This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Mozilla First view 2004-08-06
Product Thunderbird Last view 2025-06-11
Version Type
Update  
Edition  
Language  
Sofware Edition  
Target Software  
Target Hardware  
Other  

Activity : Overall

COMMON PLATFORM ENUMERATION: Repartition per Version

CPE Name Affected CVE
cpe:2.3:a:mozilla:thunderbird:1.5:-:*:*:*:*:*:* 1340
cpe:2.3:a:mozilla:thunderbird:0.7:-:*:*:*:*:*:* 1328
cpe:2.3:a:mozilla:thunderbird:0.6:*:*:*:*:*:*:* 1327
cpe:2.3:a:mozilla:thunderbird:1.0:-:*:*:*:*:*:* 1327
cpe:2.3:a:mozilla:thunderbird:1.0.1:*:*:*:*:*:*:* 1324
cpe:2.3:a:mozilla:thunderbird:1.0.7:*:*:*:*:*:*:* 1323
cpe:2.3:a:mozilla:thunderbird:1.0.6:*:*:*:*:*:*:* 1322
cpe:2.3:a:mozilla:thunderbird:1.0.5:*:*:*:*:*:*:* 1322
cpe:2.3:a:mozilla:thunderbird:1.0.2:*:*:*:*:*:*:* 1322
cpe:2.3:a:mozilla:thunderbird:0.5:*:*:*:*:*:*:* 1321
cpe:2.3:a:mozilla:thunderbird:0.1:*:*:*:*:*:*:* 1321
cpe:2.3:a:mozilla:thunderbird:0.2:*:*:*:*:*:*:* 1321
cpe:2.3:a:mozilla:thunderbird:0.4:*:*:*:*:*:*:* 1321
cpe:2.3:a:mozilla:thunderbird:0.3:*:*:*:*:*:*:* 1321
cpe:2.3:a:mozilla:thunderbird:0.7.2:*:*:*:*:*:*:* 1320
cpe:2.3:a:mozilla:thunderbird:1.5:beta2:*:*:*:*:*:* 1320
cpe:2.3:a:mozilla:thunderbird:0.7.1:*:*:*:*:*:*:* 1320
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* 1319
cpe:2.3:a:mozilla:thunderbird:1.0.3:*:*:*:*:*:*:* 1318
cpe:2.3:a:mozilla:thunderbird:1.0.4:*:*:*:*:*:*:* 1318
cpe:2.3:a:mozilla:thunderbird:0.7.3:*:*:*:*:*:*:* 1316
cpe:2.3:a:mozilla:thunderbird:1.0.5:beta:*:*:*:*:*:* 1315
cpe:2.3:a:mozilla:thunderbird:0.8:*:*:*:*:*:*:* 1315
cpe:2.3:a:mozilla:thunderbird:0.9:*:*:*:*:*:*:* 1313
cpe:2.3:a:mozilla:thunderbird:-:*:*:*:*:*:*:* 1311
cpe:2.3:a:mozilla:thunderbird:1.5.0.1:*:*:*:*:*:*:* 1309
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:* 1308
cpe:2.3:a:mozilla:thunderbird:0.7:rc:*:*:*:*:*:* 1308
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:* 1308
cpe:2.3:a:mozilla:thunderbird:1.5.0.2:*:*:*:*:*:*:* 1308
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:x86:* 1308
cpe:2.3:a:mozilla:thunderbird:1.5.0.4:*:*:*:*:*:*:* 1303
cpe:2.3:a:mozilla:thunderbird:1.0:rc:*:*:*:*:*:* 1302
cpe:2.3:a:mozilla:thunderbird:1.0.8:*:*:*:*:*:*:* 1301
cpe:2.3:a:mozilla:thunderbird:1.5.0.3:*:*:*:*:*:*:* 1295
cpe:2.3:a:mozilla:thunderbird:1.5:rc1:*:*:*:*:*:* 1293
cpe:2.3:a:mozilla:thunderbird:1.5:rc2:*:*:*:*:*:* 1293
cpe:2.3:a:mozilla:thunderbird:1.1:alpha1:*:*:*:*:*:* 1293
cpe:2.3:a:mozilla:thunderbird:1.5:beta1:*:*:*:*:*:* 1293
cpe:2.3:a:mozilla:thunderbird:1.1:alpha2:*:*:*:*:*:* 1293
cpe:2.3:a:mozilla:thunderbird:1.5.0.6:*:*:*:*:*:*:* 1289
cpe:2.3:a:mozilla:thunderbird:1.5.0.7:*:*:*:*:*:*:* 1286
cpe:2.3:a:mozilla:thunderbird:1.5.0.5:*:*:*:*:*:*:* 1283
cpe:2.3:a:mozilla:thunderbird:1.5.0.8:*:*:*:*:*:*:* 1281
cpe:2.3:a:mozilla:thunderbird:2.0.0.3:*:*:*:*:*:*:* 1276
cpe:2.3:a:mozilla:thunderbird:2.0.0.0:*:*:*:*:*:*:* 1276
cpe:2.3:a:mozilla:thunderbird:2.0.0.2:*:*:*:*:*:*:* 1276
cpe:2.3:a:mozilla:thunderbird:2.0.0.1:*:*:*:*:*:*:* 1276
cpe:2.3:a:mozilla:thunderbird:1.5.0.9:*:*:*:*:*:*:* 1274
cpe:2.3:a:mozilla:thunderbird:2.0.0.4:*:*:*:*:*:*:* 1274

