Approved changes feed: RSS · Atom

cpe:2.3:a:mozilla:firefox:2.0:beta_1:*:*:*:*:*:*

part: a version: 2.0 update: beta_1

VendorMozilla (be1b0d4e-21a7-5a25-9982-bbda6ef43ec1)
ProductFirefox (d152d976-2d5e-5cc4-89b6-e80c6d067896)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:deb/debian/firefox purl2cpe 2026-06-01 10:17:52.824581
pkg:mozilla/mozilla-central purl2cpe 2026-06-01 10:17:52.824583
pkg:rpm/fedora/firefox purl2cpe 2026-06-01 10:17:52.824584
pkg:rpm/opensuse/mozillafirefox purl2cpe 2026-06-01 10:17:52.824586

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2010-1210 vulnerable 2026-06-03 14:30:13.382687 Details available
intl/uconv/util/nsUnicodeDecodeHelper.cpp in Mozilla Firefox before 3.6.7 and Thunderbird before 3.1.1 inserts a U+FFFD sequence into text in certain circumstances involving undefined positions, which might make it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted 8-bit text.
Published: 2010-07-30T20:00:00.000Z
Updated: 2024-08-07T01:14:06.669Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-3987 vulnerable 2026-06-03 14:29:54.847696 Details available
The GeckoActiveXObject function in Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, generates different exception messages depending on whether the referenced COM object is listed in the registry, which allows remote attackers to obtain potentially sensitive information about installed software by making multiple calls that specify the ProgID values of different COM objects.
Published: 2009-12-17T17:00:00.000Z
Updated: 2024-08-07T06:45:50.904Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-3986 vulnerable 2026-06-03 14:29:54.843905 Details available
Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to execute arbitrary JavaScript with chrome privileges by leveraging a reference to a chrome window from a content window, related to the window.opener property.
Published: 2009-12-17T17:00:00.000Z
Updated: 2024-08-07T06:45:50.896Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-3985 vulnerable 2026-06-03 14:29:54.839556 Details available
Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to associate spoofed content with an invalid URL by setting document.location to this URL, and then writing arbitrary web script or HTML to the associated blank document, a related issue to CVE-2009-2654.
Published: 2009-12-17T17:00:00.000Z
Updated: 2024-08-07T06:45:50.919Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-3984 vulnerable 2026-06-03 14:29:54.835483 Details available
Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to spoof an SSL indicator for an http URL or a file URL by setting document.location to an https URL corresponding to a site that responds with a No Content (aka 204) status code and an empty body.
Published: 2009-12-17T17:00:00.000Z
Updated: 2024-08-07T06:45:50.789Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-3983 vulnerable 2026-06-03 14:29:54.831215 Details available
Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to send authenticated requests to arbitrary applications by replaying the NTLM credentials of a browser user.
Published: 2009-12-17T17:00:00.000Z
Updated: 2024-08-07T06:45:50.871Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-3981 vulnerable 2026-06-03 14:29:54.825257 Details available
Unspecified vulnerability in the browser engine in Mozilla Firefox before 3.0.16, SeaMonkey before 2.0.1, and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Published: 2009-12-17T17:00:00.000Z
Updated: 2024-08-07T06:45:50.930Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-3979 vulnerable 2026-06-03 14:29:54.793912 Details available
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Published: 2009-12-17T17:00:00.000Z
Updated: 2024-08-07T06:45:50.879Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-3079 vulnerable 2026-06-03 14:29:44.821414 Details available
Unspecified vulnerability in Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.3, allows remote attackers to execute arbitrary JavaScript with chrome privileges via vectors involving an object, the FeedWriter, and the BrowserFeedWriter.
Published: 2009-09-10T21:00:00.000Z
Updated: 2024-08-07T06:14:56.194Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-3078 vulnerable 2026-06-03 14:29:44.818858 Details available
Visual truncation vulnerability in Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.3, allows remote attackers to trigger a vertical scroll and spoof URLs via unspecified Unicode characters with a tall line-height property.
Published: 2009-09-10T21:00:00.000Z
Updated: 2024-08-07T06:14:55.435Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-3077 vulnerable 2026-06-03 14:29:44.816284 Details available
Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.3, does not properly manage pointers for the columns (aka TreeColumns) of a XUL tree element, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to a "dangling pointer vulnerability."
Published: 2009-09-10T21:00:00.000Z
Updated: 2024-08-07T06:14:55.501Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-3076 vulnerable 2026-06-03 14:29:44.813526 Details available
Mozilla Firefox before 3.0.14 does not properly implement certain dialogs associated with the (1) pkcs11.addmodule and (2) pkcs11.deletemodule operations, which makes it easier for remote attackers to trick a user into installing or removing an arbitrary PKCS11 module.
