# Mozilla Firefox ESR.

Every CVE that names Mozilla Firefox ESR among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Mozilla Thunderbird: A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by…](https://agentprime.io/advisories/CVE-2018-12385.md)
  `CVE-2018-12385` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [Mozilla Firefox: If a user saved passwords before Firefox 58 and then later set a master password…](https://agentprime.io/advisories/CVE-2018-12383.md)
  `CVE-2018-12383` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [Mozilla Firefox ESR: Manually dragging and dropping an Outlook email message into the browser will trigger a…](https://agentprime.io/advisories/CVE-2018-12381.md)
  `CVE-2018-12381` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [Mozilla Firefox: When the Mozilla Updater opens a MAR format file which contains a very long item…](https://agentprime.io/advisories/CVE-2018-12379.md)
  `CVE-2018-12379` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [Mozilla Firefox: A use-after-free vulnerability can occur when an IndexedDB index is deleted while still…](https://agentprime.io/advisories/CVE-2018-12378.md)
  `CVE-2018-12378` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [Mozilla Firefox: A use-after-free vulnerability can occur when refresh driver timers are refreshed in some…](https://agentprime.io/advisories/CVE-2018-12377.md)
  `CVE-2018-12377` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [Memory safety bugs present in Firefox 61 and Firefox ESR 60.1.](https://agentprime.io/advisories/CVE-2018-12376.md)
  `CVE-2018-12376` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [WebExtensions bundled with embedded experiments were not correctly checked for proper authorization.](https://agentprime.io/advisories/CVE-2018-12369.md)
  `CVE-2018-12369` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [Mozilla Thunderbird: Windows 10 does not warn users before opening executable files with the SettingContent-ms…](https://agentprime.io/advisories/CVE-2018-12368.md)
  `CVE-2018-12368` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [Mozilla Thunderbird: In the previous mitigations for Spectre…](https://agentprime.io/advisories/CVE-2018-12367.md)
  `CVE-2018-12367` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [Mozilla Thunderbird: An invalid grid size during QCMS (color profile) transformations can result in the…](https://agentprime.io/advisories/CVE-2018-12366.md)
  `CVE-2018-12366` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [Mozilla Thunderbird: A compromised IPC child process can escape the content sandbox and list the names of…](https://agentprime.io/advisories/CVE-2018-12365.md)
  `CVE-2018-12365` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [Mozilla Thunderbird: NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests…](https://agentprime.io/advisories/CVE-2018-12364.md)
  `CVE-2018-12364` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [Mozilla Thunderbird: A use-after-free vulnerability can occur when script uses mutation events to move DOM…](https://agentprime.io/advisories/CVE-2018-12363.md)
  `CVE-2018-12363` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [Mozilla Thunderbird: An integer overflow can occur during graphics operations done by the Supplemental…](https://agentprime.io/advisories/CVE-2018-12362.md)
  `CVE-2018-12362` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [An integer overflow can occur in the SwizzleData code while calculating buffer sizes.](https://agentprime.io/advisories/CVE-2018-12361.md)
  `CVE-2018-12361` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [Mozilla Thunderbird: A use-after-free vulnerability can occur when deleting an input element during a mutation…](https://agentprime.io/advisories/CVE-2018-12360.md)
  `CVE-2018-12360` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [Mozilla Thunderbird: A buffer overflow can occur when rendering canvas content while adjusting the height and…](https://agentprime.io/advisories/CVE-2018-12359.md)
  `CVE-2018-12359` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [Mozilla developers backported selected changes in the Skia library.](https://agentprime.io/advisories/CVE-2018-5183.md)
  `CVE-2018-5183` · CVE record: Mozilla Thunderbird ESR and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird ESR: A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript…](https://agentprime.io/advisories/CVE-2018-5178.md)
