CVE-2014-2018: Mozilla Seamonkey

Medium severity, CVSS 4.3. EPSS: 2% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in a (1) OBJECT or (2) EMBED element, a related issue to CVE-2013-6674.

Affected products

• Mozilla Seamonkey: any version; up to and including 2.19; version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; …
• Mozilla Thunderbird: version 17.0 only; version 17.0.1 only; version 17.0.2 only; version 17.0.3 only; version 17.0.4 only; version 17.0.5 only; …
• Mozilla Thunderbird ESR: version 17.0 only; version 17.0.1 only; version 17.0.2 only; version 17.0.3 only; version 17.0.4 only; version 17.0.5 only; …

Published 2014-02-17. Last modified 2026-06-17.