Published: 2009-09-10T21:00:00.000Z
Updated: 2024-08-07T06:14:56.084Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-3075 vulnerable 2026-06-03 14:29:44.810865 Details available
Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox before 3.0.14 and 3.5.x before 3.5.2, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to use of mutable strings in the js_StringReplaceHelper function in js/src/jsstr.cpp, and unknown vectors.
Published: 2009-09-10T21:00:00.000Z
Updated: 2024-08-07T06:14:55.420Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-3074 vulnerable 2026-06-03 14:29:44.808238 Details available
Unspecified vulnerability in the JavaScript engine in Mozilla Firefox before 3.0.14 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Published: 2009-09-10T21:00:00.000Z
Updated: 2024-08-07T06:14:56.174Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-3072 vulnerable 2026-06-03 14:29:44.805116 Details available
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.14 and 3.5.x before 3.5.3, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the BinHex decoder in netwerk/streamconv/converters/nsBinHexDecoder.cpp, and unknown vectors.
Published: 2009-09-10T21:00:00.000Z
Updated: 2024-08-07T06:14:55.562Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-3071 vulnerable 2026-06-03 14:29:44.802474 Details available
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.2, allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Published: 2009-09-10T21:00:00.000Z
Updated: 2024-08-07T06:14:55.731Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-3070 vulnerable 2026-06-03 14:29:44.799801 Details available
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Published: 2009-09-10T21:00:00.000Z
Updated: 2024-08-07T06:14:55.759Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-2664 vulnerable 2026-06-03 14:29:42.386110 Details available
The js_watch_set function in js/src/jsdbgapi.cpp in the JavaScript engine in Mozilla Firefox before 3.0.12 allows remote attackers to cause a denial of service (assertion failure and application exit) or possibly execute arbitrary code via a crafted .js file, related to a "memory safety bug." NOTE: this was originally reported as affecting versions before 3.0.13.
Published: 2009-08-04T16:13:00.000Z
Updated: 2024-08-07T05:59:56.939Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-2663 vulnerable 2026-06-03 14:29:42.382942 Details available
libvorbis before r16182, as used in Mozilla Firefox 3.5.x before 3.5.2 and other products, allows context-dependent attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted .ogg file.
Published: 2009-08-04T16:13:00.000Z
Updated: 2024-08-07T05:59:56.959Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-2654 vulnerable 2026-06-03 14:29:42.314409 Details available
Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to spoof the address bar, and possibly conduct phishing attacks, via a crafted web page that calls window.open with an invalid character in the URL, makes document.write calls to the resulting object, and then calls the stop method during the loading of the error page.
Published: 2009-08-03T14:00:00.000Z
Updated: 2024-08-07T05:59:56.565Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-2471 vulnerable 2026-06-03 14:29:41.398896 Details available
The setTimeout function in Mozilla Firefox before 3.0.12 does not properly preserve object wrapping, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted call, related to XPCNativeWrapper.
Published: 2009-07-22T18:00:00.000Z
Updated: 2024-08-07T05:52:14.812Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-2470 vulnerable 2026-06-03 14:29:41.396455 Details available
Mozilla Firefox before 3.0.12, and 3.5.x before 3.5.2, allows remote SOCKS5 proxy servers to cause a denial of service (data stream corruption) via a long domain name in a reply.
Published: 2009-08-04T16:13:00.000Z
Updated: 2024-08-07T05:52:14.864Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-2469 vulnerable 2026-06-03 14:29:41.394094 Details available
Mozilla Firefox before 3.0.12 does not properly handle an SVG element that has a property with a watch function and an __defineSetter__ function, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted document, related to a certain pointer misinterpretation.
Published: 2009-07-22T18:00:00.000Z
Updated: 2024-08-07T05:52:14.950Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-2468 vulnerable 2026-06-03 14:29:41.391677 Details available
Integer overflow in Apple CoreGraphics, as used in Safari before 4.0.3, Mozilla Firefox before 3.0.12, and Mac OS X 10.4.11 and 10.5.8, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long text run that triggers a heap-based buffer overflow during font glyph rendering, a related issue to CVE-2009-1194.
Published: 2009-07-22T18:00:00.000Z
Updated: 2024-08-07T05:52:14.616Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-2467 vulnerable 2026-06-03 14:29:41.389288 Details available
Mozilla Firefox before 3.0.12 and 3.5 before 3.5.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving a Flash object, a slow script dialog, and the unloading of the Flash plugin, which triggers attempted use of a deleted object.
