Advisories · Technology

Mozilla Firefox ESR.

Every CVE that names Mozilla Firefox ESR among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2022-22748 CVE record

CVSS 6.5 Medium

Cross-site scripting in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Firefox
- Cross-site scripting (XSS)
Not analysed yet 22 Dec 2022
CVE-2022-22747 CVE record

CVSS 6.5 Medium

Improper certificate validation in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Firefox
- Weak cryptography or TLS
Not analysed yet 22 Dec 2022
CVE-2022-22746 CVE record

CVSS 5.9 Medium

Race condition in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Firefox
- Race condition
Not analysed yet 22 Dec 2022
CVE-2022-22745 CVE record

CVSS 6.5 Medium

Information disclosure in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Firefox
- Information disclosure
Not analysed yet 22 Dec 2022
CVE-2022-22744 CVE record

CVSS 8.8 High

Improper output encoding in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Firefox
- CWE-116
Not analysed yet 22 Dec 2022
CVE-2022-22743 CVE record

CVSS 4.3 Medium

Mozilla Firefox ESR: When navigating from inside an iframe while requesting fullscreen access…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 22 Dec 2022
CVE-2022-22742 CVE record

CVSS 6.5 Medium

Out-of-bounds read in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Firefox
- Memory corruption
Not analysed yet 22 Dec 2022
CVE-2022-22741 CVE record

CVSS 7.5 High

Mozilla Firefox ESR: When resizing a popup while requesting fullscreen access…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 22 Dec 2022
CVE-2022-22740 CVE record

CVSS 8.8 High

Use after free in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Firefox
- Memory corruption
Not analysed yet 22 Dec 2022
CVE-2022-22739 CVE record

CVSS 6.5 Medium

Mozilla Firefox ESR: Malicious websites could have tricked users into accepting launching a program to handle…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 22 Dec 2022
CVE-2022-22738 CVE record

CVSS 8.8 High

Out-of-bounds write in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Firefox
- Memory corruption
Not analysed yet 22 Dec 2022
CVE-2022-22737 CVE record

CVSS 7.5 High

Race condition in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Firefox
- Race condition
Not analysed yet 22 Dec 2022
CVE-2022-2200 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

Prototype pollution in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Prototype pollution
Not analysed yet 22 Dec 2022
CVE-2022-1802 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

Prototype pollution in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Firefox
- Prototype pollution
Not analysed yet 22 Dec 2022
CVE-2022-1529 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

Prototype pollution in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Firefox
- Prototype pollution
Not analysed yet 22 Dec 2022
CVE-2022-1196 CVE record

CVSS 6.5 Medium

Use after free in Mozilla Thunderbird and others
- Mozilla Thunderbird
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 22 Dec 2022
CVE-2022-1097 CVE record

CVSS 6.5 Medium

Use after free in Mozilla Thunderbird and others
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 22 Dec 2022
CVE-2021-4140 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

XML injection in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Firefox
- Other injection
Not analysed yet 22 Dec 2022
CVE-2021-4129 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 22 Dec 2022
CVE-2021-4127 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mozilla Thunderbird: An out of date graphics library (Angle) likely contained vulnerabilities that could…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 22 Dec 2022
CVE-2021-38503 CVE record

Mozilla Firefox: The iframe sandbox rules were not correctly applied to XSLT stylesheets…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 8 Dec 2021
CVE-2021-38504 CVE record

Mozilla Firefox: When interacting with an HTML input element's file picker dialog with webkitdirectory…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 8 Dec 2021
CVE-2021-38505 CVE record

Mozilla Firefox: Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 8 Dec 2021
CVE-2021-38506 CVE record

Mozilla Firefox: Through a series of navigations, Firefox could have entered fullscreen mode without…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 8 Dec 2021
CVE-2021-38507 CVE record

Mozilla Firefox: The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 8 Dec 2021
CVE-2021-38508 CVE record

Mozilla Firefox: By displaying a form validity message in the correct location at the same time as a…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 8 Dec 2021
CVE-2021-38509 CVE record

Mozilla Firefox: Due to an unusual sequence of attacker-controlled events…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 8 Dec 2021
CVE-2021-38510 CVE record

Mozilla Firefox: The executable file warning was not presented when downloading .inetloc files, which…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 8 Dec 2021
CVE-2021-43534 CVE record

Mozilla Firefox: Mozilla developers and community members reported memory safety bugs present in Firefox…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 8 Dec 2021
CVE-2021-43535 CVE record

