Skip to contentMozilla Thunderbird vulnerabilities
- mozilla firefox, firefox esr, thunderbird +2 moreIf a garbage collection was triggered at the right time, a use-after-free could have occurred...CVE-2024-5688Fix available8.1 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMemory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of...CVE-2024-4777Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen saving a page to PDF, certain font styles could have led to a potential use-after-free crash...CVE-2024-4770Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreWhen importing resources using Web Workers, error messages would distinguish the difference...CVE-2024-4769Fix available5.9 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a...CVE-2024-4768Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIf the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not...CVE-2024-4767Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +5 more +7 morePDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDFCVE-2024-4367Public exploitFix availableEPSS 70.7%8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMemory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug...CVE-2024-3864Fix available8.1 High
- mozilla firefox, firefox esr, thunderbird +2 moreThere was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server...CVE-2024-3302Fix available3.7 Low
- mozilla firefox, firefox esr, thunderbird +2 moreThe executable file warning was not presented when downloading .xrm-ms files.
*Note: This issue...CVE-2024-38639.8 Critical
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIf an AlignedBuffer were assigned to itself, the subsequent self-move could result in an...CVE-2024-3861Fix available4.0 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreOn 32-bit versions there were integer-overflows that led to an out-of-bounds-read that...CVE-2024-3859Fix available5.9 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreThe JIT created incorrect code for arguments in certain cases. This led to potential use-after...CVE-2024-3857Fix available7.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreIn some code patterns the JIT incorrectly optimized switch statements and generated code with out...CVE-2024-3854Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreGetBoundName could return the wrong version of an object when JIT optimizations were applied....CVE-2024-3852Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreTo harden ICU against exploitation, the behavior for out-of-memory conditions was changed to...CVE-2024-2616Fix available2.7 Low
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have leveraged the Windows Error Reporter to run arbitrary code on the system...CVE-2024-2605Fix available5.9 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMemory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of...CVE-2024-2614Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreIf an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have...CVE-2024-2612Fix available8.1 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA missing delay on when pointer lock was used could have allowed a malicious page to trick a user...CVE-2024-2611Fix available5.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreUsing a markup injection an attacker could have stolen nonce values. This could have been used to...CVE-2024-2610Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreThe permission prompt input delay could have expired while the window is not in focus, which made...CVE-2024-2609Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 more`AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()...CVE-2024-2608Fix available8.4 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreReturn registers were overwritten which could have allowed an attacker to execute arbitrary code....CVE-2024-2607Fix available8.1 High
- mozilla thunderbird, debian linux +1 moreThe encrypted subject of an email message could be incorrectly and permanently assigned to an...CVE-2024-1936Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMemory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of...CVE-2024-1553Fix available8.1 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIncorrect code generation could have led to unexpected numeric conversions and potential...CVE-2024-1552Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreSet-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an...CVE-2024-1551Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA malicious website could have used a combination of exiting fullscreen mode and ...CVE-2024-1550Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIf a website set a large custom cursor, portions of the cursor could have overlapped with the...CVE-2024-1549Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA website could have obscured the fullscreen notification by using a dropdown select input...CVE-2024-1548Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreThrough a series of API calls and redirects, an attacker-controlled alert dialog could have been...CVE-2024-1547Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreWhen storing and re-accessing data on a networking channel, the length of buffers may have been...CVE-2024-1546Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreAn unchecked return value in TLS handshake code could have caused a potentially exploitable crash...CVE-2024-0743Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMemory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of...CVE-2024-0755Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIn specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This...CVE-2024-0753Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA malicious devtools extension could have been used to escalate privileges. This vulnerability...CVE-2024-0751Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA bug in popup notifications delay calculation could have made it possible for an attacker to...CVE-2024-0750Fix available8.8 High
- mozilla firefox, thunderbird, debian linux +1 more +3 moreA phishing site could have repurposed an `about:` dialog to show phishing content with an...CVE-2024-0749Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreWhen a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security...CVE-2024-0747Fix available6.5 Medium
- debian linux, mozilla firefox, firefox esr +1 more +3 moreA Linux user opening the print preview dialog could have caused the browser to crash. This...CVE-2024-0746Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIt was possible for certain browser prompts and dialogs to be activated or dismissed...CVE-2024-0742Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreAn out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a...CVE-2024-0741Public exploitFix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMemory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of...CVE-2023-6864Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreThe `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on...CVE-2023-6863Fix available8.8 High
- mozilla firefox esr, thunderbird, debian linux +2 moreA use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest...CVE-2023-6862Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreThe `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in...CVE-2023-6861Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreThe `VideoBridge` allowed any content process to use textures produced by remote decoders. This...CVE-2023-6860Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA use-after-free condition affected TLS socket creation when under memory pressure. This...CVE-2023-6859Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreFirefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM...CVE-2023-6858Fix available8.8 High
- Show moreLoading…