Vulnerabilities > Mozilla > Thunderbird > High

DATE CVE VULNERABILITY TITLE RISK
2019-04-26 CVE-2018-18513 NULL Pointer Dereference vulnerability in Mozilla Thunderbird
A crash can occur when processing a crafted S/MIME message or an XPI package containing a crafted signature.
network
low complexity
mozilla CWE-476
7.5
2019-02-28 CVE-2018-12393 Integer Overflow or Wraparound vulnerability in multiple products
A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a buffer too small for the conversion.
network
low complexity
mozilla debian canonical redhat CWE-190
7.5
2019-02-28 CVE-2018-12391 Incorrect Authorization vulnerability in Mozilla Firefox
During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies.
network
low complexity
mozilla CWE-863
8.8
2019-02-28 CVE-2018-12389 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2.
network
low complexity
mozilla debian canonical redhat CWE-119
8.8
2018-10-18 CVE-2018-12385 Improper Input Validation vulnerability in multiple products
A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory.
local
high complexity
redhat debian canonical mozilla CWE-20
7.0
2018-10-18 CVE-2018-12379 Out-of-bounds Write vulnerability in multiple products
When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading to a potentially exploitable crash.
local
low complexity
redhat debian mozilla CWE-787
7.8
2018-10-18 CVE-2018-12368 Unspecified vulnerability in Mozilla Firefox
Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and have the "Mark of the Web." Without the warning, unsuspecting users unfamiliar with this new file type might run an unwanted executable.
network
high complexity
mozilla
8.1
2018-10-18 CVE-2018-12364 Cross-Site Request Forgery (CSRF) vulnerability in multiple products
NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the target site.
network
low complexity
redhat debian canonical mozilla CWE-352
8.8
2018-10-18 CVE-2018-12363 Use After Free vulnerability in multiple products
A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node being freed but the node still having a pointer referencing it.
network
low complexity
redhat debian canonical mozilla CWE-416
8.8
2018-10-18 CVE-2018-12362 Integer Overflow or Wraparound vulnerability in multiple products
An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in a potentially exploitable crash.
network
low complexity
redhat debian canonical mozilla CWE-190
8.8