Published: 2009-07-22T18:00:00.000Z
Updated: 2024-08-07T05:52:14.620Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-2466 vulnerable 2026-06-03 14:29:41.386516 Details available
The JavaScript engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) nsDOMClassInfo.cpp, (2) JS_HashTableRawLookup, and (3) MirrorWrappedNativeParent and js_LockGCThingRT.
Published: 2009-07-22T18:00:00.000Z
Updated: 2024-08-07T05:52:14.831Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-2465 vulnerable 2026-06-03 14:29:41.383600 Details available
Mozilla Firefox before 3.0.12 and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via vectors involving double frame construction, related to (1) nsHTMLContentSink.cpp, (2) nsXMLContentSink.cpp, and (3) nsPresShell.cpp, and the nsSubDocumentFrame::Reflow function.
Published: 2009-07-22T18:00:00.000Z
Updated: 2024-08-07T05:52:15.099Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-2464 vulnerable 2026-06-03 14:29:41.361704 Details available
The nsXULTemplateQueryProcessorRDF::CheckIsSeparator function in Mozilla Firefox before 3.0.12, SeaMonkey 2.0a1pre, and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to loading multiple RDF files in a XUL tree element.
Published: 2009-07-22T18:00:00.000Z
Updated: 2024-08-07T05:52:14.679Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-2463 vulnerable 2026-06-03 14:29:41.358077 Details available
Multiple integer overflows in the (1) PL_Base64Decode and (2) PL_Base64Encode functions in nsprpub/lib/libc/src/base64.c in Mozilla Firefox before 3.0.12, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors that trigger buffer overflows.
Published: 2009-07-22T18:00:00.000Z
Updated: 2024-08-07T05:52:14.700Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-2462 vulnerable 2026-06-03 14:29:41.342461 Details available
The browser engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) the frame chain and synchronous events, (2) a SetMayHaveFrame assertion and nsCSSFrameConstructor::CreateFloatingLetterFrame, (3) nsCSSFrameConstructor::ConstructFrame, (4) the child list and initial reflow, (5) GetLastSpecialSibling, (6) nsFrameManager::GetPrimaryFrameFor and MathML, (7) nsFrame::GetBoxAscent, (8) nsCSSFrameConstructor::AdjustParentFrame, (9) nsDOMOfflineResourceList, and (10) nsContentUtils::ComparePosition.
Published: 2009-07-22T18:00:00.000Z
Updated: 2024-08-07T05:52:15.181Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-2065 vulnerable 2026-06-03 14:29:39.113898 Details available
Mozilla Firefox 3.0.10, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."
Published: 2009-06-15T19:00:00.000Z
Updated: 2024-08-07T05:36:20.623Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-2061 vulnerable 2026-06-03 14:29:39.021995 Details available
Mozilla Firefox before 3.0.10 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.
Published: 2009-06-15T19:00:00.000Z
Updated: 2024-08-07T05:36:20.985Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-1841 vulnerable 2026-06-03 14:29:37.785925 Details available
js/src/xpconnect/src/xpcwrappedjsclass.cpp in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to execute arbitrary web script with the privileges of a chrome object, as demonstrated by the browser sidebar and the FeedWriter.
Published: 2009-06-12T21:07:00.000Z
Updated: 2024-08-07T05:27:54.576Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-1838 vulnerable 2026-06-03 14:29:37.760133 Details available
The garbage-collection implementation in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 sets an element's owner document to null in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted event handler, related to an incorrect context for this event handler.
Published: 2009-06-12T21:07:00.000Z
Updated: 2024-08-07T05:27:54.417Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-1836 vulnerable 2026-06-03 14:29:37.680329 Details available
Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 use the HTTP Host header to determine the context of a document provided in a non-200 CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.
Published: 2009-06-12T21:07:00.000Z
Updated: 2024-08-07T05:27:54.628Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-1835 vulnerable 2026-06-03 14:29:37.676568 Details available
Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 associate local documents with external domain names located after the file:// substring in a URL, which allows user-assisted remote attackers to read arbitrary cookies via a crafted HTML document, as demonstrated by a URL with file://example.com/C:/ at the beginning.
Published: 2009-06-12T21:07:00.000Z
Updated: 2024-08-07T05:27:54.351Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-1834 vulnerable 2026-06-03 14:29:37.672469 Details available
Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 allows remote attackers to spoof the location bar via an IDN with invalid Unicode characters that are displayed as whitespace, as demonstrated by the \u115A through \u115E characters.
