# Mozilla Firefox ESR.

Every CVE that names Mozilla Firefox ESR among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash.](https://agentprime.io/advisories/CVE-2019-11750.md)
  `CVE-2019-11750` · CVE record: Mozilla Firefox and 1 more · No CVSS score · Not analysed yet · Published 27 Sept 2019
- [Mozilla Firefox: Logging-related command line parameters are not properly sanitized when Firefox is…](https://agentprime.io/advisories/CVE-2019-11751.md)
  `CVE-2019-11751` · CVE record: Mozilla Firefox and 1 more · No CVSS score · Not analysed yet · Published 27 Sept 2019
- [Mozilla Firefox: It is possible to delete an IndexedDB key value and subsequently try to extract it during…](https://agentprime.io/advisories/CVE-2019-11752.md)
  `CVE-2019-11752` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 27 Sept 2019
- [Mozilla Firefox: The Firefox installer allows Firefox to be installed to a custom user writable location…](https://agentprime.io/advisories/CVE-2019-11753.md)
  `CVE-2019-11753` · CVE record: Mozilla Firefox and 1 more · No CVSS score · Not analysed yet · Published 27 Sept 2019
- [Mozilla Thunderbird: Mozilla developers and community members reported memory safety bugs present in Firefox…](https://agentprime.io/advisories/CVE-2019-9800.md)
  `CVE-2019-9800` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Mozilla Firefox ESR: As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by…](https://agentprime.io/advisories/CVE-2019-9811.md)
  `CVE-2019-9811` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Mozilla Thunderbird: If hyperthreading is not disabled, a timing attack vulnerability exists…](https://agentprime.io/advisories/CVE-2019-9815.md)
  `CVE-2019-9815` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Mozilla Thunderbird: A possible vulnerability exists where type confusion can occur when manipulating…](https://agentprime.io/advisories/CVE-2019-9816.md)
  `CVE-2019-9816` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Images from a different domain can be read using a canvas object in some circumstances.](https://agentprime.io/advisories/CVE-2019-9817.md)
  `CVE-2019-9817` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Mozilla Thunderbird: A race condition is present in the crash generation server used to generate data for the…](https://agentprime.io/advisories/CVE-2019-9818.md)
  `CVE-2019-9818` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Mozilla Thunderbird: A vulnerability where a JavaScript compartment mismatch can occur while working with the…](https://agentprime.io/advisories/CVE-2019-9819.md)
  `CVE-2019-9819` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Mozilla Thunderbird: A use-after-free vulnerability can occur in the chrome event handler when it is freed…](https://agentprime.io/advisories/CVE-2019-9820.md)
  `CVE-2019-9820` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Mozilla Thunderbird: A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an…](https://agentprime.io/advisories/CVE-2019-11691.md)
  `CVE-2019-11691` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Mozilla Thunderbird: A use-after-free vulnerability can occur when listeners are removed from the event…](https://agentprime.io/advisories/CVE-2019-11692.md)
  `CVE-2019-11692` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Mozilla Thunderbird: The bufferdata function in WebGL is vulnerable to a buffer overflow with specific…](https://agentprime.io/advisories/CVE-2019-11693.md)
  `CVE-2019-11693` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Mozilla Thunderbird: A vulnerability exists in the Windows sandbox where an uninitialized value in memory can…](https://agentprime.io/advisories/CVE-2019-11694.md)
  `CVE-2019-11694` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Mozilla Thunderbird: If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the…](https://agentprime.io/advisories/CVE-2019-11698.md)
  `CVE-2019-11698` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Type confusion in Mozilla Firefox ESR and others](https://agentprime.io/advisories/CVE-2019-11707.md)
  `CVE-2019-11707` · CVE record: Mozilla Firefox ESR and 2 more · CVSS 8.8 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.38 · Not analysed yet · Published 23 Jul 2019 · Tags: Memory corruption
- [Improper input validation in Mozilla Firefox ESR and others](https://agentprime.io/advisories/CVE-2019-11708.md)
  `CVE-2019-11708` · CVE record: Mozilla Firefox ESR and 2 more · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.56 · Not analysed yet · Published 23 Jul 2019 · Tags: CWE-20
- [Mozilla Firefox ESR: Mozilla developers and community members reported memory safety bugs present in Firefox…](https://agentprime.io/advisories/CVE-2019-11709.md)
  `CVE-2019-11709` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Mozilla Firefox ESR: When an inner window is reused, it does not consider the use of document.domain for…](https://agentprime.io/advisories/CVE-2019-11711.md)