Related : CVE

This CPE Product have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
  Date Alert Description
0 2025-06-11 CVE-2025-5986

A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. This vulnerability affects Thunderbird < 128.11.1 and Thunderbird < 139.0.2.

0 2025-05-27 CVE-2025-5272

Memory safety bugs present in Firefox 138 and Thunderbird 138. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 139 and Thunderbird < 139.

0 2025-05-27 CVE-2025-5269

Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 128.11 and Thunderbird < 128.11.

0 2025-05-27 CVE-2025-5268

Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11.

0 2025-05-17 CVE-2025-4919

An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability affects Firefox < 138.0.4, Firefox ESR < 128.10.1, Firefox ESR < 115.23.1, Thunderbird < 128.10.2, and Thunderbird < 138.0.2.

0 2025-05-17 CVE-2025-4918

An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability affects Firefox < 138.0.4, Firefox ESR < 128.10.1, Firefox ESR < 115.23.1, Thunderbird < 128.10.2, and Thunderbird < 138.0.2.

0 2025-05-14 CVE-2025-3932

It was possible to craft an email that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird automatically accessed the link. The configuration to block remote content did not prevent that. Thunderbird has been fixed to no longer allow access to web pages listed in the X-Mozilla-External-Attachment-URL header of an email. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1.

0 2025-05-14 CVE-2025-3909

Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment (message/rfc822) and setting its content type to application/pdf, Thunderbird may incorrectly render it as HTML when opened, allowing the embedded JavaScript to run without requiring a file download. This behavior relies on Thunderbird auto-saving the attachment to /tmp and linking to it via the file:/// protocol, potentially enabling JavaScript execution as part of the HTML. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1.

0 2025-05-14 CVE-2025-3875

Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats spoofed@example.com as the actual address. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1.

0 2025-04-29 CVE-2025-4093

Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 128.10 and Thunderbird < 128.10.

0 2025-04-29 CVE-2025-4092

Memory safety bugs present in Firefox 137 and Thunderbird 137. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 138 and Thunderbird < 138.

0 2025-04-29 CVE-2025-4091

Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Thunderbird < 138, and Thunderbird < 128.10.

0 2025-04-29 CVE-2025-4090

A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat. This vulnerability affects Firefox < 138 and Thunderbird < 138.

0 2025-04-29 CVE-2025-4089

Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability affects Firefox < 138 and Thunderbird < 138.

0 2025-04-29 CVE-2025-4088

A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invoked the Storage Access API. This enabled potential Cross-Site Request Forgery attacks across origins. This vulnerability affects Firefox < 138 and Thunderbird < 138.

0 2025-04-29 CVE-2025-4087

A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access and potentially, memory corruption. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Thunderbird < 138, and Thunderbird < 128.10.

0 2025-04-29 CVE-2025-4086

A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. *This bug only affects Thunderbird for Android. Other versions of Thunderbird are unaffected.* This vulnerability affects Firefox < 138 and Thunderbird < 138.

