Mozilla Thunderbird

Spoofing issue in the Privacy: Anti-Tracking component

When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 128.2.

Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. This vulnerability affects Firefox < 133 and Thunderbird < 133.

Potential opening of private browsing tabs in normal browsing windows

Mitigation bypass in the File Handling component

Incorrect boundary conditions in the JavaScript: GC component

Chat UI manipulation by injection

Memory safety bugs fixed in Firefox 138 and Thunderbird 138

Same-origin policy bypass in the Layout component

Spoofing issue in the WebAuthn component in Firefox for Android

JIT optimization bug with different stack slot sizes

Specially crafted filename could be used to obscure download type

Address of e-mail sender can be spoofed by malicious email

Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: postMessage component

Sandboxed iframes allowed links to open in external apps (Android only)

Memory safety bug fixed in Firefox 152

Some non-writable Object properties could be modified

Denial-of-service in the Graphics: ImageLib component

Denial-of-service in the Audio/Video: Playback component

Spoofing issue in the Address Bar component

Same-origin policy bypass in the Request Handling component

Cross-site request forgery via storage access API redirects

Same-origin policy bypass in the Networking: JAR component

Double free vulnerability in nsVCard.cpp in Mozilla Thunderbird before 1.5.0.4 and SeaMonkey before 1.0.2 allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via a VCard that contains invalid base64 characters.

Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 allow remote attackers to bypass the Same Origin Policy and read the Location object via a prototype property-injection attack that defeats certain protection mechanisms for this object.

The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via an invalid custom waveform that triggers a calculation of a negative frequency value.

Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates. NOTE: this identifier is for unpatched product versions that were originally intended to be addressed by CVE-2006-4340.

The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 exposes the internal "AnyName" object to external interfaces, which allows multiple cooperating domains to exchange information in violation of the same origin restrictions.

Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict write access to the window.fullScreen object, which allows remote attackers to spoof the user interface via a crafted web page.

User Interface (UI) Misrepresentation of attachment URL

Memory corruption in WebGL API

Information Disclosure of /tmp directory listing

Form validation popups could block exiting full-screen mode

Invalid pointer in the JavaScript: WebAssembly component

Spoofing issue in the DOM: Core & HTML component

Leak of hashed Window credentials via crafted attachment URL

Mozilla Updater in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 does not ensure exclusive access to a MAR file, which allows local users to gain privileges by creating a Trojan horse file after MAR signature verification but before MAR use.

Information disclosure in the Networking: Cache component

If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed. A site that relied on the browser behaving correctly could suffer a cross-site scripting vulnerability as a result. In general, this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but is potentially a risk in browser or browser-like contexts. This vulnerability affects Thunderbird < 68.5, Firefox < 73, and Firefox < ESR68.5.