Mozilla Thunderbird vulnerabilities

CVE-2026-12327 [HIGH] Mozilla Foundation Security Advisory 2026-60: CVE-2026-12327 Mozilla Foundation Security Advisory 2026-60 CVE: CVE-2026-12327 Product: Thunderbird Impact: high Fixed in: Thunderbird 152

CVE-2019-11730 [MEDIUM] CVE-2019-11730: A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and they may uploaded to a server. It was demonstrated that in comb

CVE-2019-17017 [HIGH] CVE-2019-17017: Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

CVE-2013-0755 [CRITICAL] CWE-416 CVE-2013-0755: Use-after-free vulnerability in the mozVibrate implementation in the Vibrate library in Mozilla Fire Use-after-free vulnerability in the mozVibrate implementation in the Vibrate library in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via vectors related to the domDoc pointer.

CVE-2021-43537 [HIGH] CWE-704 CVE-2021-43537: An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt me An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

CVE-2020-15678 [HIGH] CWE-416 CVE-2020-15678: When recursing through graphical layers while scrolling, an iterator may have become invalid, result When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the function APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.

CVE-2020-26971 [HIGH] CWE-787 CVE-2020-26971: Certain blit values provided by the user were not properly constrained leading to a heap buffer over Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.

CVE-2012-0457 [CRITICAL] CWE-399 CVE-2012-0457: Use-after-free vulnerability in the nsSMILTimeValueSpec::ConvertBetweenTimeContainer function in Moz Use-after-free vulnerability in the nsSMILTimeValueSpec::ConvertBetweenTimeContainer function in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 might allow remote attackers to execute arbitrary code via an

CVE-2014-1551 [CRITICAL] CVE-2014-1551: Use-after-free vulnerability in the FontTableRec destructor in Mozilla Firefox before 31.0, Firefox Use-after-free vulnerability in the FontTableRec destructor in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 on Windows allows remote attackers to execute arbitrary code via crafted use of fonts in MathML content, leading to improper handling of a DirectWrite font-face object.

CVE-2023-6858 [HIGH] CWE-787 CVE-2023-6858: Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handli Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.

CVE-2005-4809 [MEDIUM] CVE-2005-4809: Mozilla Firefox 1.0.1 and possibly other versions, including Mozilla and Thunderbird, allows remote Mozilla Firefox 1.0.1 and possibly other versions, including Mozilla and Thunderbird, allows remote attackers to spoof the URL in the Status Bar via an A HREF tag that contains a TABLE tag that contains another A tag.

CVE-2024-11705 [CRITICAL] CWE-476 CVE-2024-11705: `NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was pas `NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV) occurred, leading to crashes. This behavior conflicted with the PKCS#11 v3.0 specification, which allows `phKey` to be NULL for certain mechanisms. This vulnerability affects Firefox < 133 and Thunderbird < 1

CVE-2022-40962 [HIGH] CWE-787 CVE-2022-40962: Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 104 and Firefox ESR 102.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vuln

CVE-2020-16044 [HIGH] CVE-2020-16044: Use after free in WebRTC in Google Chrome prior to 88 Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet.

CVE-2021-23995 [HIGH] CWE-672 CVE-2021-23995: When Responsive Design Mode was enabled, it used references to objects that were previously freed. W When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

CVE-2023-6864 [HIGH] CWE-787 CVE-2023-6864: Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these b Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.

CVE-2017-5459 [CRITICAL] CWE-119 CVE-2017-5459: A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash. A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVE-2013-1674 [CRITICAL] CWE-399 CVE-2013-1674: Use-after-free vulnerability in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunder Use-after-free vulnerability in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code via vectors involving an onresize event during the playing of a video.

CVE-2021-38510 [HIGH] CVE-2021-38510: The executable file warning was not presented when downloading .inetloc files, which, due to a flaw The executable file warning was not presented when downloading .inetloc files, which, due to a flaw in Mac OS, can run commands on a user's computer.*Note: This issue only affected Mac OS operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.

CVE-2022-22740 [HIGH] CWE-416 CVE-2022-22740: Certain network request objects were freed too early when releasing a network request handle. This c Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.