  `CVE-2018-5178` · CVE record: Mozilla Thunderbird ESR and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the…](https://agentprime.io/advisories/CVE-2018-5174.md)
  `CVE-2018-5174` · CVE record: Mozilla Thunderbird and 3 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: Sites can bypass security checks on permissions to install lightweight themes by…](https://agentprime.io/advisories/CVE-2018-5168.md)
  `CVE-2018-5168` · CVE record: Mozilla Thunderbird and 3 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: An integer overflow can occur in the Skia library due to 32-bit integer use in an array…](https://agentprime.io/advisories/CVE-2018-5159.md)
  `CVE-2018-5159` · CVE record: Mozilla Thunderbird and 3 more · No CVSS score · EPSS 0.21 · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox ESR: Same-origin protections for the PDF viewer can be bypassed…](https://agentprime.io/advisories/CVE-2018-5157.md)
  `CVE-2018-5157` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: A use-after-free vulnerability can occur while adjusting layout during SVG animations…](https://agentprime.io/advisories/CVE-2018-5155.md)
  `CVE-2018-5155` · CVE record: Mozilla Thunderbird and 3 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: A use-after-free vulnerability can occur while enumerating attributes during SVG…](https://agentprime.io/advisories/CVE-2018-5154.md)
  `CVE-2018-5154` · CVE record: Mozilla Thunderbird and 3 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7.](https://agentprime.io/advisories/CVE-2018-5150.md)
  `CVE-2018-5150` · CVE record: Mozilla Thunderbird and 3 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox ESR: A use-after-free vulnerability can occur in the compositor during certain graphics…](https://agentprime.io/advisories/CVE-2018-5148.md)
  `CVE-2018-5148` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [The libtremor library has the same flaw as CVE-2018-5146.](https://agentprime.io/advisories/CVE-2018-5147.md)
  `CVE-2018-5147` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: An out of bounds memory write while processing Vorbis audio data was reported through the…](https://agentprime.io/advisories/CVE-2018-5146.md)
  `CVE-2018-5146` · CVE record: Mozilla Firefox and 2 more · No CVSS score · EPSS 0.12 · Not analysed yet · Published 11 Jun 2018
- [Memory safety bugs were reported in Firefox ESR 52.6.](https://agentprime.io/advisories/CVE-2018-5145.md)
  `CVE-2018-5145` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox ESR: An integer overflow can occur during conversion of text to some Unicode character sets…](https://agentprime.io/advisories/CVE-2018-5144.md)
  `CVE-2018-5144` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox ESR: Under certain circumstances the "fetch()" API can return transient local copies of…](https://agentprime.io/advisories/CVE-2018-5131.md)
  `CVE-2018-5131` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox ESR: When packets with a mismatched RTP payload type are sent in WebRTC connections…](https://agentprime.io/advisories/CVE-2018-5130.md)
  `CVE-2018-5130` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: A lack of parameter validation on IPC messages results in a potential out-of-bounds write…](https://agentprime.io/advisories/CVE-2018-5129.md)
  `CVE-2018-5129` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script.](https://agentprime.io/advisories/CVE-2018-5127.md)
  `CVE-2018-5127` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Memory safety bugs were reported in Firefox 58 and Firefox ESR 52.6.](https://agentprime.io/advisories/CVE-2018-5125.md)
  `CVE-2018-5125` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: If right-to-left text is used in the addressbar with left-to-right alignment…](https://agentprime.io/advisories/CVE-2018-5117.md)
  `CVE-2018-5117` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: A use-after-free vulnerability can occur during font face manipulation when a font face…](https://agentprime.io/advisories/CVE-2018-5104.md)
  `CVE-2018-5104` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: A use-after-free vulnerability can occur during mouse event handling due to issues with…](https://agentprime.io/advisories/CVE-2018-5103.md)
  `CVE-2018-5103` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: A use-after-free vulnerability can occur when manipulating HTML media elements with media…](https://agentprime.io/advisories/CVE-2018-5102.md)
