# Mozilla Firefox ESR.

Every CVE that names Mozilla Firefox ESR among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Mozilla Firefox ESR: The WebAssembly JIT could miscalculate the size of a return type…](https://agentprime.io/advisories/CVE-2021-29945.md)
  `CVE-2021-29945` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 24 Jun 2021
- [Mozilla Firefox ESR: Ports that were written as an integer overflow above the bounds of a 16-bit integer could…](https://agentprime.io/advisories/CVE-2021-29946.md)
  `CVE-2021-29946` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 24 Jun 2021
- [Mozilla Thunderbird: The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which…](https://agentprime.io/advisories/CVE-2021-29951.md)
  `CVE-2021-29951` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 24 Jun 2021
- [Mozilla Firefox ESR: A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed…](https://agentprime.io/advisories/CVE-2021-29955.md)
  `CVE-2021-29955` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 24 Jun 2021
- [Mozilla Thunderbird: A locally-installed hostile program could send \`WM_COPYDATA\` messages that Firefox would…](https://agentprime.io/advisories/CVE-2021-29964.md)
  `CVE-2021-29964` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 24 Jun 2021
- [Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11.](https://agentprime.io/advisories/CVE-2021-29967.md)
  `CVE-2021-29967` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 24 Jun 2021
- [Mozilla Firefox ESR: A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip…](https://agentprime.io/advisories/CVE-2021-23981.md)
  `CVE-2021-23981` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 31 Mar 2021
- [Mozilla Firefox ESR: Using techniques that built on the slipstream research…](https://agentprime.io/advisories/CVE-2021-23982.md)
  `CVE-2021-23982` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 31 Mar 2021
- [A malicious extension could have opened a popup window lacking an address bar.](https://agentprime.io/advisories/CVE-2021-23984.md)
  `CVE-2021-23984` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 31 Mar 2021
- [Mozilla Firefox ESR: Mozilla developers and community members reported memory safety bugs present in Firefox…](https://agentprime.io/advisories/CVE-2021-23987.md)
  `CVE-2021-23987` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 31 Mar 2021
- [Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6.](https://agentprime.io/advisories/CVE-2021-23964.md)
  `CVE-2021-23964` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 26 Feb 2021
- [Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7.](https://agentprime.io/advisories/CVE-2021-23978.md)
  `CVE-2021-23978` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 26 Feb 2021
- [Mozilla Firefox: If a user clicked into a specifically crafted PDF…](https://agentprime.io/advisories/CVE-2021-23953.md)
  `CVE-2021-23953` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 26 Feb 2021
- [Mozilla Firefox: Using the new logical assignment operators in a JavaScript switch statement could have…](https://agentprime.io/advisories/CVE-2021-23954.md)
  `CVE-2021-23954` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 26 Feb 2021
- [Mozilla Firefox: Performing garbage collection on re-declared JavaScript variables resulted in a…](https://agentprime.io/advisories/CVE-2021-23960.md)
  `CVE-2021-23960` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 26 Feb 2021
- [Mozilla Firefox: If Content Security Policy blocked frame navigation…](https://agentprime.io/advisories/CVE-2021-23968.md)
  `CVE-2021-23968` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 26 Feb 2021
- [Mozilla Firefox: As specified in the W3C Content Security Policy draft, when creating a violation report…](https://agentprime.io/advisories/CVE-2021-23969.md)
  `CVE-2021-23969` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 26 Feb 2021
- [Mozilla Firefox: When trying to load a cross-origin resource in an audio/video context a decoding error…](https://agentprime.io/advisories/CVE-2021-23973.md)
  `CVE-2021-23973` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 26 Feb 2021
- [Mozilla Firefox: Certain blit values provided by the user were not properly constrained leading to a heap…](https://agentprime.io/advisories/CVE-2020-26971.md)
  `CVE-2020-26971` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 7 Jan 2021
- [Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed.](https://agentprime.io/advisories/CVE-2020-26973.md)
  `CVE-2020-26973` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 7 Jan 2021
- [Mozilla Firefox: When flex-basis was used on a table wrapper…](https://agentprime.io/advisories/CVE-2020-26974.md)
  `CVE-2020-26974` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 7 Jan 2021