Published: 2009-06-12T21:07:00.000Z
Updated: 2024-08-07T05:27:54.586Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-1833 vulnerable 2026-06-03 14:29:37.667839 Details available
The JavaScript engine in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) js_LeaveSharpObject, (2) ParseXMLSource, and (3) a certain assertion in jsinterp.c; and other vectors.
Published: 2009-06-12T21:07:00.000Z
Updated: 2024-08-07T05:27:54.660Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-1832 vulnerable 2026-06-03 14:29:37.644511 Details available
Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors involving "double frame construction."
Published: 2009-06-12T21:07:00.000Z
Updated: 2024-08-07T05:27:54.842Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-1312 vulnerable 2026-06-03 14:29:29.258264 Details available
Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header. NOTE: it was later reported that Firefox 3.6 a1 pre and Mozilla 1.7.x and earlier are also affected.
Published: 2009-04-22T18:00:00.000Z
Updated: 2024-08-07T05:04:49.647Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-1311 vulnerable 2026-06-03 14:29:29.193051 Details available
Mozilla Firefox before 3.0.9 and SeaMonkey before 1.1.17 allow user-assisted remote attackers to obtain sensitive information via a web page with an embedded frame, which causes POST data from an outer page to be sent to the inner frame's URL during a SAVEMODE_FILEONLY save of the inner frame.
Published: 2009-04-22T18:00:00.000Z
Updated: 2024-08-07T05:04:49.615Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-1310 vulnerable 2026-06-03 14:29:29.190155 Details available
Cross-site scripting (XSS) vulnerability in the MozSearch plugin implementation in Mozilla Firefox before 3.0.9 allows user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SearchForm element.
Published: 2009-04-22T18:00:00.000Z
Updated: 2024-08-07T05:04:49.580Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-1309 vulnerable 2026-06-03 14:29:29.187616 Details available
Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey do not properly implement the Same Origin Policy for (1) XMLHttpRequest, involving a mismatch for a document's principal, and (2) XPCNativeWrapper.toString, involving an incorrect __proto__ scope, which allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly other attacks via a crafted document.
Published: 2009-04-22T18:00:00.000Z
Updated: 2024-08-07T05:04:49.528Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-1308 vulnerable 2026-06-03 14:29:29.184987 Details available
Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey allows remote attackers to inject arbitrary web script or HTML via vectors involving XBL JavaScript bindings and remote stylesheets, as exploited in the wild by a March 2009 eBay listing.
Published: 2009-04-22T18:00:00.000Z
Updated: 2024-08-07T05:04:49.602Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-1307 vulnerable 2026-06-03 14:29:29.182479 Details available
The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to (1) bypass crossdomain.xml restrictions and connect to arbitrary web sites via a Flash file; (2) read, create, or modify Local Shared Objects via a Flash file; or (3) bypass unspecified restrictions and render content via vectors involving a jar: URI.
Published: 2009-04-22T18:00:00.000Z
Updated: 2024-08-07T05:04:49.691Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-1306 vulnerable 2026-06-03 14:29:29.179640 Details available
The jar: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not follow the Content-Disposition header of the inner URI, which allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly other attacks via an uploaded .jar file with a "Content-Disposition: attachment" designation.
Published: 2009-04-22T18:00:00.000Z
Updated: 2024-08-07T05:04:49.503Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-1303 vulnerable 2026-06-03 14:29:29.148670 Details available
The browser engine in Mozilla Firefox before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application crash) and possibly trigger memory corruption via vectors related to nsSVGElement::BindToTree.
Published: 2009-04-22T18:00:00.000Z
Updated: 2024-08-07T05:04:49.481Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-1169 vulnerable 2026-06-03 14:29:28.137946 Details available
The txMozillaXSLTProcessor::TransformToDoc function in Mozilla Firefox before 3.0.8 and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XML file with a crafted XSLT transform.
Published: 2009-03-27T00:00:00.000Z
Updated: 2024-08-07T05:04:49.375Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-0821 vulnerable 2026-06-03 14:29:26.269110 Details available
Mozilla Firefox 2.0.0.20 and earlier allows remote attackers to cause a denial of service (application crash) via nested calls to the window.print function, as demonstrated by a window.print(window.print()) in the onclick attribute of an INPUT element.
Published: 2009-03-05T02:00:00.000Z
Updated: 2024-09-16T16:17:46.669Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-0356 vulnerable 2026-06-03 14:29:23.765436 Details available
Mozilla Firefox before 3.0.6 and SeaMonkey do not block links to the (1) about:plugins and (2) about:config URIs from .desktop files, which allows user-assisted remote attackers to bypass the Same Origin Policy and execute arbitrary code with chrome privileges via vectors involving the URL field in a Desktop Entry section of a .desktop file, related to representation of about: URIs as jar:file:// URIs. NOTE: this issue exists because of an incomplete fix for CVE-2008-4582.
