Advisories · Technology
Mozilla Firefox ESR.
Every CVE that names Mozilla Firefox ESR among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Mozilla Firefox: On Windows 10, when using the 'Save As' functionality…
- Mozilla Firefox
- Mozilla Firefox ESR
- CVSS 4.7 Medium
Protection mechanism failure in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-693
- CVSS 4.3 Medium
Observable discrepancy in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Information disclosure
- CVSS 8.1 High
Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
- CVSS 7.5 High
Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
- CVSS 7.5 High
Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
- CVSS 8.8 High
Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
- CVSS 5.9 Medium
Mozilla Firefox: When importing resources using Web Workers…
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-351
- CVSS 6.1 Medium
Mozilla Firefox: A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to…
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-281
- CVSS 4.3 Medium
Exposure of personal information in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Information disclosure
- CVSS 8.1 High
Buffer overflow in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
- CVSS 3.7 Low
Resource allocation without limits in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Denial of service
- CVSS 9.8 CriticalCritical · CVSS 9+
Unrestricted file upload in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Unrestricted file upload
- CVSS 4.0 Medium
Mozilla Firefox: If an AlignedBuffer were assigned to itself…
- Mozilla Firefox
- Mozilla Firefox ESR
- CVSS 5.9 Medium
Integer overflow in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
- CVSS 7.8 High
Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
- CVSS 8.8 High
Out-of-bounds read in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
- CVSS 7.5 High
GetBoundName could return the wrong version of an object when JIT optimizations were applied.
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-386
- CVSS 8.4 High
Mozilla Firefox: An attacker was able to inject an event handler into a privileged object that would allow…
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-830
- CVSS 2.7 Low
Mozilla Firefox ESR: To harden ICU against exploitation, the behavior for out-of-memory conditions was changed…
- Mozilla Firefox ESR
- Mozilla Thunderbird
- CVSS 8.8 High
Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
- CVSS 8.1 High
Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
- CVSS 5.5 Medium
Mozilla Firefox: A missing delay on when pointer lock was used could have allowed a malicious page to…
- Mozilla Firefox
- Mozilla Firefox ESR
- CVSS 6.1 Medium
Code injection in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Code injection
- CVSS 6.1 Medium
The permission prompt input delay could expire while the window is not in focus.
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-356
- CVSS 6.5 Medium
NSS was susceptible to a timing side-channel attack when performing RSA decryption.
- Mozilla Firefox
- Mozilla Firefox ESR
- CVSS 8.4 High
Mozilla Firefox: `AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and…
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
- CVSS 8.1 High
Mozilla Firefox: Return registers were overwritten which could have allowed an attacker to execute…
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-123
- CVSS 5.9 Medium
Mozilla Firefox: An attacker could have leveraged the Windows Error Reporter to run arbitrary code on the…
- Mozilla Firefox
- Mozilla Firefox ESR
- CVSS 8.1 High
Buffer overflow in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
- CVSS 7.5 High
Incorrect numeric conversion in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-681
- CVSS 6.1 Medium
Set-Cookie response headers were being incorrectly honored in multipart HTTP responses.
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-565
- CVSS 6.1 Medium
Clickjacking in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-1021
- CVSS 6.1 Medium
Mozilla Firefox: If a website set a large custom cursor…
- Mozilla Firefox
- Mozilla Firefox ESR
- CVSS 4.3 Medium
A website could have obscured the fullscreen notification by using a dropdown select input element.
- Mozilla Firefox
- Mozilla Firefox ESR
- CVSS 6.5 Medium
Authentication bypass by spoofing in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Authentication bypass
- CVSS 7.5 High
Out-of-bounds read in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
- CVSS 7.5 High
Unchecked return value in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-252
- CVSS 8.8 High
Code injection in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Code injection
- CVSS 6.5 Medium
In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain.
- Mozilla Firefox
- Mozilla Firefox ESR
- CVSS 8.8 High
Improper privilege management in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Privilege escalation
- CVSS 8.8 High
Mozilla Firefox: A bug in popup notifications delay calculation could have made it possible for an…
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-451
- CVSS 6.5 Medium
Protection mechanism failure in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-693
- CVSS 6.5 Medium
Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
- CVSS 4.3 Medium
Mozilla Firefox: It was possible for certain browser prompts and dialogs to be activated or dismissed…
- Mozilla Firefox
- Mozilla Firefox ESR
- CVSS 6.5 Medium
Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
-
Mozilla Firefox ESR: The timing of a button click causing a popup to disappear was approximately the same…
- Mozilla Firefox ESR
- Mozilla Firefox
-
`EncryptingOutputStream` was susceptible to exposing uninitialized data.
- Mozilla Firefox ESR
- Mozilla Firefox
-
Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5.
- Mozilla Firefox ESR
- Mozilla Thunderbird
-
Mozilla Firefox ESR: The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its…
- Mozilla Firefox ESR
- Mozilla Thunderbird
-
A use-after-free was identified in the `nsDNSService::Init`.
- Mozilla Firefox ESR
- Mozilla Thunderbird
-
Mozilla Firefox ESR: The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when…
- Mozilla Firefox ESR
- Mozilla Thunderbird
-
The `VideoBridge` allowed any content process to use textures produced by remote decoders.
- Mozilla Firefox ESR
- Mozilla Thunderbird
-
A use-after-free condition affected TLS socket creation when under memory pressure.
- Mozilla Firefox ESR
- Mozilla Thunderbird
- CVSS 8.8 High
Out-of-bounds write in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Memory corruption
-
Mozilla Firefox ESR: When resolving a symlink, a race may occur where the buffer passed to `readlink` may…
- Mozilla Firefox ESR
- Mozilla Thunderbird
-
Mozilla Firefox ESR: The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when…
- Mozilla Firefox ESR
- Mozilla Thunderbird
-
Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4.
- Mozilla Firefox
- Mozilla Firefox ESR
-
Mozilla Firefox: Relative URLs starting with three slashes were incorrectly parsed…
- Mozilla Firefox
- Mozilla Firefox ESR
-
Mozilla Firefox: When using X11, text selected by the page using the Selection API was erroneously copied…
- Mozilla Firefox
- Mozilla Firefox ESR