Advisories · Technology

Mozilla Firefox ESR.

Every CVE that names Mozilla Firefox ESR among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2019-11750 CVE record

A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 27 Sept 2019
CVE-2019-11751 CVE record

Mozilla Firefox: Logging-related command line parameters are not properly sanitized when Firefox is…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 27 Sept 2019
CVE-2019-11752 CVE record

Mozilla Firefox: It is possible to delete an IndexedDB key value and subsequently try to extract it during…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 27 Sept 2019
CVE-2019-11753 CVE record

Mozilla Firefox: The Firefox installer allows Firefox to be installed to a custom user writable location…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 27 Sept 2019
CVE-2019-9800 CVE record

Mozilla Thunderbird: Mozilla developers and community members reported memory safety bugs present in Firefox…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-9811 CVE record

Mozilla Firefox ESR: As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-9815 CVE record

Mozilla Thunderbird: If hyperthreading is not disabled, a timing attack vulnerability exists…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-9816 CVE record

Mozilla Thunderbird: A possible vulnerability exists where type confusion can occur when manipulating…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-9817 CVE record

Images from a different domain can be read using a canvas object in some circumstances.
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-9818 CVE record

Mozilla Thunderbird: A race condition is present in the crash generation server used to generate data for the…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-9819 CVE record

Mozilla Thunderbird: A vulnerability where a JavaScript compartment mismatch can occur while working with the…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-9820 CVE record

Mozilla Thunderbird: A use-after-free vulnerability can occur in the chrome event handler when it is freed…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-11691 CVE record

Mozilla Thunderbird: A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-11692 CVE record

Mozilla Thunderbird: A use-after-free vulnerability can occur when listeners are removed from the event…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-11693 CVE record

Mozilla Thunderbird: The bufferdata function in WebGL is vulnerable to a buffer overflow with specific…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-11694 CVE record

Mozilla Thunderbird: A vulnerability exists in the Windows sandbox where an uninitialized value in memory can…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-11698 CVE record

Mozilla Thunderbird: If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-11707 CVE record

CVSS 8.8 HighCritical · KEV, CVSS 7+ and EPSSKEV

Type confusion in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Firefox
- Memory corruption
Not analysed yet 23 Jul 2019
CVE-2019-11708 CVE record

CVSS 10.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Improper input validation in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Firefox
- CWE-20
Not analysed yet 23 Jul 2019
CVE-2019-11709 CVE record

Mozilla Firefox ESR: Mozilla developers and community members reported memory safety bugs present in Firefox…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-11711 CVE record

Mozilla Firefox ESR: When an inner window is reused, it does not consider the use of document.domain for…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-11712 CVE record

Mozilla Firefox ESR: POST requests made by NPAPI plugins, such as Flash…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-11713 CVE record

Mozilla Firefox ESR: A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-11715 CVE record

Mozilla Firefox ESR: Due to an error while parsing page content…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-11717 CVE record

Mozilla Firefox ESR: A vulnerability exists where the caret ("^") character is improperly escaped constructing…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-11719 CVE record

Mozilla Firefox ESR: When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-11729 CVE record

Mozilla Firefox ESR: Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-11730 CVE record

Mozilla Firefox ESR: A vulnerability exists where if a user opens a locally saved HTML file…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 23 Jul 2019
CVE-2019-9801 CVE record

Mozilla Thunderbird: Firefox will accept any registered Program ID as an external protocol handler and offer…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 26 Apr 2019
CVE-2019-9796 CVE record

Mozilla Thunderbird: A use-after-free vulnerability can occur when the SMIL animation controller incorrectly…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 26 Apr 2019
CVE-2019-9795 CVE record

Mozilla Thunderbird: A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 26 Apr 2019
CVE-2019-9794 CVE record

Mozilla Thunderbird: A vulnerability was discovered where specific command line arguments are not properly…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 26 Apr 2019
CVE-2019-9793 CVE record

Mozilla Thunderbird: A mechanism was discovered that removes some bounds checking for string, array…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 26 Apr 2019
CVE-2019-9792 CVE record

Mozilla Thunderbird: The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 26 Apr 2019
CVE-2019-9791 CVE record

Mozilla Thunderbird: The type inference system allows the compilation of functions that can cause type…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 26 Apr 2019
CVE-2019-9790 CVE record

Mozilla Thunderbird: A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 26 Apr 2019
CVE-2019-9788 CVE record

Mozilla Thunderbird: Mozilla developers and community members reported memory safety bugs present in Firefox…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 26 Apr 2019
CVE-2019-9810 CVE record

Mozilla Firefox: Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 26 Apr 2019
CVE-2019-9813 CVE record

Mozilla Firefox: Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 26 Apr 2019
CVE-2018-18499 CVE record

Mozilla Firefox: A same-origin policy violation allowing the theft of cross-origin URL entries when using…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 28 Feb 2019
CVE-2018-18498 CVE record

Mozilla Thunderbird: A potential vulnerability leading to an integer overflow can occur during buffer size…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 28 Feb 2019
CVE-2018-18494 CVE record

Mozilla Thunderbird: A same-origin policy violation allowing the theft of cross-origin URL entries when using…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 28 Feb 2019
CVE-2018-18493 CVE record

Mozilla Thunderbird: A buffer overflow can occur in the Skia library during buffer offset calculations with…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 28 Feb 2019
CVE-2018-18492 CVE record

Mozilla Thunderbird: A use-after-free vulnerability can occur after deleting a selection element due to a weak…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 28 Feb 2019
CVE-2018-12405 CVE record

Mozilla Thunderbird: Mozilla developers and community members reported memory safety bugs present in Firefox…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 28 Feb 2019
CVE-2018-12397 CVE record

Mozilla Firefox ESR: A WebExtension can request access to local files without the warning prompt stating that…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 28 Feb 2019
CVE-2018-12396 CVE record

Mozilla Firefox ESR: A vulnerability where a WebExtension can run content scripts in disallowed contexts…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 28 Feb 2019
CVE-2018-12395 CVE record

Mozilla Firefox ESR: By rewriting the Host: request headers using the webRequest API…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 28 Feb 2019
CVE-2018-12393 CVE record

Mozilla Firefox: A potential vulnerability was found in 32-bit builds where an integer overflow during the…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 28 Feb 2019
CVE-2018-12392 CVE record

Mozilla Firefox: When manipulating user events in nested loops while opening a document through script…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 28 Feb 2019
CVE-2018-12391 CVE record

Mozilla Firefox: During HTTP Live Stream playback on Firefox for Android…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 28 Feb 2019
CVE-2018-12390 CVE record

Mozilla Firefox: Mozilla developers and community members reported memory safety bugs present in Firefox…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 28 Feb 2019
CVE-2018-12389 CVE record

Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2.
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 28 Feb 2019
CVE-2018-18505 CVE record

Mozilla Thunderbird: An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 5 Feb 2019
CVE-2018-18501 CVE record

Mozilla Thunderbird: Mozilla developers and community members reported memory safety bugs present in Firefox…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 5 Feb 2019
CVE-2018-5188 CVE record

Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 18 Oct 2018
CVE-2018-5187 CVE record

Memory safety bugs present in Firefox 60 and Firefox ESR 60.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 18 Oct 2018
CVE-2018-5156 CVE record

Mozilla Thunderbird: A vulnerability can occur when capturing a media stream when the media source type is…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 18 Oct 2018
CVE-2018-12387 CVE record

Mozilla Firefox ESR: A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 18 Oct 2018
CVE-2018-12386 CVE record

Mozilla Firefox ESR: A vulnerability in register allocation in JavaScript can lead to type confusion…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 18 Oct 2018