Published: 2009-02-04T19:00:00.000Z
Updated: 2024-08-07T04:31:25.627Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2009-0355 vulnerable 2026-06-03 14:29:23.755725 Details available
components/sessionstore/src/nsSessionStore.js in Mozilla Firefox before 3.0.6 does not block changes of INPUT elements to type="file" during tab restoration, which allows user-assisted remote attackers to read arbitrary files on a client machine via a crafted INPUT element.
Published: 2009-02-04T19:00:00.000Z
Updated: 2024-08-07T04:31:25.663Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2008-5012 vulnerable 2026-06-03 14:29:06.921108 Details available
Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary images that are not directly accessible to the attacker. NOTE: this issue can be leveraged to enumerate software on the client by performing redirections related to moz-icon.
Published: 2008-11-13T11:00:00.000Z
Updated: 2024-08-07T10:40:16.886Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2008-2808 vulnerable 2026-06-03 14:28:51.109413 Details available
Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly escape HTML in file:// URLs in directory listings, which allows remote attackers to conduct cross-site scripting (XSS) attacks or have unspecified other impact via a crafted filename.
Published: 2008-07-07T23:00:00.000Z
Updated: 2024-08-07T09:14:14.873Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2008-2806 vulnerable 2026-06-03 14:28:51.068004 Details available
Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 on Mac OS X allow remote attackers to bypass the Same Origin Policy and create arbitrary socket connections via a crafted Java applet, related to the Java Embedding Plugin (JEP) and Java LiveConnect.
Published: 2008-07-07T23:00:00.000Z
Updated: 2024-08-07T09:14:14.936Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2007-0996 vulnerable 2026-06-03 14:27:58.598190 Details available
The child frames in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 inherit the default charset from the parent window, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set.
Published: 2007-02-27T02:00:00.000Z
Updated: 2024-08-07T12:43:21.663Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2007-0981 vulnerable 2026-06-03 14:27:58.584100 Details available
Mozilla based browsers, including Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8, allow remote attackers to bypass the same origin policy, steal cookies, and conduct other attacks by writing a URI with a null byte to the hostname (location.hostname) DOM property, due to interactions with DNS resolver code.
Published: 2007-02-16T01:00:00.000Z
Updated: 2024-08-07T12:43:21.623Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2007-0779 vulnerable 2026-06-03 14:27:57.992726 Details available
GUI overlay vulnerability in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 allows remote attackers to spoof certain user interface elements, such as the host name or security indicators, via the CSS3 hotspot property with a large, transparent, custom cursor.
Published: 2007-02-26T20:00:00.000Z
Updated: 2024-08-07T12:34:20.842Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2007-0775 vulnerable 2026-06-03 14:27:57.978357 Details available
Multiple unspecified vulnerabilities in the layout engine in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, and SeaMonkey before 1.0.8 allow remote attackers to cause a denial of service (crash) and potentially execute arbitrary code via certain vectors.
Published: 2007-02-26T19:00:00.000Z
Updated: 2024-08-07T12:34:20.497Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2006-6502 vulnerable 2026-06-03 14:27:53.401984 Details available
Use-after-free vulnerability in the LiveConnect bridge code for Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to cause a denial of service (crash) via unknown vectors.
Published: 2006-12-20T01:00:00.000Z
Updated: 2024-08-07T20:26:46.734Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2006-5160 vulnerable 2026-06-03 14:27:45.054539 Details available
Multiple unspecified vulnerabilities in Mozilla Firefox have unspecified vectors and impact, as claimed during ToorCon 2006. NOTE: the vendor and original researchers have released a follow-up comment disputing this issue, in which one researcher states that "I have no undisclosed Firefox vulnerabilities. The person who was speaking with me made this claim, and I honestly have no idea if he has them or not.
Published: 2006-10-03T23:00:00.000Z
Updated: 2025-01-17T14:03:52.423Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2006-5159 vulnerable 2026-06-03 14:27:45.052832 Details available
Stack-based buffer overflow in Mozilla Firefox allows remote attackers to execute arbitrary code via unspecified vectors involving JavaScript. NOTE: the vendor and original researchers have released a follow-up comment disputing the severity of this issue, in which the researcher states that "we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However, the code we presented did not in fact do this... I have not succeeded in making this code do anything more than cause a crash and eat up system resources"
Published: 2006-10-03T23:00:00.000Z
Updated: 2024-08-07T19:41:04.230Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.