Vulnerabilities > Mozilla > Thunderbird > Medium

DATE CVE VULNERABILITY TITLE RISK
2023-06-19 CVE-2023-29532 Unspecified vulnerability in Mozilla Firefox
A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server.
local
low complexity
mozilla
5.5
2023-06-02 CVE-2023-0430 Improper Certificate Validation vulnerability in Mozilla Thunderbird
Certificate OCSP revocation status was not checked when verifying S/Mime signatures.
network
low complexity
mozilla CWE-295
6.5
2023-06-02 CVE-2023-0547 Improper Certificate Validation vulnerability in Mozilla Thunderbird
OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted.
network
low complexity
mozilla CWE-295
6.5
2023-06-02 CVE-2023-0616 Resource Exhaustion vulnerability in Mozilla Thunderbird
If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actions.
network
low complexity
mozilla CWE-400
6.5
2023-06-02 CVE-2023-1945 Out-of-bounds Write vulnerability in Mozilla Thunderbird
Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.
network
low complexity
mozilla CWE-787
6.5
2023-06-02 CVE-2023-23598 Unspecified vulnerability in Mozilla Firefox
Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to <code>DataTransfer.setData</code>.
network
low complexity
mozilla
6.5
2023-06-02 CVE-2023-23599 Improper Encoding or Escaping of Output vulnerability in Mozilla Firefox
When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within.
network
low complexity
mozilla CWE-116
6.5
2023-06-02 CVE-2023-23601 Origin Validation Error vulnerability in Mozilla Firefox
Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks.
network
low complexity
mozilla CWE-346
6.5
2023-06-02 CVE-2023-23602 Improper Check for Unusual or Exceptional Conditions vulnerability in Mozilla Firefox
A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored.
network
low complexity
mozilla CWE-754
6.5
2023-06-02 CVE-2023-23603 Unspecified vulnerability in Mozilla Firefox
Regular expressions used to filter out forbidden properties and values from style directives in calls to <code>console.log</code> weren't accounting for external URLs.
network
low complexity
mozilla
6.5