# Mozilla Firefox ESR.

Every CVE that names Mozilla Firefox ESR among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Cross-site scripting in Mozilla Firefox ESR and others](https://agentprime.io/advisories/CVE-2022-22748.md)
  `CVE-2022-22748` · CVE record: Mozilla Firefox ESR and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: Cross-site scripting (XSS)
- [Improper certificate validation in Mozilla Firefox ESR and others](https://agentprime.io/advisories/CVE-2022-22747.md)
  `CVE-2022-22747` · CVE record: Mozilla Firefox ESR and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: Weak cryptography or TLS
- [Race condition in Mozilla Firefox ESR and others](https://agentprime.io/advisories/CVE-2022-22746.md)
  `CVE-2022-22746` · CVE record: Mozilla Firefox ESR and 2 more · CVSS 5.9 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: Race condition
- [Information disclosure in Mozilla Firefox ESR and others](https://agentprime.io/advisories/CVE-2022-22745.md)
  `CVE-2022-22745` · CVE record: Mozilla Firefox ESR and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: Information disclosure
- [Improper output encoding in Mozilla Firefox ESR and others](https://agentprime.io/advisories/CVE-2022-22744.md)
  `CVE-2022-22744` · CVE record: Mozilla Firefox ESR and 2 more · CVSS 8.8 High · Not analysed yet · Published 22 Dec 2022 · Tags: CWE-116
- [Mozilla Firefox ESR: When navigating from inside an iframe while requesting fullscreen access…](https://agentprime.io/advisories/CVE-2022-22743.md)
  `CVE-2022-22743` · CVE record: Mozilla Firefox ESR and 2 more · CVSS 4.3 Medium · Not analysed yet · Published 22 Dec 2022
- [Out-of-bounds read in Mozilla Firefox ESR and others](https://agentprime.io/advisories/CVE-2022-22742.md)
  `CVE-2022-22742` · CVE record: Mozilla Firefox ESR and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: Memory corruption
- [Mozilla Firefox ESR: When resizing a popup while requesting fullscreen access…](https://agentprime.io/advisories/CVE-2022-22741.md)
  `CVE-2022-22741` · CVE record: Mozilla Firefox ESR and 2 more · CVSS 7.5 High · Not analysed yet · Published 22 Dec 2022
- [Use after free in Mozilla Firefox ESR and others](https://agentprime.io/advisories/CVE-2022-22740.md)
  `CVE-2022-22740` · CVE record: Mozilla Firefox ESR and 2 more · CVSS 8.8 High · Not analysed yet · Published 22 Dec 2022 · Tags: Memory corruption
- [Mozilla Firefox ESR: Malicious websites could have tricked users into accepting launching a program to handle…](https://agentprime.io/advisories/CVE-2022-22739.md)
  `CVE-2022-22739` · CVE record: Mozilla Firefox ESR and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 22 Dec 2022
- [Out-of-bounds write in Mozilla Firefox ESR and others](https://agentprime.io/advisories/CVE-2022-22738.md)
  `CVE-2022-22738` · CVE record: Mozilla Firefox ESR and 2 more · CVSS 8.8 High · Not analysed yet · Published 22 Dec 2022 · Tags: Memory corruption
- [Race condition in Mozilla Firefox ESR and others](https://agentprime.io/advisories/CVE-2022-22737.md)
  `CVE-2022-22737` · CVE record: Mozilla Firefox ESR and 2 more · CVSS 7.5 High · Not analysed yet · Published 22 Dec 2022 · Tags: Race condition
- [Prototype pollution in Mozilla Firefox and others](https://agentprime.io/advisories/CVE-2022-2200.md)
  `CVE-2022-2200` · CVE record: Mozilla Firefox and 2 more · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.24 · Not analysed yet · Published 22 Dec 2022 · Tags: Prototype pollution
- [Prototype pollution in Mozilla Firefox ESR and others](https://agentprime.io/advisories/CVE-2022-1802.md)
  `CVE-2022-1802` · CVE record: Mozilla Firefox ESR and 3 more · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.28 · Not analysed yet · Published 22 Dec 2022 · Tags: Prototype pollution
- [Prototype pollution in Mozilla Firefox ESR and others](https://agentprime.io/advisories/CVE-2022-1529.md)
  `CVE-2022-1529` · CVE record: Mozilla Firefox ESR and 3 more · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.18 · Not analysed yet · Published 22 Dec 2022 · Tags: Prototype pollution
- [Use after free in Mozilla Thunderbird and others](https://agentprime.io/advisories/CVE-2022-1196.md)
  `CVE-2022-1196` · CVE record: Mozilla Thunderbird and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: Memory corruption
- [Use after free in Mozilla Thunderbird and others](https://agentprime.io/advisories/CVE-2022-1097.md)
  `CVE-2022-1097` · CVE record: Mozilla Thunderbird and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: Memory corruption
- [XML injection in Mozilla Firefox ESR and others](https://agentprime.io/advisories/CVE-2021-4140.md)
  `CVE-2021-4140` · CVE record: Mozilla Firefox ESR and 2 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Dec 2022 · Tags: Other injection
- [Out-of-bounds write in Mozilla Firefox and others](https://agentprime.io/advisories/CVE-2021-4129.md)
  `CVE-2021-4129` · CVE record: Mozilla Firefox and 2 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Dec 2022 · Tags: Memory corruption