0 2025-04-29 CVE-2025-4085

An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or escalate privileges. This vulnerability affects Firefox < 138 and Thunderbird < 138.

0 2025-04-29 CVE-2025-4084

Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. *This bug only affects Firefox for Windows. Other versions of Firefox are unaffected.* This vulnerability affects Firefox ESR < 128.10, Firefox ESR < 115.23, and Thunderbird < 128.10.

0 2025-04-29 CVE-2025-4083

A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23, Thunderbird < 138, and Thunderbird < 128.10.

0 2025-04-29 CVE-2025-4082

Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate privileges. *This bug only affects Thunderbird for macOS. Other versions of Thunderbird are unaffected.* This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23, Thunderbird < 138, and Thunderbird < 128.10.

0 2025-04-29 CVE-2025-2817

Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths controlled by a non-privileged user and enabling privilege escalation. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23, Thunderbird < 138, and Thunderbird < 128.10.

0 2025-04-15 CVE-2025-3523

When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.

0 2025-04-15 CVE-2025-3522

Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validated or sanitized, it can reference internal resources like chrome:// or SMB share file:// links, potentially leading to hashed Windows credential leakage and opening the door to more serious security issues. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.

0 2025-04-15 CVE-2025-2830

By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the victim's system. This vulnerability is not limited to Linux; similar behavior has been observed on Windows as well. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.

CWE : Common Weakness Enumeration

This CPE Product have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
%idName
17% (177) CWE-416 Use After Free
14% (152) CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
11% (120) CWE-787 Out-of-bounds Write
7% (73) CWE-399 Resource Management Errors
5% (55) CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting')
5% (54) CWE-20 Improper Input Validation
5% (51) CWE-264 Permissions, Privileges, and Access Controls
4% (45) CWE-200 Information Exposure
2% (29) CWE-94 Failure to Control Generation of Code ('Code Injection')
2% (28) CWE-125 Out-of-bounds Read
2% (21) CWE-362 Race Condition
1% (16) CWE-189 Numeric Errors
1% (15) CWE-190 Integer Overflow or Wraparound
1% (14) CWE-346 Origin Validation Error
1% (11) CWE-269 Improper Privilege Management
0% (10) CWE-295 Certificate Issues
0% (8) CWE-203 Information Exposure Through Discrepancy
0% (6) CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflo...
0% (6) CWE-74 Failure to Sanitize Data into a Different Plane ('Injection')
0% (6) CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path ...
0% (5) CWE-476 NULL Pointer Dereference
0% (5) CWE-352 Cross-Site Request Forgery (CSRF)
0% (5) CWE-326 Inadequate Encryption Strength
0% (5) CWE-290 Authentication Bypass by Spoofing
0% (5) CWE-17 Code

CAPEC : Common Attack Pattern Enumeration & Classification

This CPE Product have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Name
CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
CAPEC-7 Blind SQL Injection
CAPEC-8 Buffer Overflow in an API Call
CAPEC-9 Buffer Overflow in Local Command-Line Utilities
CAPEC-10 Buffer Overflow via Environment Variables
CAPEC-13 Subverting Environment Variable Values
CAPEC-14 Client-side Injection-induced Buffer Overflow
CAPEC-18 Embedding Scripts in Nonscript Elements
CAPEC-22 Exploiting Trust in Client (aka Make the Client Invisible)
CAPEC-24 Filter Failure through Buffer Overflow
CAPEC-26 Leveraging Race Conditions
CAPEC-28 Fuzzing
CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies
CAPEC-32 Embedding Scripts in HTTP Query Strings
CAPEC-42 MIME Conversion
CAPEC-43 Exploiting Multiple Input Interpretation Layers
CAPEC-45 Buffer Overflow via Symbolic Links
CAPEC-46 Overflow Variables and Tags
CAPEC-47 Buffer Overflow via Parameter Expansion
CAPEC-52 Embedding NULL Bytes
CAPEC-53 Postfix, Null Terminate, and Backslash
CAPEC-63 Simple Script Injection
CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic
CAPEC-66 SQL Injection