  `CVE-2019-11711` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Mozilla Firefox ESR: POST requests made by NPAPI plugins, such as Flash…](https://agentprime.io/advisories/CVE-2019-11712.md)
  `CVE-2019-11712` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Mozilla Firefox ESR: A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed…](https://agentprime.io/advisories/CVE-2019-11713.md)
  `CVE-2019-11713` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Mozilla Firefox ESR: Due to an error while parsing page content…](https://agentprime.io/advisories/CVE-2019-11715.md)
  `CVE-2019-11715` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Mozilla Firefox ESR: A vulnerability exists where the caret ("^") character is improperly escaped constructing…](https://agentprime.io/advisories/CVE-2019-11717.md)
  `CVE-2019-11717` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Mozilla Firefox ESR: When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes…](https://agentprime.io/advisories/CVE-2019-11719.md)
  `CVE-2019-11719` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Mozilla Firefox ESR: Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values…](https://agentprime.io/advisories/CVE-2019-11729.md)
  `CVE-2019-11729` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 23 Jul 2019
- [Mozilla Firefox ESR: A vulnerability exists where if a user opens a locally saved HTML file…](https://agentprime.io/advisories/CVE-2019-11730.md)
  `CVE-2019-11730` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · EPSS 0.20 · Not analysed yet · Published 23 Jul 2019
- [Mozilla Thunderbird: Firefox will accept any registered Program ID as an external protocol handler and offer…](https://agentprime.io/advisories/CVE-2019-9801.md)
  `CVE-2019-9801` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 26 Apr 2019
- [Mozilla Thunderbird: A use-after-free vulnerability can occur when the SMIL animation controller incorrectly…](https://agentprime.io/advisories/CVE-2019-9796.md)
  `CVE-2019-9796` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 26 Apr 2019
- [Mozilla Thunderbird: A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could…](https://agentprime.io/advisories/CVE-2019-9795.md)
  `CVE-2019-9795` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 26 Apr 2019
- [Mozilla Thunderbird: A vulnerability was discovered where specific command line arguments are not properly…](https://agentprime.io/advisories/CVE-2019-9794.md)
  `CVE-2019-9794` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 26 Apr 2019
- [Mozilla Thunderbird: A mechanism was discovered that removes some bounds checking for string, array…](https://agentprime.io/advisories/CVE-2019-9793.md)
  `CVE-2019-9793` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 26 Apr 2019
- [Mozilla Thunderbird: The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic…](https://agentprime.io/advisories/CVE-2019-9792.md)
  `CVE-2019-9792` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · EPSS 0.13 · Not analysed yet · Published 26 Apr 2019
- [Mozilla Thunderbird: The type inference system allows the compilation of functions that can cause type…](https://agentprime.io/advisories/CVE-2019-9791.md)
  `CVE-2019-9791` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · EPSS 0.20 · Not analysed yet · Published 26 Apr 2019
- [Mozilla Thunderbird: A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is…](https://agentprime.io/advisories/CVE-2019-9790.md)
  `CVE-2019-9790` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 26 Apr 2019
- [Mozilla Thunderbird: Mozilla developers and community members reported memory safety bugs present in Firefox…](https://agentprime.io/advisories/CVE-2019-9788.md)
  `CVE-2019-9788` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 26 Apr 2019
- [Mozilla Firefox: Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method…](https://agentprime.io/advisories/CVE-2019-9810.md)
  `CVE-2019-9810` · CVE record: Mozilla Firefox and 2 more · No CVSS score · EPSS 0.27 · Not analysed yet · Published 26 Apr 2019
- [Mozilla Firefox: Incorrect handling of \_\_proto\_\_ mutations may lead to type confusion in IonMonkey JIT…](https://agentprime.io/advisories/CVE-2019-9813.md)
  `CVE-2019-9813` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 26 Apr 2019
- [Mozilla Firefox: A same-origin policy violation allowing the theft of cross-origin URL entries when using…](https://agentprime.io/advisories/CVE-2018-18499.md)
  `CVE-2018-18499` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 28 Feb 2019
- [Mozilla Thunderbird: A potential vulnerability leading to an integer overflow can occur during buffer size…](https://agentprime.io/advisories/CVE-2018-18498.md)
  `CVE-2018-18498` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 28 Feb 2019
- [Mozilla Thunderbird: A same-origin policy violation allowing the theft of cross-origin URL entries when using…](https://agentprime.io/advisories/CVE-2018-18494.md)