- [Mozilla Firefox: Using techniques that built on the slipstream research…](https://agentprime.io/advisories/CVE-2020-26978.md)
  `CVE-2020-26978` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 7 Jan 2021
- [Mozilla Firefox: When an extension with the proxy permission registered to receive \<all_urls>…](https://agentprime.io/advisories/CVE-2020-35111.md)
  `CVE-2020-35111` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 7 Jan 2021
- [Mozilla Firefox: If a user downloaded a file lacking an extension on Windows…](https://agentprime.io/advisories/CVE-2020-35112.md)
  `CVE-2020-35112` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 7 Jan 2021
- [Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5.](https://agentprime.io/advisories/CVE-2020-35113.md)
  `CVE-2020-35113` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 7 Jan 2021
- [Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4.](https://agentprime.io/advisories/CVE-2020-26968.md)
  `CVE-2020-26968` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 9 Dec 2020
- [Mozilla Firefox: Searching for a single word from the address bar caused an mDNS request to be sent on the…](https://agentprime.io/advisories/CVE-2020-26966.md)
  `CVE-2020-26966` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 9 Dec 2020
- [Mozilla Firefox: Some websites have a feature "Show Password" where clicking a button will change a…](https://agentprime.io/advisories/CVE-2020-26965.md)
  `CVE-2020-26965` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 9 Dec 2020
- [Mozilla Firefox: When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges…](https://agentprime.io/advisories/CVE-2020-26961.md)
  `CVE-2020-26961` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 9 Dec 2020
- [Mozilla Firefox: If the Compact() method was called on an nsTArray…](https://agentprime.io/advisories/CVE-2020-26960.md)
  `CVE-2020-26960` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 9 Dec 2020
- [Mozilla Firefox: During browser shutdown, reference decrementing could have occured on a previously freed…](https://agentprime.io/advisories/CVE-2020-26959.md)
  `CVE-2020-26959` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 9 Dec 2020
- [Mozilla Firefox: Firefox did not block execution of scripts with incorrect MIME types when the response…](https://agentprime.io/advisories/CVE-2020-26958.md)
  `CVE-2020-26958` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 9 Dec 2020
- [Mozilla Firefox: In some cases, removing HTML elements during sanitization would keep existing SVG event…](https://agentprime.io/advisories/CVE-2020-26956.md)
  `CVE-2020-26956` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 9 Dec 2020
- [Mozilla Firefox: It was possible to cause the browser to enter fullscreen mode without displaying the…](https://agentprime.io/advisories/CVE-2020-26953.md)
  `CVE-2020-26953` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 9 Dec 2020
- [Mozilla Firefox: A parsing and event loading mismatch in Firefox's SVG code could have allowed load events…](https://agentprime.io/advisories/CVE-2020-26951.md)
  `CVE-2020-26951` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 9 Dec 2020
- [Mozilla Firefox: In certain circumstances, the MCallGetProperty opcode can be emitted with unmet…](https://agentprime.io/advisories/CVE-2020-26950.md)
  `CVE-2020-26950` · CVE record: Mozilla Firefox and 2 more · No CVSS score · EPSS 0.42 · Not analysed yet · Published 9 Dec 2020
- [Mozilla Firefox ESR: Mozilla developers and community members reported memory safety bugs present in Firefox…](https://agentprime.io/advisories/CVE-2020-15683.md)
  `CVE-2020-15683` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 22 Oct 2020
- [Mozilla Firefox: If Firefox is installed to a user-writable directory…](https://agentprime.io/advisories/CVE-2020-15663.md)
  `CVE-2020-15663` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 1 Oct 2020
- [Mozilla Firefox: By holding a reference to the eval() function from an about:blank window…](https://agentprime.io/advisories/CVE-2020-15664.md)
  `CVE-2020-15664` · CVE record: Mozilla Firefox and 3 more · No CVSS score · Not analysed yet · Published 1 Oct 2020
- [Mozilla Firefox ESR: When aborting an operation, such as a fetch…](https://agentprime.io/advisories/CVE-2020-15669.md)
  `CVE-2020-15669` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 1 Oct 2020
- [Mozilla developers reported memory safety bugs present in Firefox for Android 79.](https://agentprime.io/advisories/CVE-2020-15670.md)
  `CVE-2020-15670` · CVE record: Mozilla Firefox and 3 more · No CVSS score · Not analysed yet · Published 1 Oct 2020
- [Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2.](https://agentprime.io/advisories/CVE-2020-15673.md)