- [Mozilla Thunderbird: An out of date graphics library (Angle) likely contained vulnerabilities that could…](https://agentprime.io/advisories/CVE-2021-4127.md)
  `CVE-2021-4127` · CVE record: Mozilla Thunderbird and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Dec 2022
- [Mozilla Firefox: The iframe sandbox rules were not correctly applied to XSLT stylesheets…](https://agentprime.io/advisories/CVE-2021-38503.md)
  `CVE-2021-38503` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 8 Dec 2021
- [Mozilla Firefox: When interacting with an HTML input element's file picker dialog with webkitdirectory…](https://agentprime.io/advisories/CVE-2021-38504.md)
  `CVE-2021-38504` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 8 Dec 2021
- [Mozilla Firefox: Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which…](https://agentprime.io/advisories/CVE-2021-38505.md)
  `CVE-2021-38505` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 8 Dec 2021
- [Mozilla Firefox: Through a series of navigations, Firefox could have entered fullscreen mode without…](https://agentprime.io/advisories/CVE-2021-38506.md)
  `CVE-2021-38506` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 8 Dec 2021
- [Mozilla Firefox: The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be…](https://agentprime.io/advisories/CVE-2021-38507.md)
  `CVE-2021-38507` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 8 Dec 2021
- [Mozilla Firefox: By displaying a form validity message in the correct location at the same time as a…](https://agentprime.io/advisories/CVE-2021-38508.md)
  `CVE-2021-38508` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 8 Dec 2021
- [Mozilla Firefox: Due to an unusual sequence of attacker-controlled events…](https://agentprime.io/advisories/CVE-2021-38509.md)
  `CVE-2021-38509` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 8 Dec 2021
- [Mozilla Firefox: The executable file warning was not presented when downloading .inetloc files, which…](https://agentprime.io/advisories/CVE-2021-38510.md)
  `CVE-2021-38510` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 8 Dec 2021
- [Mozilla Firefox: Mozilla developers and community members reported memory safety bugs present in Firefox…](https://agentprime.io/advisories/CVE-2021-43534.md)
  `CVE-2021-43534` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 8 Dec 2021
- [Mozilla Firefox: A use-after-free could have occured when an HTTP2 session object was released on a…](https://agentprime.io/advisories/CVE-2021-43535.md)
  `CVE-2021-43535` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 8 Dec 2021
- [Mozilla Thunderbird: Under certain circumstances, asynchronous functions could have caused a navigation to…](https://agentprime.io/advisories/CVE-2021-43536.md)
  `CVE-2021-43536` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 8 Dec 2021
- [Mozilla Thunderbird: An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to…](https://agentprime.io/advisories/CVE-2021-43537.md)
  `CVE-2021-43537` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 8 Dec 2021
- [Mozilla Thunderbird: By misusing a race in our notification code…](https://agentprime.io/advisories/CVE-2021-43538.md)
  `CVE-2021-43538` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 8 Dec 2021
- [Mozilla Thunderbird: Failure to correctly record the location of live pointers across wasm instance calls…](https://agentprime.io/advisories/CVE-2021-43539.md)
  `CVE-2021-43539` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 8 Dec 2021
- [Mozilla Thunderbird: When invoking protocol handlers for external protocols…](https://agentprime.io/advisories/CVE-2021-43541.md)
  `CVE-2021-43541` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 8 Dec 2021
- [Mozilla Thunderbird: Using XMLHttpRequest, an attacker could have identified installed applications by probing…](https://agentprime.io/advisories/CVE-2021-43542.md)
  `CVE-2021-43542` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 8 Dec 2021
- [Mozilla Thunderbird: Documents loaded with the CSP sandbox directive could have escaped the sandbox's script…](https://agentprime.io/advisories/CVE-2021-43543.md)
  `CVE-2021-43543` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 8 Dec 2021
- [Using the Location API in a loop could have caused severe application hangs and crashes.](https://agentprime.io/advisories/CVE-2021-43545.md)
  `CVE-2021-43545` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 8 Dec 2021
- [Mozilla Thunderbird: It was possible to recreate previous cursor spoofing attacks against users with a zoomed…](https://agentprime.io/advisories/CVE-2021-43546.md)
  `CVE-2021-43546` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 8 Dec 2021
- [Mozilla Firefox: When delegating navigations to the operating system…](https://agentprime.io/advisories/CVE-2021-38492.md)
  `CVE-2021-38492` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 3 Nov 2021
- [Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13.](https://agentprime.io/advisories/CVE-2021-38493.md)