Oval Markup Language : Definitions

This CPE Product have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
OvalID Name
oval:org.mitre.oval:def:3250 Mozilla, Firefox, Thunderbird POP3 SendUidl Buffer Overflow
oval:org.mitre.oval:def:11042 Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla...
oval:org.mitre.oval:def:9240 Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow rem...
oval:org.mitre.oval:def:3603 Mozilla, Firefox, Thunderbird Security Lock Icon Spoof Vulnerability
oval:org.mitre.oval:def:4403 Mozilla, Firefox, Thunderbird XPInstall Security Vulnerability
oval:org.mitre.oval:def:10032 Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow rem...
oval:org.mitre.oval:def:9419 Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow rem...
oval:org.mitre.oval:def:2418 Mozilla, Firefox, Thunderbird User Interface Hijacking Vulnerability
oval:org.mitre.oval:def:11162 The cert_TestHostName function in Mozilla before 1.7, Firefox before 0.9, and...
oval:org.mitre.oval:def:11201 Multiple heap-based buffer overflows in Mozilla Firefox before the Preview Re...
oval:org.mitre.oval:def:10873 Stack-based buffer overflow in the writeGroup function in nsVCardObj.cpp for ...
oval:org.mitre.oval:def:10952 Integer overflow in the bitmap (BMP) decoder for Mozilla Firefox before the P...
oval:org.mitre.oval:def:11668 The XPInstall installer in Mozilla Firefox before the Preview Release, Mozill...
oval:org.mitre.oval:def:9745 Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunder...
oval:org.mitre.oval:def:9543 Mozilla before 1.7.6, and Firefox before 1.0.1, allows remote attackers to sp...
oval:org.mitre.oval:def:100056 Mozilla Creates World-readable temp Files
oval:org.mitre.oval:def:100048 Mozilla Thunderbird Subject to IE Vulnerabilities via javascript
oval:org.mitre.oval:def:11407 Thunderbird 0.6 through 0.9 and Mozilla 1.7 through 1.7.3 does not obey the n...
oval:org.mitre.oval:def:100047 Mozilla Mail News Cookie Security Bypass Vulnerability
oval:org.mitre.oval:def:9111 The TimeZone.getTimeZone method in Sun Java SE 5.0 before Update 22 and 6 bef...
oval:org.mitre.oval:def:100040 Mozilla String Library Memory Overwrite Vulnerability
oval:org.mitre.oval:def:11377 The TimeZone.getTimeZone method in Sun Java SE 5.0 before Update 22 and 6 bef...
oval:org.mitre.oval:def:100028 Mozilla GIF Heap Overflow
oval:org.mitre.oval:def:10010 The installation confirmation dialog in Firefox before 1.0.1, Thunderbird bef...
oval:org.mitre.oval:def:100041 Mozilla 'user:pass@host' Spoofing Vulnerability

SAINT Exploits

Description Link
Firefox AttributeChildRemoved Use After Free More info here
Mozilla Firefox document.write and DOM insertion memory corruption More info here
Firefox DOMAttrModified nsSVGValue Observer Handling Out-of-bounds Memory Access More info here
Mozilla Firefox GIF processing buffer overflow More info here
Firefox sensor.dll Insecure Library Loading More info here
Mozilla Firefox QueryInterface method memory corruption More info here
Mozilla Firefox onreadystatechange Event Use After Free More info here
Mozilla Firefox XMLSerializer serializeToStream Use-after-free Vulnerability More info here
Firefox crypto.generateCRMFRequest command execution More info here

Open Source Vulnerability Database (OSVDB)

