thunderbird Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/thunderbird/ Sun, 26 Feb 2023 09:11:03 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png thunderbird Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/thunderbird/ 32 32 CVE-2008-5513 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-5513/ Sun, 26 Feb 2023 09:11:03 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-5513/ Unspecified vulnerability in the session-restore feature in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19 allows remote attackers to bypass the same origin policy, inject content into documents associated with other domains, and conduct cross-site scripting (XSS) attacks via unknown vectors related to restoration of SessionStore data.

The post CVE-2008-5513 appeared first on CVE Vulnerability.

]]> Unspecified vulnerability in the session-restore feature in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19 allows remote attackers to bypass the same origin policy, inject content into documents associated with other domains, and conduct cross-site scripting (XSS) attacks via unknown vectors related to restoration of SessionStore data.

The post CVE-2008-5513 appeared first on CVE Vulnerability.

]]> CVE-2008-5511 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-5511/ Sun, 26 Feb 2023 09:11:03 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-5511/ Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to bypass the same origin policy and conduct cross-site scripting (XSS) attacks via an XBL binding to an “unloaded document.”

The post CVE-2008-5511 appeared first on CVE Vulnerability.

]]> Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to bypass the same origin policy and conduct cross-site scripting (XSS) attacks via an XBL binding to an “unloaded document.”

The post CVE-2008-5511 appeared first on CVE Vulnerability.

]]> CVE-2008-5016 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-5016/ Sun, 26 Feb 2023 09:10:49 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-5016/ The layout engine in Mozilla Firefox 3.x before 3.0.4, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via multiple vectors that trigger an assertion failure or other consequences.

The post CVE-2008-5016 appeared first on CVE Vulnerability.

]]> The layout engine in Mozilla Firefox 3.x before 3.0.4, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via multiple vectors that trigger an assertion failure or other consequences.

The post CVE-2008-5016 appeared first on CVE Vulnerability.

]]> CVE-2008-5012 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-5012/ Sun, 26 Feb 2023 09:10:49 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-5012/ Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary images that are not directly accessible to the attacker. NOTE: this issue […]

The post CVE-2008-5012 appeared first on CVE Vulnerability.

]]> Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary images that are not directly accessible to the attacker. NOTE: this issue can be leveraged to enumerate software on the client by performing redirections related to moz-icon.

The post CVE-2008-5012 appeared first on CVE Vulnerability.

]]> CVE-2008-1380 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-1380/ Sun, 26 Feb 2023 09:09:00 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-1380/ The JavaScript engine in Mozilla Firefox before 2.0.0.14, Thunderbird before 2.0.0.14, and SeaMonkey before 1.1.10 allows remote attackers to cause a denial of service (garbage collector crash) and possibly have other impacts via a crafted web page. NOTE: this is due to an incorrect fix for CVE-2008-1237.

The post CVE-2008-1380 appeared first on CVE Vulnerability.

]]> The JavaScript engine in Mozilla Firefox before 2.0.0.14, Thunderbird before 2.0.0.14, and SeaMonkey before 1.1.10 allows remote attackers to cause a denial of service (garbage collector crash) and possibly have other impacts via a crafted web page. NOTE: this is due to an incorrect fix for CVE-2008-1237.

The post CVE-2008-1380 appeared first on CVE Vulnerability.

]]> CVE-2008-0416 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-0416/ Sun, 26 Feb 2023 09:08:32 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-0416/ Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allow remote attackers to inject arbitrary web script or HTML via certain character encodings, including (1) a backspace character that is treated as whitespace, (2) 0x80 with Shift_JIS encoding, and (3) “zero-length non-ASCII sequences” in certain Asian character […]

The post CVE-2008-0416 appeared first on CVE Vulnerability.

]]> Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allow remote attackers to inject arbitrary web script or HTML via certain character encodings, including (1) a backspace character that is treated as whitespace, (2) 0x80 with Shift_JIS encoding, and (3) “zero-length non-ASCII sequences” in certain Asian character sets.

The post CVE-2008-0416 appeared first on CVE Vulnerability.

]]> CVE-2007-5340 https://cvevulnerability.com/cve_vulnerabilities/cve-2007-5340/ Sun, 26 Feb 2023 09:07:38 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2007-5340/ Multiple vulnerabilities in the Javascript engine in Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allow remote attackers to cause a denial of service (crash) via crafted HTML that triggers memory corruption.

The post CVE-2007-5340 appeared first on CVE Vulnerability.

]]> Multiple vulnerabilities in the Javascript engine in Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allow remote attackers to cause a denial of service (crash) via crafted HTML that triggers memory corruption.

The post CVE-2007-5340 appeared first on CVE Vulnerability.

]]> CVE-2007-5339 https://cvevulnerability.com/cve_vulnerabilities/cve-2007-5339/ Sun, 26 Feb 2023 09:07:38 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2007-5339/ Multiple vulnerabilities in Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allow remote attackers to cause a denial of service (crash) via crafted HTML that triggers memory corruption or assert errors.

The post CVE-2007-5339 appeared first on CVE Vulnerability.

]]> Multiple vulnerabilities in Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allow remote attackers to cause a denial of service (crash) via crafted HTML that triggers memory corruption or assert errors.

The post CVE-2007-5339 appeared first on CVE Vulnerability.

]]> CVE-2020-6812 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-6812/ Sun, 26 Feb 2023 06:42:51 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-6812/ The first time AirPods are connected to an iPhone, they become named after the user’s name by default (e.g. Jane Doe’s AirPods.) Websites with camera or microphone permission are able to enumerate device names, disclosing the user’s name. To resolve this issue, Firefox added a special case that renames devices containing the substring ‘AirPods’ to […]

The post CVE-2020-6812 appeared first on CVE Vulnerability.

]]> The first time AirPods are connected to an iPhone, they become named after the user’s name by default (e.g. Jane Doe’s AirPods.) Websites with camera or microphone permission are able to enumerate device names, disclosing the user’s name. To resolve this issue, Firefox added a special case that renames devices containing the substring ‘AirPods’ to simply ‘AirPods’. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.

The post CVE-2020-6812 appeared first on CVE Vulnerability.

]]> CVE-2020-12397 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-12397/ Sun, 26 Feb 2023 06:36:34 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-12397/ By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerability affects Thunderbird < 68.8.0.

The post CVE-2020-12397 appeared first on CVE Vulnerability.

]]> By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerability affects Thunderbird < 68.8.0.

The post CVE-2020-12397 appeared first on CVE Vulnerability.

]]>