Advisories · Technology

Mozilla Firefox ESR.

Every CVE that names Mozilla Firefox ESR among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2017-5438 CVE record

Mozilla Thunderbird: A use-after-free vulnerability during XSLT processing due to the result handler being…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5436 CVE record

An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5435 CVE record

Mozilla Thunderbird: A use-after-free vulnerability occurs during transaction processing in the editor during…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5434 CVE record

Mozilla Thunderbird: A use-after-free vulnerability occurs when redirecting focus handling which results in a…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5433 CVE record

Mozilla Thunderbird: A use-after-free vulnerability in SMIL animation functions occurs when pointers to…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5432 CVE record

Mozilla Thunderbird: A use-after-free vulnerability occurs during certain text input selection resulting in a…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5430 CVE record

Memory safety bugs were reported in Firefox 52, Firefox ESR 52, and Thunderbird 52.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5429 CVE record

Mozilla Thunderbird: Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5428 CVE record

An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest.
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2017-5410 CVE record

Mozilla Firefox: Memory corruption resulting in a potentially exploitable crash during garbage collection…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5409 CVE record

Mozilla Firefox ESR: The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2017-5408 CVE record

Mozilla Firefox: Video files loaded video captions cross-origin without checking for the presence of CORS…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5407 CVE record

Mozilla Firefox: Using SVG filters that don't use the fixed point math implementation on a target iframe…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5405 CVE record

Mozilla Firefox: Certain response codes in FTP connections can result in the use of uninitialized values…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5404 CVE record

Mozilla Firefox: A use-after-free error can occur when manipulating ranges in selections with one node…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5402 CVE record

Mozilla Firefox: A use-after-free can occur when events are fired for a "FontFace" object after the object…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5401 CVE record

Mozilla Firefox: A crash triggerable by web content in which an "ErrorResult" references unassigned memory…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5400 CVE record

Mozilla Firefox: JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5398 CVE record

Memory safety bugs were reported in Thunderbird 45.7.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5396 CVE record

Mozilla Thunderbird: A use-after-free vulnerability in the Media Decoder when working with media files when…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5390 CVE record

Mozilla Thunderbird: The JSON viewer in the Developer Tools uses insecure methods to create a communication…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5386 CVE record

Mozilla Firefox ESR: WebExtension scripts can use the "data:" protocol to affect pages loaded by other web…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2017-5383 CVE record

Mozilla Thunderbird: URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5380 CVE record

A potential use-after-free found through fuzzing during DOM manipulation of SVG content.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5378 CVE record

Hashed codes of JavaScript objects are shared between pages.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5376 CVE record

Use-after-free while manipulating XSL in XSLT documents.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5375 CVE record

Mozilla Thunderbird: JIT code allocation can allow for a bypass of ASLR and DEP protections leading to…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5373 CVE record

Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-9905 CVE record

A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents.
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 11 Jun 2018
CVE-2016-9904 CVE record

Mozilla Firefox: An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-9902 CVE record

Mozilla Firefox ESR: The Pocket toolbar button, once activated…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9901 CVE record

Mozilla Firefox ESR: HTML tags received from the Pocket server will be processed without sanitization and any…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-9900 CVE record

Mozilla Firefox: External resources that should be blocked when loaded by SVG images can bypass security…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-9899 CVE record

Mozilla Firefox: Use-after-free while manipulating DOM events and removing audio elements due to errors in…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-9898 CVE record

Mozilla Firefox: Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-9897 CVE record

Mozilla Firefox: Memory corruption resulting in a potentially exploitable crash during WebGL functions…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-9895 CVE record

Mozilla Firefox: Event handlers on "marquee" elements were executed despite a strict Content Security…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-9893 CVE record

Memory safety bugs were reported in Thunderbird 45.5.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-9079 CVE record

CVSS 7.5 HighCritical · KEV, CVSS 7+ and EPSSKEV

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 11 Jun 2018
CVE-2016-9074 CVE record

An existing mitigation of timing side-channel attacks is insufficient in some circumstances.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-9066 CVE record

Mozilla Thunderbird: A buffer overflow resulting in a potentially exploitable crash due to memory allocation…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-9064 CVE record

Mozilla Firefox ESR: Add-on updates failed to verify that the add-on ID inside the signed package matched the…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-5297 CVE record

Mozilla Thunderbird: An error in argument length checking in JavaScript…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-5296 CVE record

Mozilla Thunderbird: A heap-buffer-overflow in Cairo when processing SVG content caused by compiler…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-5294 CVE record

Mozilla Thunderbird: The Mozilla Updater can be made to choose an arbitrary target working directory for…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-5293 CVE record

Mozilla Firefox ESR: When the Mozilla Updater is run, if the Updater's log file in the working directory…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 11 Jun 2018
CVE-2016-5291 CVE record

A same-origin policy bypass with local shortcut files to load arbitrary local content from disk.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2016-5290 CVE record

Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 Jun 2018
CVE-2017-5461 CVE record

Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a denial of service (out-of…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 11 May 2017
CVE-2017-5031 CVE record

A use after free in ANGLE in Google Chrome prior to 57.0.2987.98 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 24 Apr 2017