CVE-2013-6674: Mozilla Seamonkey

Medium severity, CVSS 4.3. EPSS: 7.7% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in an IFRAME element, a related issue to CVE-2014-2018.

Affected products

• Mozilla Seamonkey: any version; up to and including 2.20; version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; …
• Mozilla Thunderbird: version 17.0 only; version 17.0.1 only; version 17.0.2 only; version 17.0.3 only; version 17.0.4 only; version 17.0.5 only; …
• Mozilla Thunderbird ESR: version 17.0 only; version 17.0.1 only; version 17.0.2 only; version 17.0.3 only; version 17.0.4 only; version 17.0.5 only; …

Published 2014-02-17. Last modified 2026-06-17.