Debian Thunderbird vulnerabilities

CVE-2025-5269 [HIGH] CVE-2025-5269: firefox-esr - Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bu... Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 128.11 and Thunderbird < 128.11. Scope: local bookworm: resolved (fixed in 128.11.0esr-1~deb12u1) bullseye: resol

CVE-2018-12359 [HIGH] CVE-2018-12359: firefox - A buffer overflow can occur when rendering canvas content while adjusting the he... A buffer overflow can occur when rendering canvas content while adjusting the height and width of the canvas element dynamically, causing data to be written outside of the currently computed boundaries. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox

CVE-2019-9796 [CRITICAL] CVE-2019-9796: firefox - A use-after-free vulnerability can occur when the SMIL animation controller inco... A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a single registration is expected. When a registration is later freed with the removal of the animation controller element, the refresh driver incorrectly leaves a dangling pointer to the driver's observer array. This vulnerabil

CVE-2019-9790 [CRITICAL] CVE-2019-9790: firefox - A use-after-free vulnerability can occur when a raw pointer to a DOM element on ... A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66. Scope: local sid: resolved (fixed in 66.0-1)

CVE-2019-9795 [CRITICAL] CVE-2019-9795: firefox - A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compile... A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to trigger a potentially exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66. Scope: local sid: resolved (fixed in 66.0-1)

CVE-2024-43097 [HIGH] CVE-2024-43097: firefox-esr - In resizeToAtLeast of SkRegion.cpp, there is a possible out of bounds write due ... In resizeToAtLeast of SkRegion.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Scope: local bookworm: resolved (fixed in 128.8.0esr-1~deb12u1) bullseye: resolved (fixed in 128.8.0esr-1~deb11u1)

CVE-2021-4127 [CRITICAL] CVE-2021-4127: firefox-esr - An out of date graphics library (Angle) likely contained vulnerabilities that co... An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vulnerability affects Thunderbird < 78.9 and Firefox ESR < 78.9. Scope: local bookworm: resolved (fixed in 78.9.0esr-1) bullseye: resolved (fixed in 78.9.0esr-1) forky: resolved (fixed in 78.9.0esr-1) sid: resolved (fixed in 78.9.0esr-1) trixie: r

CVE-2022-31747 [CRITICAL] CVE-2022-31747: firefox - Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing... Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100 and Firefox ESR 91.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.10,

CVE-2023-4057 [CRITICAL] CVE-2023-4057: firefox - Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 11... Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and Thunderbird < 115.1. Scope: local sid: resolved (fixed i

CVE-2018-5178 [HIGH] CVE-2018-5178: firefox-esr - A buffer overflow was found during UTF8 to Unicode string conversion within Java... A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable legacy extension in order to occur. This vulnerability affects Thunderbird ESR < 52.8, Thunderbird < 52.8, and Firefox ESR < 52.8. Scope: local bookworm: resolved (fixed in 52.

CVE-2018-12363 [HIGH] CVE-2018-12363: firefox - A use-after-free vulnerability can occur when script uses mutation events to mov... A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node being freed but the node still having a pointer referencing it. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ES

CVE-2024-7519 [CRITICAL] CVE-2024-7519: firefox - Insufficient checks when processing graphics shared memory could have led to mem... Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14. Scope: local sid: resolved (fixed in 129.0-1)

CVE-2020-15659 [HIGH] CVE-2020-15659: firefox - Mozilla developers and community members reported memory safety bugs present in ... Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 6

CVE-2006-1726 [CRITICAL] CVE-2006-1726: firefox - Unspecified vulnerability in Firefox and Thunderbird 1.5 before 1.5.0.2, and Sea... Unspecified vulnerability in Firefox and Thunderbird 1.5 before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to bypass the js_ValueToFunctionObject check and execute arbitrary code via unknown vectors involving setTimeout and Firefox' ForEach method. Scope: local sid: resolved (fixed in 1.5.dfsg+1.5.0.2-1)

CVE-2020-15673 [HIGH] CVE-2020-15673: firefox - Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox... Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. Scope: local sid: resolved (fixed

CVE-2019-17008 [HIGH] CVE-2019-17008: firefox - When using nested workers, a use-after-free could occur during worker destructio... When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Scope: local sid: resolved (fixed in 71.0-1)

CVE-2021-38496 [HIGH] CVE-2021-38496: firefox - During operations on MessageTasks, a task may have been removed while it was sti... During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.15, Thunderbird < 91.2, Firefox ESR < 91.2, Firefox ESR < 78.15, and Firefox < 93. Scope: local sid: resolved (fixed in 93.0-1)

CVE-2019-11740 [HIGH] CVE-2019-11740: firefox - Mozilla developers and community members reported memory safety bugs present in ... Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firef

CVE-2020-15656 [HIGH] CVE-2020-15656: firefox - JIT optimizations involving the Javascript arguments object could confuse later ... JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the code, resulting in this bug rated at only moderate severity. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1. Scope: local sid: resolved (fixed in 79.0-1)

CVE-2020-6805 [HIGH] CVE-2020-6805: firefox - When removing data about an origin whose tab was recently closed, a use-after-fr... When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. Scope: local sid: resolved (fixed in 74.0-1)