  `CVE-2021-38493` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 3 Nov 2021
- [Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0.](https://agentprime.io/advisories/CVE-2021-38495.md)
  `CVE-2021-38495` · CVE record: Mozilla Thunderbird and 1 more · No CVSS score · Not analysed yet · Published 3 Nov 2021
- [Mozilla Thunderbird: During operations on MessageTasks, a task may have been removed while it was still…](https://agentprime.io/advisories/CVE-2021-38496.md)
  `CVE-2021-38496` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 3 Nov 2021
- [Mozilla Firefox: Through use of reportValidity() and window.open()…](https://agentprime.io/advisories/CVE-2021-38497.md)
  `CVE-2021-38497` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 3 Nov 2021
- [Mozilla Firefox: During process shutdown, a document could have caused a use-after-free of a languages…](https://agentprime.io/advisories/CVE-2021-38498.md)
  `CVE-2021-38498` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 3 Nov 2021
- [Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1.](https://agentprime.io/advisories/CVE-2021-38500.md)
  `CVE-2021-38500` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 3 Nov 2021
- [Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1.](https://agentprime.io/advisories/CVE-2021-38501.md)
  `CVE-2021-38501` · CVE record: Mozilla Firefox and 2 more · No CVSS score · Not analysed yet · Published 3 Nov 2021
- [Mozilla Thunderbird: Uninitialized memory in a canvas object could have caused an incorrect free() leading to…](https://agentprime.io/advisories/CVE-2021-29980.md)
  `CVE-2021-29980` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 17 Aug 2021
- [Mozilla Thunderbird: Instruction reordering resulted in a sequence of instructions that would cause an object…](https://agentprime.io/advisories/CVE-2021-29984.md)
  `CVE-2021-29984` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 17 Aug 2021
- [Mozilla Thunderbird: A use-after-free vulnerability in media channels could have led to memory corruption and…](https://agentprime.io/advisories/CVE-2021-29985.md)
  `CVE-2021-29985` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 17 Aug 2021
- [Mozilla Thunderbird: A suspected race condition when calling getaddrinfo led to memory corruption and a…](https://agentprime.io/advisories/CVE-2021-29986.md)
  `CVE-2021-29986` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 17 Aug 2021
- [Mozilla Thunderbird: Firefox incorrectly treated an inline list-item element as a block element…](https://agentprime.io/advisories/CVE-2021-29988.md)
  `CVE-2021-29988` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 17 Aug 2021
- [Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12.](https://agentprime.io/advisories/CVE-2021-29989.md)
  `CVE-2021-29989` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 17 Aug 2021
- [Mozilla Thunderbird: A malicious webpage could have triggered a use-after-free, memory corruption…](https://agentprime.io/advisories/CVE-2021-29970.md)
  `CVE-2021-29970` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 5 Aug 2021
- [Mozilla Thunderbird: Mozilla developers reported memory safety bugs present in code shared between Firefox and…](https://agentprime.io/advisories/CVE-2021-29976.md)
  `CVE-2021-29976` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 5 Aug 2021
- [Mozilla Firefox ESR: A WebGL framebuffer was not initialized early enough…](https://agentprime.io/advisories/CVE-2021-23994.md)
  `CVE-2021-23994` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 24 Jun 2021
- [When Responsive Design Mode was enabled, it used references to objects that were previously freed.](https://agentprime.io/advisories/CVE-2021-23995.md)
  `CVE-2021-23995` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 24 Jun 2021
- [Mozilla Firefox ESR: Through complicated navigations with new windows…](https://agentprime.io/advisories/CVE-2021-23998.md)
  `CVE-2021-23998` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 24 Jun 2021
- [Mozilla Firefox ESR: If a Blob URL was loaded through some unusual user interaction…](https://agentprime.io/advisories/CVE-2021-23999.md)
  `CVE-2021-23999` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 24 Jun 2021
- [Mozilla Firefox ESR: When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D)…](https://agentprime.io/advisories/CVE-2021-24002.md)
  `CVE-2021-24002` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 24 Jun 2021

Newest: <https://agentprime.io/advisories/technology/mozilla-firefox-esr.md>
Older: <https://agentprime.io/advisories/technology/mozilla-firefox-esr.md?cursor=WyIyMDIxLTA2LTI0VDEzOjIwOjM1LjAwMDAwMFoiLCJDVkUtMjAyMS0yNDAwMiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mozilla-firefox-esr&cursor=WyIyMDIyLTEyLTIyVDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMi0yMjc1MSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mozilla-firefox-esr/?cursor=WyIyMDIyLTEyLTIyVDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMi0yMjc1MSJd>. Everything for agents: <https://agentprime.io/llms.txt>.