Mozilla Firefox: A use-after-free could have occured when an HTTP2 session object was released on a…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 8 Dec 2021
CVE-2021-43536 CVE record

Mozilla Thunderbird: Under certain circumstances, asynchronous functions could have caused a navigation to…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 8 Dec 2021
CVE-2021-43537 CVE record

Mozilla Thunderbird: An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 8 Dec 2021
CVE-2021-43538 CVE record

Mozilla Thunderbird: By misusing a race in our notification code…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 8 Dec 2021
CVE-2021-43539 CVE record

Mozilla Thunderbird: Failure to correctly record the location of live pointers across wasm instance calls…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 8 Dec 2021
CVE-2021-43541 CVE record

Mozilla Thunderbird: When invoking protocol handlers for external protocols…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 8 Dec 2021
CVE-2021-43542 CVE record

Mozilla Thunderbird: Using XMLHttpRequest, an attacker could have identified installed applications by probing…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 8 Dec 2021
CVE-2021-43543 CVE record

Mozilla Thunderbird: Documents loaded with the CSP sandbox directive could have escaped the sandbox's script…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 8 Dec 2021
CVE-2021-43545 CVE record

Using the Location API in a loop could have caused severe application hangs and crashes.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 8 Dec 2021
CVE-2021-43546 CVE record

Mozilla Thunderbird: It was possible to recreate previous cursor spoofing attacks against users with a zoomed…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 8 Dec 2021
CVE-2021-38492 CVE record

Mozilla Firefox: When delegating navigations to the operating system…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 3 Nov 2021
CVE-2021-38493 CVE record

Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13.
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 3 Nov 2021
CVE-2021-38495 CVE record

Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 3 Nov 2021
CVE-2021-38496 CVE record

Mozilla Thunderbird: During operations on MessageTasks, a task may have been removed while it was still…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 3 Nov 2021
CVE-2021-38497 CVE record

Mozilla Firefox: Through use of reportValidity() and window.open()…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 3 Nov 2021
CVE-2021-38498 CVE record

Mozilla Firefox: During process shutdown, a document could have caused a use-after-free of a languages…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 3 Nov 2021
CVE-2021-38500 CVE record

Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 3 Nov 2021
CVE-2021-38501 CVE record

Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1.
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 3 Nov 2021
CVE-2021-29980 CVE record

Mozilla Thunderbird: Uninitialized memory in a canvas object could have caused an incorrect free() leading to…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 17 Aug 2021
CVE-2021-29984 CVE record

Mozilla Thunderbird: Instruction reordering resulted in a sequence of instructions that would cause an object…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 17 Aug 2021
CVE-2021-29985 CVE record

Mozilla Thunderbird: A use-after-free vulnerability in media channels could have led to memory corruption and…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 17 Aug 2021
CVE-2021-29986 CVE record

Mozilla Thunderbird: A suspected race condition when calling getaddrinfo led to memory corruption and a…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 17 Aug 2021
CVE-2021-29988 CVE record

Mozilla Thunderbird: Firefox incorrectly treated an inline list-item element as a block element…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 17 Aug 2021
CVE-2021-29989 CVE record

Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12.
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 17 Aug 2021
CVE-2021-29970 CVE record

Mozilla Thunderbird: A malicious webpage could have triggered a use-after-free, memory corruption…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 5 Aug 2021
CVE-2021-29976 CVE record

Mozilla Thunderbird: Mozilla developers reported memory safety bugs present in code shared between Firefox and…
- Mozilla Thunderbird
- Mozilla Firefox ESR
Not analysed yet 5 Aug 2021
CVE-2021-23994 CVE record

Mozilla Firefox ESR: A WebGL framebuffer was not initialized early enough…
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 24 Jun 2021
CVE-2021-23995 CVE record

When Responsive Design Mode was enabled, it used references to objects that were previously freed.
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 24 Jun 2021
CVE-2021-23998 CVE record

Mozilla Firefox ESR: Through complicated navigations with new windows…
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 24 Jun 2021
CVE-2021-23999 CVE record

Mozilla Firefox ESR: If a Blob URL was loaded through some unusual user interaction…
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 24 Jun 2021
CVE-2021-24002 CVE record

Mozilla Firefox ESR: When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D)…
- Mozilla Firefox ESR
- Mozilla Thunderbird
Not analysed yet 24 Jun 2021