Mozilla Thunderbird vulnerabilities

CVE-2020-6819 High · 8.1 KEV High · 54 CWE-362 Apr 24, 2020

Mozilla Firefox And Thunderbird Use-After-Free Vulnerability

Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.

CVE-2019-17026 High · 8.8 KEV Urgent · 70 Public exploit CWE-843 Mar 2, 2020

Mozilla Firefox And Thunderbird Type Confusion Vulnerability

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.

CVE-2019-11708 Critical · 10.0 KEV Urgent · 74 Public exploit CWE-20 Jul 23, 2019

Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.

CVE-2019-11707 High · 8.8 KEV Urgent · 70 Public exploit CWE-843 Jul 23, 2019

Mozilla Firefox and Thunderbird Type Confusion Vulnerability

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.

CVE-2017-5436 High · 8.8 CWE-787 Jun 11, 2018

An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite...

An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVE-2016-9079 High · 7.5 KEV Urgent · 79 Public exploit CWE-416 Jun 11, 2018

Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

CVE-2013-1690 High · 8.8 KEV Urgent · 76 Public exploit CWE-119 Jun 26, 2013

Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.

CVE-2013-1675 Medium · 6.5 KEV High · 52 CWE-665 May 16, 2013

Mozilla Firefox Information Disclosure Vulnerability

Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.

CVE-2010-3765 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-119 Oct 27, 2010

Mozilla Multiple Products Remote Code Execution Vulnerability

Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.