This CPE Product have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Description
77956 Mozilla Multiple Product Large OGG <video> Element Handling Remote DoS
77955 Mozilla Multiple Product for Mac DOM Frame Deletion NULL Dereference Remote C...
77954 Mozilla Multiple Product SVG Animation accessKey Event Handling Disabled Java...
77953 Mozilla Multiple Product DOMAttrModified SVG Element Handling Out-of-bounds M...
77952 Mozilla Multiple Product Multiple Unspecified Remote Memory Corruption
77951 Mozilla Multiple Product YARR Regular Expression Library Javascript Parsing R...
77609 Mozilla Multiple Product CSS Token Sequence Parsing Timing Attack Remote Info...
76955 Mozilla Multiple Product NoWaiverWrappers Internal Privilege Check Weakness R...
76954 Mozilla Multiple Product WebGL GPU Memory Random Image Disclosure
76953 Mozilla Multiple Product Windows D2D Hardware Acceleration Same Origin Policy...
76952 Mozilla Multiple Product Firebug JavaScript File Profiling Remote Memory Corr...
76951 Mozilla Multiple Product Multiple Unspecified Remote Memory Corruption (2011-...
76950 Mozilla Multiple Product Unchecked Allocation Failure Remote Memory Corruption
76949 Mozilla Multiple Product SVG <mpath> Non-SVG Link Remote Memory Corruption
76948 Mozilla Multiple Product Shift-JIS XSS
76947 Mozilla Multiple Product JSSubScriptLoader loadSubScript Method XPCNativeWrap...
75846 Mozilla Multiple Product Use-after-free OGG File Handling Remote Code Execution
75844 Mozilla Multiple Product YARR Unspecified Memory Corruption
75841 Mozilla Multiple Product Enter Key Download Dialog Verification Bypass
75840 Mozilla Multiple Product PLUGINSPAGE Enter Key Addon Installation Verificatio...
75839 Mozilla Multiple Product Multiple Header Handling HTTP Response Splitting Wea...
75838 Mozilla Multiple Product window.location Named Frame Creation Same Origin Pol...
75836 Mozilla Multiple Product Multiple Unspecified Memory Corruption (2011-2997)
75834 Mozilla Multiple Product Multiple Unspecified Memory Corruption (2011-2995)
74595 Mozilla Multiple Products Ogg Reader Unspecified DoS

ExploitDB Exploits

id Description
34363 Firefox toString console.time Privileged Javascript Injection
30474 Firefox 5.0 - 15.0.1 - __exposedProps__ XCS Code Execution
18531 Mozilla Firefox Firefox 4.0.1 Array.reduceRight() Exploit
17974 Mozilla Firefox Array.reduceRight() Integer Overflow Exploit
15342 Firefox Memory Corruption Proof of Concept (Simplified)
15104 MOAUB #25 - Mozilla Firefox CSS font-face Remote Code Execution Vulnerability
14949 MOAUB #9 - Mozilla Firefox XSLT Sort Remote Code Execution Vulnerability
14422 libpng <= 1.4.2 Denial of Service Vulnerability