  `CVE-2020-15673` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 1 Oct 2020
- [Mozilla Firefox: Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided…](https://agentprime.io/advisories/CVE-2020-15676.md)
  `CVE-2020-15676` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 1 Oct 2020
- [Mozilla Firefox: By exploiting an Open Redirect vulnerability on a website…](https://agentprime.io/advisories/CVE-2020-15677.md)
  `CVE-2020-15677` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 1 Oct 2020
- [Mozilla Firefox: When recursing through graphical layers while scrolling…](https://agentprime.io/advisories/CVE-2020-15678.md)
  `CVE-2020-15678` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 1 Oct 2020
- [Mozilla Firefox ESR: A redirected HTTP request which is observed or modified through a web extension could…](https://agentprime.io/advisories/CVE-2020-15655.md)
  `CVE-2020-15655` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 10 Aug 2020
- [Mozilla Firefox ESR: When in an endless loop, a website specifying a custom cursor using CSS could make it…](https://agentprime.io/advisories/CVE-2020-15654.md)
  `CVE-2020-15654` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 10 Aug 2020
- [An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links.](https://agentprime.io/advisories/CVE-2020-15653.md)
  `CVE-2020-15653` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 10 Aug 2020
- [Mozilla Firefox: By observing the stack trace for JavaScript errors in web workers…](https://agentprime.io/advisories/CVE-2020-15652.md)
  `CVE-2020-15652` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 10 Aug 2020
- [Mozilla Firefox ESR: Given an installed malicious file picker application…](https://agentprime.io/advisories/CVE-2020-15650.md)
  `CVE-2020-15650` · CVE record: Mozilla Firefox ESR · No CVSS score · Not analysed yet · Published 10 Aug 2020
- [Mozilla Firefox ESR: Given an installed malicious file picker application…](https://agentprime.io/advisories/CVE-2020-15649.md)
  `CVE-2020-15649` · CVE record: Mozilla Firefox ESR · No CVSS score · Not analysed yet · Published 10 Aug 2020
- [Mozilla Firefox: Mozilla developers and community members reported memory safety bugs present in Firefox…](https://agentprime.io/advisories/CVE-2020-15659.md)
  `CVE-2020-15659` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 10 Aug 2020
- [Mozilla Firefox ESR: The code for downloading files did not properly take care of special characters…](https://agentprime.io/advisories/CVE-2020-15658.md)
  `CVE-2020-15658` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 10 Aug 2020
- [Firefox could be made to load attacker-supplied DLL files from the installation directory.](https://agentprime.io/advisories/CVE-2020-15657.md)
  `CVE-2020-15657` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 10 Aug 2020
- [JIT optimizations involving the Javascript arguments object could confuse later optimizations.](https://agentprime.io/advisories/CVE-2020-15656.md)
  `CVE-2020-15656` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 10 Aug 2020
- [Mozilla Thunderbird: NSS has shown timing differences when performing DSA signatures…](https://agentprime.io/advisories/CVE-2020-12399.md)
  `CVE-2020-12399` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 9 Jul 2020
- [Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8.](https://agentprime.io/advisories/CVE-2020-12410.md)
  `CVE-2020-12410` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 9 Jul 2020
- [Mozilla Thunderbird: When browsing a malicious page, a race condition in our SharedWorkerService could occur…](https://agentprime.io/advisories/CVE-2020-12405.md)
  `CVE-2020-12405` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 9 Jul 2020
- [Mozilla Thunderbird: Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects…](https://agentprime.io/advisories/CVE-2020-12406.md)
  `CVE-2020-12406` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 9 Jul 2020
- [Mozilla Firefox ESR: When performing add-on updates, certificate chains terminating in non-built-in-roots were…](https://agentprime.io/advisories/CVE-2020-12421.md)
  `CVE-2020-12421` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 9 Jul 2020

Newest: <https://agentprime.io/advisories/technology/mozilla-firefox-esr.md>
Older: <https://agentprime.io/advisories/technology/mozilla-firefox-esr.md?cursor=WyIyMDIwLTA3LTA5VDE0OjM5OjM3LjAwMDAwMFoiLCJDVkUtMjAyMC0xMjQyMSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mozilla-firefox-esr&cursor=WyIyMDIxLTA2LTI0VDEzOjIwOjM1LjAwMDAwMFoiLCJDVkUtMjAyMS0yNDAwMiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mozilla-firefox-esr/?cursor=WyIyMDIxLTA2LTI0VDEzOjIwOjM1LjAwMDAwMFoiLCJDVkUtMjAyMS0yNDAwMiJd>. Everything for agents: <https://agentprime.io/llms.txt>.