Advisories · Technology

Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2023-3417 CVE record

File Extension Spoofing using the Text Direction Override Character
- Mozilla Thunderbird
Not analysed yet 24 Jul 2023
CVE-2023-3600 CVE record

Use-after-free in workers
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 12 Jul 2023
CVE-2023-37211 CVE record

Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 5 Jul 2023
CVE-2023-37208 CVE record

Unrestricted file upload in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Unrestricted file upload
Not analysed yet 5 Jul 2023
CVE-2023-37207 CVE record

Mozilla Firefox: A website could have obscured the fullscreen notification by using a URL with a scheme…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 5 Jul 2023
CVE-2023-37202 CVE record

Mozilla Firefox: Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 5 Jul 2023
CVE-2023-37201 CVE record

Mozilla Firefox: An attacker could have triggered a use-after-free condition when creating a WebRTC…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 5 Jul 2023
CVE-2023-34416 CVE record

Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12.
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 19 Jun 2023
CVE-2023-34414 CVE record

Mozilla Firefox ESR: The error page for sites with invalid TLS certificates was missing the activation-delay…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 19 Jun 2023
CVE-2023-29545 CVE record

CVSS 6.5 Medium

Mozilla Firefox: Similar to CVE-2023-28163, this time when choosing 'Save Link As'…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 19 Jun 2023
CVE-2023-29542 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mozilla Firefox: A newline in a filename could have been used to bypass the file extension security…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 19 Jun 2023
CVE-2023-29532 CVE record

CVSS 5.5 Medium

Mozilla Firefox: A local attacker can trick the Mozilla Maintenance Service into applying an unsigned…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 19 Jun 2023
CVE-2023-29531 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 19 Jun 2023
CVE-2023-32214 CVE record

Mozilla Firefox: Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 19 Jun 2023
CVE-2023-32215 CVE record

Mozilla Firefox: Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-32213 CVE record

When reading a file, an uninitialized value could have been used as read limit.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-32212 CVE record

An attacker could have positioned a `datalist` element to obscure the address bar.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-32211 CVE record

A type checking bug would have led to invalid code being compiled.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-32207 CVE record

CVSS 8.8 High

Authentication bypass by spoofing in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Authentication bypass
Not analysed yet 2 Jun 2023
CVE-2023-32206 CVE record

An out-of-bound read could have led to a crash in the RLBox Expat driver.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-32205 CVE record

In multiple cases browser prompts could have been obscured by popups controlled by content.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-29550 CVE record

CVSS 8.8 High

Memory safety bugs present in Firefox 111 and Firefox ESR 102.9.
- Mozilla Firefox
- Mozilla Focus for Android
Not analysed yet 2 Jun 2023
CVE-2023-29548 CVE record

CVSS 6.5 Medium

A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.
- Mozilla Firefox
- Mozilla Focus for Android
Not analysed yet 2 Jun 2023
CVE-2023-29541 CVE record

CVSS 8.8 High

Improper output encoding in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Focus for Android
- CWE-116
Not analysed yet 2 Jun 2023
CVE-2023-29539 CVE record

Mozilla Firefox: When handling the filename directive in the Content-Disposition header…
- Mozilla Firefox
- Mozilla Focus for Android
Not analysed yet 2 Jun 2023
CVE-2023-29536 CVE record

Mozilla Firefox: An attacker could cause the memory manager to incorrectly free a pointer that addresses…
- Mozilla Firefox
- Mozilla Focus for Android
Not analysed yet 2 Jun 2023
CVE-2023-29535 CVE record

Mozilla Firefox: Following a Garbage Collector compaction…
- Mozilla Firefox
- Mozilla Focus for Android
Not analysed yet 2 Jun 2023
CVE-2023-29533 CVE record

Mozilla Firefox: A website could have obscured the fullscreen notification by using a combination of…
- Mozilla Firefox
- Mozilla Focus for Android
Not analysed yet 2 Jun 2023
CVE-2023-28176 CVE record

CVSS 8.8 High

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 2 Jun 2023
CVE-2023-28164 CVE record

CVSS 6.5 Medium

Origin validation error in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-346
Not analysed yet 2 Jun 2023
CVE-2023-28163 CVE record

