Skip to contentMozilla Thunderbird vulnerabilities
- mozilla thunderbirdAddress of e-mail sender can be spoofed by malicious emailCVE-2025-0510Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreFullscreen notification not properly displayedCVE-2025-1019Fix available4.3 Medium
- mozilla firefox, thunderbird +1 moreFullscreen notification is not displayed when fullscreen is re-requestedCVE-2025-1018Fix available5.3 Medium
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7CVE-2025-1017Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7CVE-2025-1016Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreCertificate length was not properly checkedCVE-2025-1014Fix available8.8 High
- mozilla firefox, thunderbird +1 morePotential opening of private browsing tabs in normal browsing windowsCVE-2025-1013Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free during concurrent delazificationCVE-2025-1012Fix available7.5 High
- mozilla firefox, thunderbird +1 moreA bug in WebAssembly code generation could result in a crashCVE-2025-1011Fix available8.8 High
- mozilla firefox, thunderbird +1 moreUse-after-free in Custom HighlightCVE-2025-1010Fix available8.8 High
- mozilla firefox, thunderbird +1 moreUse-after-free in XSLTCVE-2025-1009Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 134 and Thunderbird 134CVE-2025-0247Fix availableEPSS 10.7%9.8 Critical
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6CVE-2025-0243Fix available5.1 Medium
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6CVE-2025-0242Fix availableEPSS 14.7%6.5 Medium
- mozilla firefox, thunderbird +1 moreMemory corruption when using JavaScript Text SegmentationCVE-2025-0241Fix available7.7 High
- mozilla firefox, thunderbird +1 moreCompartment mismatch when parsing JavaScript JSON moduleCVE-2025-0240Fix available4.0 Medium
- mozilla firefox, thunderbird +1 moreAlt-Svc ALPN validation failure when redirectedCVE-2025-0239Fix available4.0 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free when breaking lines in textCVE-2025-0238Fix available5.3 Medium
- mozilla firefox, thunderbird +1 moreWebChannel APIs susceptible to confused deputy attackCVE-2025-0237Fix available5.4 Medium
- mozilla firefox, thunderbird +1 moreMissing thread synchronization primitives could have led to a data race on members of the...CVE-2024-11708Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMemory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of...CVE-2024-11699Fix available8.8 High
- mozilla firefox, thunderbird +1 moreA null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the...CVE-2024-11706Fix available6.5 Medium
- mozilla firefox, thunderbird +1 more`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was...CVE-2024-11705Fix available9.1 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreA flaw in handling fullscreen transitions may have inadvertently caused the application to become...CVE-2024-116989.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreA double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an...CVE-2024-11704Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreWhen handling keypress events, an attacker may have been able to trick a user into bypassing the ...CVE-2024-11697Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreThe application failed to account for exceptions thrown by the `loadManifestFromFile` method...CVE-2024-11696Fix available5.4 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA crafted URL containing Arabic script and whitespace characters could have hidden the true...CVE-2024-11695Fix available5.4 Medium
- mozilla firefox, thunderbird +1 moreCopying sensitive information from Private Browsing tabs on Android, such as passwords, may have...CVE-2024-117027.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreEnhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src`...CVE-2024-11694Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe executable file warning was not presented when downloading .library-ms files.
*Note: This...CVE-2024-11693Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreThe incorrect domain may have been displayed in the address bar during an interrupted navigation...CVE-2024-11701Fix available4.3 Medium
- mozilla firefox, thunderbird +1 moreMalicious websites may have been able to user intent confirmation through tapjacking. This could...CVE-2024-117008.1 High
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could cause a select dropdown to be shown over another tab; this could have led to...CVE-2024-11692Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have caused memory corruption due to a flaw in Apple's GPU driver; this can be...CVE-2024-11691Fix available8.8 High
- mozilla thunderbirdUsing remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This...CVE-2024-11159Fix available4.3 Medium
- mozilla firefox, thunderbird +1 morePotential race conditions in IndexedDB could have caused memory corruption, leading to a...CVE-2024-10468Fix available5.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMemory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of...CVE-2024-10467Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreBy sending a specially crafted push message, a remote server could have hung the parent process,...CVE-2024-10466Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreA clipboard "paste" button could persist across tabs which allowed a spoofing attack. This...CVE-2024-10465Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreRepeated writes to history interface attributes could have been used to cause a Denial of Service...CVE-2024-10464Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreVideo frames could have been leaked between origins in some situations. This vulnerability...CVE-2024-10463Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreTruncation of a long URL could have allowed origin spoofing in a permission prompt. This...CVE-2024-10462Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIn multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header...CVE-2024-10461Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe origin of an external protocol handler prompt could have been obscured using a data: URL...CVE-2024-10460Fix available5.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have caused a use-after-free when accessibility was enabled, leading to a...CVE-2024-10459Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreA permission leak could have occurred from a trusted site to an untrusted site via `embed` or ...CVE-2024-10458Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreAn attacker was able to achieve code execution in the content process by exploiting a use-after...CVE-2024-9680In KEVPublic exploitFix availableEPSS 23.2%9.8 Critical
- mozilla firefox, thunderbird +1 moreMemory safety bugs present in Firefox 130. Some of these bugs showed evidence of memory...CVE-2024-9403Fix available7.3 High
- mozilla firefox, firefox esr, thunderbird +2 moreMemory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of...CVE-2024-9402Fix available9.8 Critical
- Show moreLoading…