Skip to contentMozilla Thunderbird vulnerabilities
- mozilla firefox, firefox esr, thunderbird +2 moreIf there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests...CVE-2022-34472Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreSession history navigations may have led to a use-after-free and potentially exploitable crash....CVE-2022-34470Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreAn iframe that was not permitted to run scripts could do so if the user clicked on a <code...CVE-2022-34468Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreIf an object prototype was corrupted by an attacker, they would have been able to set undesired...CVE-2022-2200Fix availableEPSS 23.9%8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen downloading files on Windows, the % character was not escaped, which could have lead to a...CVE-2022-31739Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported...CVE-2022-31747Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have injected CSS into stylesheets accessible via internal URIs, such as...CVE-2022-31744Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have exploited a timing attack by sending a large number of allowCredential...CVE-2022-31742Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA crafted CMS message could have been processed incorrectly, leading to an invalid memory read,...CVE-2022-31741Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreOn arm64, WASM code could have resulted in incorrect assembly generation leading to a register...CVE-2022-31740Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen exiting fullscreen mode, an iframe could have confused the browser about the current state...CVE-2022-31738Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory...CVE-2022-31737Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreA malicious website could have learned the size of a cross-origin resource that supported Range...CVE-2022-31736Fix available9.8 Critical
- mozilla thunderbirdWhen displaying the sender of an email, and the sender name contained the Braille Pattern Blank...CVE-2022-1834Fix available6.5 Medium
- mozilla firefox, firefox esr, firefox for android +1 more +3 moreIf an attacker was able to corrupt the methods of an Array object in JavaScript via prototype...CVE-2022-1802Public exploitFix availableEPSS 28.5%8.8 High
- mozilla firefox, firefox esr, firefox for android +1 more +3 moreAn attacker could have sent a message to the parent process where the contents were used to...CVE-2022-1529Fix availableEPSS 17.6%8.8 High
- mozilla thunderbirdThe parent process would not properly check whether the Speech Synthesis feature is enabled, when...CVE-2022-29913Fix available6.5 Medium
- mozilla thunderbirdWhen viewing an email message A, which contains an attached message B, where B is encrypted or...CVE-2022-1520Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team...CVE-2022-29917Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreFirefox behaved slightly differently for already known resources when loading CSS resources...CVE-2022-29916Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen reusing existing popups Firefox would have allowed them to cover the fullscreen notification...CVE-2022-29914Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreRequests initiated through reader mode did not properly omit cookies with a SameSite attribute....CVE-2022-29912Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user...CVE-2022-29911Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreDocuments in deeply-nested cross-origin browsing contexts could have obtained permissions granted...CVE-2022-29909Fix available8.8 High
- mozilla thunderbirdWhen importing a revoked key that specified key compromise as the revocation reason, Thunderbird...CVE-2022-1197Fix available5.4 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the...CVE-2022-28289Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreDue to a layout change, iframe contents could have been rendered outside of its border. This...CVE-2022-28286Fix available5.4 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect...CVE-2022-28285Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreBy using a link with <code>rel="localization"</code> a use-after-free could have been triggered...CVE-2022-28282Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIf a compromised content process sent an unexpected number of WebAuthN Extensions in a Register...CVE-2022-28281Public exploitFix available8.8 High
- mozilla firefox esr, thunderbird +1 moreAfter a VR Process is destroyed, a reference to it may have been retained and used, leading to a...CVE-2022-1196Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 more<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in...CVE-2022-1097Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen installing an add-on, Firefox verified the signature before prompting the user; but while...CVE-2022-26387Fix available7.5 High
- mozilla firefox esr, thunderbird +1 morePreviously Firefox for macOS and Linux would download temporary files to a user-specific...CVE-2022-26386Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIf an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code>...CVE-2022-26384Fix available9.6 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreWhen resizing a popup after requesting fullscreen access, the popup would not display the...CVE-2022-26383Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading...CVE-2022-26381Fix available8.8 High
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreAn unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable...CVE-2022-26486In KEVFix available9.6 Critical
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreRemoving an XSLT parameter during processing could have lead to an exploitable use-after-free. We...CVE-2022-26485In KEVPublic exploitFix availableEPSS 14.3%8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused...CVE-2022-22753Fix available7.1 High
- mozilla thunderbirdIt may be possible for an attacker to craft an email message that causes Thunderbird to perform...CVE-2022-0566Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present...CVE-2022-22764Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a...CVE-2022-22763Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWeb-accessible extension pages (pages with a moz-extension:// scheme) were not correctly...CVE-2022-22761Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen importing resources using Web Workers, error messages would distinguish the difference...CVE-2022-22760Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIf a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently...CVE-2022-22759Fix available9.6 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreIf a user was convinced to drag and drop an image to their desktop or other folder, the resulting...CVE-2022-22756Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreIf a user installed an extension of a particular type, the extension could have auto-updated...CVE-2022-22754Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA race condition could have allowed bypassing the fullscreen notification which could have lead...CVE-2022-22746Fix available5.9 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped...CVE-2022-22744Fix available8.8 High
- Show moreLoading…