  `CVE-2018-5102` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: A use-after-free vulnerability can occur when the widget listener is holding strong…](https://agentprime.io/advisories/CVE-2018-5099.md)
  `CVE-2018-5099` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: A use-after-free vulnerability can occur when form input elements, focus…](https://agentprime.io/advisories/CVE-2018-5098.md)
  `CVE-2018-5098` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: A use-after-free vulnerability can occur during XSL transformations when the source…](https://agentprime.io/advisories/CVE-2018-5097.md)
  `CVE-2018-5097` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox ESR: A use-after-free vulnerability can occur while editing events in form elements on a page…](https://agentprime.io/advisories/CVE-2018-5096.md)
  `CVE-2018-5096` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: An integer overflow vulnerability in the Skia library when allocating memory for edge…](https://agentprime.io/advisories/CVE-2018-5095.md)
  `CVE-2018-5095` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox ESR: A use-after-free vulnerability can occur during WebRTC connections when interacting with…](https://agentprime.io/advisories/CVE-2018-5091.md)
  `CVE-2018-5091` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Memory safety bugs were reported in Firefox 57 and Firefox ESR 52.5.](https://agentprime.io/advisories/CVE-2018-5089.md)
  `CVE-2018-5089` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Thunderbird: A buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the…](https://agentprime.io/advisories/CVE-2017-7845.md)
  `CVE-2017-7845` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox ESR: When Private Browsing mode is used, it is possible for a web worker to write persistent…](https://agentprime.io/advisories/CVE-2017-7843.md)
  `CVE-2017-7843` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [The Resource Timing API incorrectly revealed navigations in cross-origin iframes.](https://agentprime.io/advisories/CVE-2017-7830.md)
  `CVE-2017-7830` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: A use-after-free vulnerability can occur when flushing and resizing layout because the…](https://agentprime.io/advisories/CVE-2017-7828.md)
  `CVE-2017-7828` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Memory safety bugs were reported in Firefox 56 and Firefox ESR 52.4.](https://agentprime.io/advisories/CVE-2017-7826.md)
  `CVE-2017-7826` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Several fonts on OS X display some Tibetan and Arabic characters as whitespace.](https://agentprime.io/advisories/CVE-2017-7825.md)
  `CVE-2017-7825` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: A buffer overflow occurs when drawing and validating elements with the ANGLE graphics…](https://agentprime.io/advisories/CVE-2017-7824.md)
  `CVE-2017-7824` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: The content security policy (CSP) "sandbox" directive did not create a unique origin for…](https://agentprime.io/advisories/CVE-2017-7823.md)
  `CVE-2017-7823` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: A use-after-free vulnerability can occur in design mode when image objects are resized if…](https://agentprime.io/advisories/CVE-2017-7819.md)
  `CVE-2017-7819` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich…](https://agentprime.io/advisories/CVE-2017-7818.md)
  `CVE-2017-7818` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Mozilla Firefox: File downloads encoded with "blob:" and "data:" URL elements bypassed normal file…](https://agentprime.io/advisories/CVE-2017-7814.md)
  `CVE-2017-7814` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018
- [Memory safety bugs were reported in Firefox 55 and Firefox ESR 52.3.](https://agentprime.io/advisories/CVE-2017-7810.md)
  `CVE-2017-7810` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 11 Jun 2018

Newest: <https://agentprime.io/advisories/technology/mozilla-firefox-esr.md>
Older: <https://agentprime.io/advisories/technology/mozilla-firefox-esr.md?cursor=WyIyMDE4LTA2LTExVDIxOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAxNy03ODEwIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mozilla-firefox-esr&cursor=WyIyMDE4LTEwLTE4VDEzOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAxOC0xMjM4NiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mozilla-firefox-esr/?cursor=WyIyMDE4LTEwLTE4VDEzOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAxOC0xMjM4NiJd>. Everything for agents: <https://agentprime.io/llms.txt>.