CVSS 6.5 Medium

Path traversal in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Path traversal
Not analysed yet 2 Jun 2023
CVE-2023-28162 CVE record

CVSS 8.8 High

Type confusion in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 2 Jun 2023
CVE-2023-25752 CVE record

Mozilla Firefox: When accessing throttled streams, the count of available bytes needed to be checked in…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-25751 CVE record

Mozilla Firefox: Sometimes, when invalidating JIT code while following an iterator…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-25746 CVE record

CVSS 8.8 High

Out-of-bounds write in Mozilla Thunderbird and others
- Mozilla Thunderbird
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 2 Jun 2023
CVE-2023-25742 CVE record

Mozilla Firefox: When importing a SPKI RSA public key as ECDSA P-256…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 2 Jun 2023
CVE-2023-25739 CVE record

CVSS 8.8 High

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 2 Jun 2023
CVE-2023-25738 CVE record

CVSS 6.5 Medium

Out-of-bounds read in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 2 Jun 2023
CVE-2023-25737 CVE record

CVSS 8.8 High

Incorrect type conversion in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-704
Not analysed yet 2 Jun 2023
CVE-2023-25735 CVE record

CVSS 8.8 High

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 2 Jun 2023
CVE-2023-25734 CVE record

CVSS 8.1 High

Open redirect in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Open redirect
Not analysed yet 2 Jun 2023
CVE-2023-25732 CVE record

CVSS 8.8 High

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 2 Jun 2023
CVE-2023-25730 CVE record

CVSS 5.4 Medium

Clickjacking in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
Not analysed yet 2 Jun 2023
CVE-2023-25729 CVE record

CVSS 8.8 High

Incorrect authorization in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
Not analysed yet 2 Jun 2023
CVE-2023-25728 CVE record

CVSS 6.5 Medium

Observable discrepancy in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 2 Jun 2023
CVE-2023-23605 CVE record

CVSS 8.8 High

Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 2 Jun 2023
CVE-2023-23603 CVE record

CVSS 6.5 Medium

Calls to console.log allowed bypassing Content Security Policy via format directive
- Mozilla Firefox
- Mozilla Firefox ESR
- Denial of service
Not analysed yet 2 Jun 2023
CVE-2023-23602 CVE record

CVSS 6.5 Medium

Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-754
Not analysed yet 2 Jun 2023
CVE-2023-23601 CVE record

URL being dragged from cross-origin iframe into same tab triggers navigation
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-23599 CVE record

Malicious command could be hidden in devtools output on Windows
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-23598 CVE record

Arbitrary file read from GTK drag and drop on Linux
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-1945 CVE record

CVSS 6.5 Medium

Out-of-bounds write in Mozilla Thunderbird and others
- Mozilla Thunderbird
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 2 Jun 2023
CVE-2023-0767 CVE record

CVSS 8.8 High

Mozilla Firefox: An attacker could construct a PKCS 12 cert bundle in such a way that could allow for…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 2 Jun 2023
CVE-2023-0616 CVE record

CVSS 6.5 Medium

Resource allocation without limits in Mozilla Thunderbird
- Mozilla Thunderbird
- Denial of service
Not analysed yet 2 Jun 2023
CVE-2023-0547 CVE record

CVSS 6.5 Medium

Improper certificate validation in Mozilla Thunderbird
- Mozilla Thunderbird
- Weak cryptography or TLS
Not analysed yet 2 Jun 2023
CVE-2023-0430 CVE record

CVSS 6.5 Medium

Improper certificate validation in Mozilla Thunderbird
- Mozilla Thunderbird
- Weak cryptography or TLS
Not analysed yet 2 Jun 2023
CVE-2021-43529 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Out-of-bounds write in Mozilla Thunderbird
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Feb 2023
CVE-2022-46882 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 22 Dec 2022
CVE-2022-46881 CVE record

CVSS 8.8 High

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 22 Dec 2022
CVE-2022-46880 CVE record

CVSS 6.5 Medium

Use after free in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Firefox
- Memory corruption
Not analysed yet 22 Dec 2022