Advisories · Technology

Mozilla Firefox ESR.

Every CVE that names Mozilla Firefox ESR among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2020-12420 CVE record

Mozilla Firefox ESR: When trying to connect to a STUN server…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 9 Jul 2020
CVE-2020-12419 CVE record

Mozilla Firefox ESR: When processing callbacks that occurred during window flushing in the parent process…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 9 Jul 2020
CVE-2020-12417 CVE record

Mozilla Firefox ESR: Due to confusion about ValueTags on JavaScript Objects…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 9 Jul 2020
CVE-2020-12418 CVE record

Mozilla Firefox ESR: Manipulating individual parts of a URL object could have caused an out-of-bounds read…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 9 Jul 2020
CVE-2018-12371 CVE record

Mozilla Firefox ESR: An integer overflow vulnerability in the Skia library when allocating memory for edge…
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 9 Jul 2020
CVE-2020-6831 CVE record

A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC.
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 26 May 2020
CVE-2020-12387 CVE record

A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability.
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 26 May 2020
CVE-2020-12388 CVE record

Mozilla Firefox ESR: The Firefox content processes did not sufficiently lockdown access control which could…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 26 May 2020
CVE-2020-12389 CVE record

Mozilla Firefox ESR: The Firefox content processes did not sufficiently lockdown access control which could…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 26 May 2020
CVE-2020-12392 CVE record

Mozilla Firefox ESR: The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 26 May 2020
CVE-2020-12393 CVE record

Mozilla Firefox ESR: The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 26 May 2020
CVE-2020-12395 CVE record

Mozilla Firefox ESR: Mozilla developers and community members reported memory safety bugs present in Firefox…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 26 May 2020
CVE-2020-6819 CVE record

CVSS 8.1 HighCritical · KEVKEV

Use after free in Mozilla Thunderbird and others
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 24 Apr 2020
CVE-2020-6820 CVE record

CVSS 8.1 HighCritical · KEVKEV

Race condition in Mozilla Thunderbird and others
- Mozilla Thunderbird
- Mozilla Firefox
- Race condition
Not analysed yet 24 Apr 2020
CVE-2020-6821 CVE record

Mozilla Thunderbird: When reading from areas partially or fully outside the source resource with WebGL's…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 24 Apr 2020
CVE-2020-6822 CVE record

Mozilla Thunderbird: On 32-bit builds, an out of bounds write could have occurred when processing an image…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 24 Apr 2020
CVE-2020-6825 CVE record

Mozilla Thunderbird: Mozilla developers and community members Tyson Smith and Christian Holler reported memory…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 24 Apr 2020
CVE-2020-6827 CVE record

Mozilla Firefox ESR: When following a link that opened an intent://-schemed URL…
- Mozilla Firefox ESR
Not analysed yet 24 Apr 2020
CVE-2020-6828 CVE record

Mozilla Firefox ESR: A malicious Android application could craft an Intent that would have been processed by…
- Mozilla Firefox ESR
Not analysed yet 24 Apr 2020
CVE-2020-6805 CVE record

Mozilla Thunderbird: When removing data about an origin whose tab was recently closed…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 25 Mar 2020
CVE-2020-6806 CVE record

Mozilla Thunderbird: By carefully crafting promise resolutions…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 25 Mar 2020
CVE-2020-6807 CVE record

Mozilla Thunderbird: When a device was changed while a stream was about to be destroyed…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 25 Mar 2020
CVE-2020-6811 CVE record

Mozilla Thunderbird: The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 25 Mar 2020
CVE-2020-6812 CVE record

Mozilla Thunderbird: The first time AirPods are connected to an iPhone…
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 25 Mar 2020
CVE-2020-6814 CVE record

Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5.
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 25 Mar 2020
CVE-2019-17026 CVE record

CVSS 8.8 HighCritical · KEV, CVSS 7+ and EPSSKEV

Type confusion in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 2 Mar 2020
CVE-2019-9812 CVE record

Mozilla Firefox ESR: Given a compromised sandboxed content process due to a separate vulnerability…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 8 Jan 2020
CVE-2019-17024 CVE record

Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3.
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 8 Jan 2020
CVE-2019-17022 CVE record

Mozilla Firefox ESR: When pasting a <style> tag from the clipboard into a rich text editor…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 8 Jan 2020
CVE-2019-17021 CVE record