OpenVAS Exploits

This CPE Product have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Description
2013-09-18 Name : Debian Security Advisory DSA 2406-1 (icedove - several vulnerabilities)
File : nvt/deb_2406_1.nasl
2013-09-18 Name : Debian Security Advisory DSA 2457-2 (iceweasel - several vulnerabilities)
File : nvt/deb_2457_2.nasl
2013-09-18 Name : Debian Security Advisory DSA 2458-2 (iceape - several vulnerabilities)
File : nvt/deb_2458_2.nasl
2013-09-18 Name : Debian Security Advisory DSA 2513-1 (iceape - several vulnerabilities)
File : nvt/deb_2513_1.nasl
2013-09-18 Name : Debian Security Advisory DSA 2553-1 (iceweasel - several vulnerabilities)
File : nvt/deb_2553_1.nasl
2013-09-18 Name : Debian Security Advisory DSA 2583-1 (iceweasel - several vulnerabilities)
File : nvt/deb_2583_1.nasl
2013-09-18 Name : Debian Security Advisory DSA 2584-1 (iceape - several vulnerabilities)
File : nvt/deb_2584_1.nasl
2013-09-18 Name : Debian Security Advisory DSA 2588-1 (icedove - several vulnerabilities)
File : nvt/deb_2588_1.nasl
2012-12-13 Name : SuSE Update for MozillaFirefox, openSUSE-SU-2012:0760-1 (MozillaFirefox,)
File : nvt/gb_suse_2012_0760_1.nasl
2012-12-13 Name : SuSE Update for MozillaFirefox openSUSE-SU-2012:0899-1 (MozillaFirefox)
File : nvt/gb_suse_2012_0899_1.nasl
2012-12-13 Name : SuSE Update for MozillaThunderbird openSUSE-SU-2012:0917-1 (MozillaThunderbird)
File : nvt/gb_suse_2012_0917_1.nasl
2012-12-13 Name : SuSE Update for xulrunner openSUSE-SU-2012:0924-1 (xulrunner)
File : nvt/gb_suse_2012_0924_1.nasl
2012-12-13 Name : SuSE Update for seamonkey openSUSE-SU-2012:0935-1 (seamonkey)
File : nvt/gb_suse_2012_0935_1.nasl
2012-12-13 Name : SuSE Update for MozillaFirefox openSUSE-SU-2012:1064-1 (MozillaFirefox)
File : nvt/gb_suse_2012_1064_1.nasl
2012-12-13 Name : SuSE Update for MozillaFirefox openSUSE-SU-2012:1345-1 (MozillaFirefox)
File : nvt/gb_suse_2012_1345_1.nasl
2012-12-13 Name : SuSE Update for Mozilla Suite openSUSE-SU-2012:1412-1 (Mozilla Suite)
File : nvt/gb_suse_2012_1412_1.nasl
2012-12-06 Name : Fedora Update for seamonkey FEDORA-2012-18931
File : nvt/gb_fedora_2012_18931_seamonkey_fc16.nasl
2012-12-06 Name : Fedora Update for seamonkey FEDORA-2012-18952
File : nvt/gb_fedora_2012_18952_seamonkey_fc17.nasl
2012-12-04 Name : Ubuntu Update for firefox USN-1638-3
File : nvt/gb_ubuntu_USN_1638_3.nasl
2012-11-26 Name : FreeBSD Ports: firefox
File : nvt/freebsd_firefox72.nasl
2012-11-26 Name : Mozilla Firefox ESR Multiple Vulnerabilities-01 November12 (Windows)
File : nvt/gb_mozilla_firefox_esr_mult_vuln01_nov12_win.nasl
2012-11-26 Name : Mozilla Firefox Multiple Vulnerabilities-01 November12 (Mac OS X)
File : nvt/gb_mozilla_prdts_mult_vuln01_nov12_macosx.nasl
2012-11-26 Name : Mozilla Firefox Multiple Vulnerabilities-01 November12 (Windows)
File : nvt/gb_mozilla_prdts_mult_vuln01_nov12_win.nasl
2012-11-26 Name : Mozilla Firefox Multiple Vulnerabilities-02 November12 (Mac OS X)
File : nvt/gb_mozilla_prdts_mult_vuln02_nov12_macosx.nasl
2012-11-26 Name : Mozilla Firefox Multiple Vulnerabilities-02 November12 (Windows)
File : nvt/gb_mozilla_prdts_mult_vuln02_nov12_win.nasl

Information Assurance Vulnerability Management (IAVM)

id Description
2015-A-0158 Multiple Vulnerabilities in Oracle Java SE
Severity: Category I - VMSKEY: V0061089
2014-A-0113 Multiple Vulnerabilities in Mozilla Products
Severity: Category I - VMSKEY: V0053309
2014-A-0082 Multiple Vulnerabilities in Mozilla Products
Severity: Category I - VMSKEY: V0052487
2014-A-0064 Multiple Vulnerabilities in Mozilla Products
Severity: Category I - VMSKEY: V0050011
2014-A-0043 Multiple Vulnerabilities in Mozilla Products
Severity: Category I - VMSKEY: V0046769
2014-B-0024 Multiple Security Vulnerabilities in Apple iOS
Severity: Category I - VMSKEY: V0046157
2014-A-0030 Apple Mac OS X Security Update 2014-001
Severity: Category I - VMSKEY: V0044547
2014-A-0021 Multiple Vulnerabilities in Mozilla Products
Severity: Category I - VMSKEY: V0043921
2014-A-0009 Multiple Vulnerabilities in Oracle Fusion Middleware
Severity: Category I - VMSKEY: V0043395
2013-A-0233 Multiple Vulnerabilities in Mozilla Products
Severity: Category I - VMSKEY: V0042596
2013-A-0220 Multiple Vulnerabilities in Mozilla Products
Severity: Category I - VMSKEY: V0042380
2013-B-0124 Multiple Vulnerabilities in Google Chrome
Severity: Category I - VMSKEY: V0042301
2013-A-0203 Multiple Vulnerabilities in Mozilla Products
Severity: Category I - VMSKEY: V0041365
2012-A-0189 Multiple Vulnerabilities in VMware ESXi 4.1 and ESX 4.1
Severity: Category I - VMSKEY: V0035032
2011-A-0160 Multiple Vulnerabilities in VMware vCenter Server 4.0 and vCenter Update Mana...
Severity: Category I - VMSKEY: V0030769