  `CVE-2018-18494` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 28 Feb 2019
- [Mozilla Thunderbird: A buffer overflow can occur in the Skia library during buffer offset calculations with…](https://agentprime.io/advisories/CVE-2018-18493.md)
  `CVE-2018-18493` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 28 Feb 2019
- [Mozilla Thunderbird: A use-after-free vulnerability can occur after deleting a selection element due to a weak…](https://agentprime.io/advisories/CVE-2018-18492.md)
  `CVE-2018-18492` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 28 Feb 2019
- [Mozilla Thunderbird: Mozilla developers and community members reported memory safety bugs present in Firefox…](https://agentprime.io/advisories/CVE-2018-12405.md)
  `CVE-2018-12405` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 28 Feb 2019
- [Mozilla Firefox ESR: A WebExtension can request access to local files without the warning prompt stating that…](https://agentprime.io/advisories/CVE-2018-12397.md)
  `CVE-2018-12397` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 28 Feb 2019
- [Mozilla Firefox ESR: A vulnerability where a WebExtension can run content scripts in disallowed contexts…](https://agentprime.io/advisories/CVE-2018-12396.md)
  `CVE-2018-12396` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 28 Feb 2019
- [Mozilla Firefox ESR: By rewriting the Host: request headers using the webRequest API…](https://agentprime.io/advisories/CVE-2018-12395.md)
  `CVE-2018-12395` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 28 Feb 2019
- [Mozilla Firefox: A potential vulnerability was found in 32-bit builds where an integer overflow during the…](https://agentprime.io/advisories/CVE-2018-12393.md)
  `CVE-2018-12393` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 28 Feb 2019
- [Mozilla Firefox: When manipulating user events in nested loops while opening a document through script…](https://agentprime.io/advisories/CVE-2018-12392.md)
  `CVE-2018-12392` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 28 Feb 2019
- [Mozilla Firefox: During HTTP Live Stream playback on Firefox for Android…](https://agentprime.io/advisories/CVE-2018-12391.md)
  `CVE-2018-12391` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 28 Feb 2019
- [Mozilla Firefox: Mozilla developers and community members reported memory safety bugs present in Firefox…](https://agentprime.io/advisories/CVE-2018-12390.md)
  `CVE-2018-12390` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 28 Feb 2019
- [Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2.](https://agentprime.io/advisories/CVE-2018-12389.md)
  `CVE-2018-12389` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 28 Feb 2019
- [Mozilla Thunderbird: An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079…](https://agentprime.io/advisories/CVE-2018-18505.md)
  `CVE-2018-18505` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 5 Feb 2019
- [Mozilla Thunderbird: Mozilla developers and community members reported memory safety bugs present in Firefox…](https://agentprime.io/advisories/CVE-2018-18501.md)
  `CVE-2018-18501` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 5 Feb 2019
- [Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8.](https://agentprime.io/advisories/CVE-2018-5188.md)
  `CVE-2018-5188` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [Memory safety bugs present in Firefox 60 and Firefox ESR 60.](https://agentprime.io/advisories/CVE-2018-5187.md)
  `CVE-2018-5187` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [Mozilla Thunderbird: A vulnerability can occur when capturing a media stream when the media source type is…](https://agentprime.io/advisories/CVE-2018-5156.md)
  `CVE-2018-5156` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [Mozilla Firefox ESR: A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with…](https://agentprime.io/advisories/CVE-2018-12387.md)
  `CVE-2018-12387` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 18 Oct 2018
- [Mozilla Firefox ESR: A vulnerability in register allocation in JavaScript can lead to type confusion…](https://agentprime.io/advisories/CVE-2018-12386.md)
  `CVE-2018-12386` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · EPSS 0.14 · Not analysed yet · Published 18 Oct 2018

Newest: <https://agentprime.io/advisories/technology/mozilla-firefox-esr.md>
Older: <https://agentprime.io/advisories/technology/mozilla-firefox-esr.md?cursor=WyIyMDE4LTEwLTE4VDEzOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAxOC0xMjM4NiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mozilla-firefox-esr&cursor=WyIyMDE5LTA5LTI3VDE3OjE1OjIzLjAwMDAwMFoiLCJDVkUtMjAxOS0xMTc0OSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mozilla-firefox-esr/?cursor=WyIyMDE5LTA5LTI3VDE3OjE1OjIzLjAwMDAwMFoiLCJDVkUtMjAxOS0xMTc0OSJd>. Everything for agents: <https://agentprime.io/llms.txt>.