Mozilla Firefox ESR: During the initialization of a new content process…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 8 Jan 2020
CVE-2019-17017 CVE record

Mozilla Firefox ESR: Due to a missing case handling object types, a type confusion vulnerability could occur…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 8 Jan 2020
CVE-2019-17016 CVE record

Mozilla Firefox ESR: When pasting a <style> tag from the clipboard into a rich text editor…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 8 Jan 2020
CVE-2019-17015 CVE record

Mozilla Firefox ESR: During the initialization of a new content process…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 8 Jan 2020
CVE-2019-17012 CVE record

Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 8 Jan 2020
CVE-2019-17011 CVE record

Mozilla Thunderbird: Under certain conditions, when retrieving a document from a DocShell in the antitracking…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 8 Jan 2020
CVE-2019-17010 CVE record

Mozilla Thunderbird: Under certain conditions, when checking the Resist Fingerprinting preference during…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 8 Jan 2020
CVE-2019-17009 CVE record

Mozilla Thunderbird: When running, the updater service wrote status and log files to an unrestricted location…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 8 Jan 2020
CVE-2019-17008 CVE record

When using nested workers, a use-after-free could occur during worker destruction.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 8 Jan 2020
CVE-2019-17005 CVE record

Mozilla Thunderbird: The plain text serializer used a fixed-size array for the number of <ol> elements it…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 8 Jan 2020
CVE-2019-11764 CVE record

Mozilla Firefox: Mozilla developers and community members reported memory safety bugs present in Firefox…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 8 Jan 2020
CVE-2019-11763 CVE record

Mozilla Firefox: Failure to correctly handle null bytes when processing HTML entities resulted in Firefox…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 8 Jan 2020
CVE-2019-11762 CVE record

Mozilla Firefox: If two same-origin documents set document.domain differently to become cross-origin…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 8 Jan 2020
CVE-2019-11761 CVE record

Mozilla Firefox: By using a form with a data URI it was possible to gain access to the privileged JSONView…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 8 Jan 2020
CVE-2019-11760 CVE record

A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling.
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 8 Jan 2020
CVE-2019-11759 CVE record

Mozilla Firefox: An attacker could have caused 4 bytes of HMAC output to be written past the end of a…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 8 Jan 2020
CVE-2019-11758 CVE record

Mozilla Firefox: Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 8 Jan 2020
CVE-2019-11757 CVE record

Mozilla Firefox: When following the value's prototype chain…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 8 Jan 2020
CVE-2019-11745 CVE record

Mozilla Thunderbird: When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 8 Jan 2020
CVE-2019-11733 CVE record

Mozilla Firefox: When a master password is set, it is required to be entered again before stored passwords…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 27 Sept 2019
CVE-2019-11735 CVE record

Mozilla Firefox: Mozilla developers and community members reported memory safety bugs present in Firefox…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 27 Sept 2019
CVE-2019-11736 CVE record

Mozilla Firefox: The Mozilla Maintenance Service does not guard against files being hardlinked to another…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 27 Sept 2019
CVE-2019-11738 CVE record

Mozilla Firefox: If a Content Security Policy (CSP) directive is defined that uses a hash-based source…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 27 Sept 2019
CVE-2019-11740 CVE record

Mozilla Firefox: Mozilla developers and community members reported memory safety bugs present in Firefox…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 27 Sept 2019
CVE-2019-11742 CVE record

Mozilla Firefox: A same-origin policy violation occurs allowing the theft of cross-origin images through a…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 27 Sept 2019
CVE-2019-11743 CVE record

Mozilla Firefox: Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 27 Sept 2019
CVE-2019-11744 CVE record

Mozilla Firefox: Some HTML elements, such as <title> and <textarea&gt…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 27 Sept 2019
CVE-2019-11746 CVE record

Mozilla Firefox: A use-after-free vulnerability can occur while manipulating video elements if the body is…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 27 Sept 2019
CVE-2019-11747 CVE record

Mozilla Firefox: The "Forget about this site" feature in the History pane is intended to remove all saved…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 27 Sept 2019
CVE-2019-11748 CVE record

Mozilla Firefox: WebRTC in Firefox will honor persisted permissions given to sites for access to…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 27 Sept 2019
CVE-2019-11749 CVE record

Mozilla Firefox: A vulnerability exists in WebRTC where malicious web content can use probing techniques…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 27 Sept 2019