Snort® IPS/IDS

This CPE Product have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
Date Description
2014-01-10 Mozilla regular expression heap corruption attempt
RuleID : 8443 - Type : BROWSER-FIREFOX - Revision : 15
2014-01-10 Mozilla regular expression heap corruption attempt
RuleID : 8442 - Type : SMTP - Revision : 2
2014-01-10 Mozilla GIF multipacket heap overflow - ANIMEXTS1.0
RuleID : 6503 - Type : WEB-CLIENT - Revision : 9
2014-01-10 Mozilla GIF single packet heap overflow - ANIMEXTS1.0
RuleID : 6502 - Type : FILE-IMAGE - Revision : 15
2020-07-23 Mozilla Firefox ReadableStreamCloseInternal out-of-bounds access attempt
RuleID : 54380 - Type : BROWSER-FIREFOX - Revision : 1
2020-07-23 Mozilla Firefox ReadableStreamCloseInternal out-of-bounds access attempt
RuleID : 54379 - Type : BROWSER-FIREFOX - Revision : 1
2020-05-07 Mozilla Firefox potential use after free attempt
RuleID : 53581 - Type : BROWSER-FIREFOX - Revision : 1
2020-05-07 Mozilla Firefox potential use after free attempt
RuleID : 53580 - Type : BROWSER-FIREFOX - Revision : 1
2020-02-11 Mozilla multiple products SharedWorker MessagePort memory corruption attempt
RuleID : 52569 - Type : BROWSER-FIREFOX - Revision : 1
2020-01-14 IonMonkey MArraySlice buffer overflow attempt
RuleID : 52431 - Type : BROWSER-FIREFOX - Revision : 1
2020-01-14 IonMonkey MArraySlice buffer overflow attempt
RuleID : 52430 - Type : BROWSER-FIREFOX - Revision : 1
2020-01-14 Mozilla Firefox RemotePrompt sandbox escape attempt
RuleID : 52425 - Type : BROWSER-FIREFOX - Revision : 1
2020-01-14 Mozilla Firefox RemotePrompt sandbox escape attempt
RuleID : 52424 - Type : BROWSER-FIREFOX - Revision : 1
2019-12-24 Mutiple products libpng extra row heap overflow attempt
RuleID : 52307 - Type : FILE-IMAGE - Revision : 1
2019-12-24 Mutiple products libpng extra row heap overflow attempt
RuleID : 52306 - Type : FILE-IMAGE - Revision : 1
2019-10-08 Mozilla Firefox Custom Elements write-after-free attempt
RuleID : 51440 - Type : BROWSER-FIREFOX - Revision : 1
2019-10-08 Mozilla Firefox Custom Elements write-after-free attempt
RuleID : 51439 - Type : BROWSER-FIREFOX - Revision : 1
2019-10-08 Mozilla Thunderbird input filter bypass cross site scripting attempt
RuleID : 51405 - Type : SERVER-MAIL - Revision : 1
2019-10-08 Mozilla Firefox GeckoActiveXObject exploit attempt
RuleID : 51394 - Type : BROWSER-OTHER - Revision : 2
2019-10-08 Mozilla Firefox GeckoActiveXObject exploit attempt
RuleID : 51393 - Type : BROWSER-OTHER - Revision : 2
2019-08-13 Mozilla Firefox RemotePrompt sandbox escape attempt
RuleID : 50697 - Type : BROWSER-FIREFOX - Revision : 2
2019-08-13 Mozilla Firefox RemotePrompt sandbox escape attempt
RuleID : 50696 - Type : BROWSER-FIREFOX - Revision : 2
2019-07-31 Mozilla Firefox Array.prototype.pop type confusion attempt
RuleID : 50519 - Type : BROWSER-FIREFOX - Revision : 2
2019-07-31 Mozilla Firefox Array.prototype.pop type confusion attempt
RuleID : 50518 - Type : BROWSER-FIREFOX - Revision : 2
2019-05-24 Mozilla Firefox DOMSVGLength appendItem use after free attempt
RuleID : 49918 - Type : BROWSER-FIREFOX - Revision : 1

