 CVE record

CVSS 8.8 High

Mozilla Firefox: Internal browser event interfaces were exposed to web content when privileged…
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-273
Not analysed yet 3 Sept 2024
CVE-2024-8381 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Type confusion in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 3 Sept 2024
CVE-2024-7529 CVE record

CVSS 8.1 High

The date picker could partially obscure security prompts.
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-451
Not analysed yet 6 Aug 2024
CVE-2024-7528 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 6 Aug 2024
CVE-2024-7527 CVE record

CVSS 8.8 High

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 6 Aug 2024