Nessus® Vulnerability Scanner

This CPE Product have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Description
2019-01-03 Name: The remote Fedora host is missing a security update.
File: fedora_2018-77fe2e20ad.nasl - Type: ACT_GATHER_INFO
2019-01-03 Name: The remote Fedora host is missing a security update.
File: fedora_2018-def329f680.nasl - Type: ACT_GATHER_INFO
2018-12-28 Name: The remote EulerOS host is missing multiple security updates.
File: EulerOS_SA-2018-1414.nasl - Type: ACT_GATHER_INFO
2018-12-27 Name: The remote CentOS host is missing a security update.
File: centos_RHSA-2018-3831.nasl - Type: ACT_GATHER_INFO
2018-12-27 Name: The remote CentOS host is missing a security update.
File: centos_RHSA-2018-3833.nasl - Type: ACT_GATHER_INFO
2018-12-18 Name: A web browser installed on the remote macOS host is affected by multiple vuln...
File: macosx_firefox_62_0.nasl - Type: ACT_GATHER_INFO
2018-12-14 Name: The remote Debian host is missing a security update.
File: debian_DLA-1605.nasl - Type: ACT_GATHER_INFO
2018-12-13 Name: The remote Debian host is missing a security-related update.
File: debian_DSA-4354.nasl - Type: ACT_GATHER_INFO
2018-12-13 Name: The remote FreeBSD host is missing one or more security-related updates.
File: freebsd_pkg_d10b49b28d0249e8afde0844626317af.nasl - Type: ACT_GATHER_INFO
2018-12-12 Name: A web browser installed on the remote macOS host is affected by multiple vuln...
File: macosx_firefox_60_4_esr.nasl - Type: ACT_GATHER_INFO
2018-12-12 Name: A web browser installed on the remote macOS host is affected by multiple vuln...
File: macosx_firefox_64_0.nasl - Type: ACT_GATHER_INFO
2018-12-12 Name: A web browser installed on the remote Windows host is affected by multiple vu...
File: mozilla_firefox_60_4_esr.nasl - Type: ACT_GATHER_INFO
2018-12-12 Name: A web browser installed on the remote Windows host is affected by multiple vu...
File: mozilla_firefox_64_0.nasl - Type: ACT_GATHER_INFO
2018-12-11 Name: The remote EulerOS host is missing multiple security updates.
File: EulerOS_SA-2018-1384.nasl - Type: ACT_GATHER_INFO
2018-11-27 Name: The remote Virtuozzo host is missing a security update.
File: Virtuozzo_VZLSA-2017-2831.nasl - Type: ACT_GATHER_INFO
2018-11-27 Name: The remote Virtuozzo host is missing a security update.
File: Virtuozzo_VZLSA-2017-2832.nasl - Type: ACT_GATHER_INFO
2018-11-27 Name: The remote Virtuozzo host is missing a security update.
File: Virtuozzo_VZLSA-2017-2885.nasl - Type: ACT_GATHER_INFO
2018-11-26 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201811-13.nasl - Type: ACT_GATHER_INFO
2018-11-21 Name: The remote CentOS host is missing a security update.
File: centos_RHSA-2018-3531.nasl - Type: ACT_GATHER_INFO
2018-11-21 Name: The remote CentOS host is missing a security update.
File: centos_RHSA-2018-3532.nasl - Type: ACT_GATHER_INFO
2018-11-13 Name: The remote Debian host is missing a security update.
File: debian_DLA-1575.nasl - Type: ACT_GATHER_INFO
2018-11-13 Name: The remote Debian host is missing a security-related update.
File: debian_DSA-4337.nasl - Type: ACT_GATHER_INFO
2018-11-09 Name: The remote CentOS host is missing a security update.
File: centos_RHSA-2018-3403.nasl - Type: ACT_GATHER_INFO
2018-11-09 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201811-04.nasl - Type: ACT_GATHER_INFO
2018-11-08 Name: The remote Debian host is missing a security update.
File: debian_DLA-1571.nasl - Type: ACT_GATHER_INFO