Advisories · Technology

Mozilla Firefox ESR.

Every CVE that names Mozilla Firefox ESR among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2023-32206 CVE record

An out-of-bound read could have led to a crash in the RLBox Expat driver.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-32205 CVE record

In multiple cases browser prompts could have been obscured by popups controlled by content.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-29550 CVE record

CVSS 8.8 High

Memory safety bugs present in Firefox 111 and Firefox ESR 102.9.
- Mozilla Firefox
- Mozilla Focus for Android
Not analysed yet 2 Jun 2023
CVE-2023-29548 CVE record

CVSS 6.5 Medium

A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.
- Mozilla Firefox
- Mozilla Focus for Android
Not analysed yet 2 Jun 2023
CVE-2023-29541 CVE record

CVSS 8.8 High

Improper output encoding in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Focus for Android
- CWE-116
Not analysed yet 2 Jun 2023
CVE-2023-29539 CVE record

Mozilla Firefox: When handling the filename directive in the Content-Disposition header…
- Mozilla Firefox
- Mozilla Focus for Android
Not analysed yet 2 Jun 2023
CVE-2023-29536 CVE record

Mozilla Firefox: An attacker could cause the memory manager to incorrectly free a pointer that addresses…
- Mozilla Firefox
- Mozilla Focus for Android
Not analysed yet 2 Jun 2023
CVE-2023-29535 CVE record

Mozilla Firefox: Following a Garbage Collector compaction…
- Mozilla Firefox
- Mozilla Focus for Android
Not analysed yet 2 Jun 2023
CVE-2023-29533 CVE record

Mozilla Firefox: A website could have obscured the fullscreen notification by using a combination of…
- Mozilla Firefox
- Mozilla Focus for Android
Not analysed yet 2 Jun 2023
CVE-2023-28176 CVE record

CVSS 8.8 High

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 2 Jun 2023
CVE-2023-28164 CVE record

CVSS 6.5 Medium

Origin validation error in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-346
Not analysed yet 2 Jun 2023
CVE-2023-28163 CVE record

CVSS 6.5 Medium

Path traversal in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Path traversal
Not analysed yet 2 Jun 2023
CVE-2023-28162 CVE record

CVSS 8.8 High

Type confusion in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 2 Jun 2023
CVE-2023-25752 CVE record

Mozilla Firefox: When accessing throttled streams, the count of available bytes needed to be checked in…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-25751 CVE record

Mozilla Firefox: Sometimes, when invalidating JIT code while following an iterator…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-25746 CVE record

CVSS 8.8 High

Out-of-bounds write in Mozilla Thunderbird and others
- Mozilla Thunderbird
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 2 Jun 2023
CVE-2023-25744 CVE record

Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-25743 CVE record

Mozilla Firefox: A lack of in app notification for entering fullscreen mode could have lead to a malicious…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-25742 CVE record

Mozilla Firefox: When importing a SPKI RSA public key as ECDSA P-256…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 2 Jun 2023
CVE-2023-25739 CVE record

CVSS 8.8 High

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 2 Jun 2023
CVE-2023-25738 CVE record

CVSS 6.5 Medium

Out-of-bounds read in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 2 Jun 2023
CVE-2023-25737 CVE record

CVSS 8.8 High

Incorrect type conversion in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-704
Not analysed yet 2 Jun 2023
CVE-2023-25735 CVE record

CVSS 8.8 High

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 2 Jun 2023
CVE-2023-25734 CVE record

CVSS 8.1 High

Open redirect in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Open redirect
Not analysed yet 2 Jun 2023
CVE-2023-25732 CVE record

CVSS 8.8 High

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 2 Jun 2023
CVE-2023-25730 CVE record

CVSS 5.4 Medium

Clickjacking in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
Not analysed yet 2 Jun 2023
CVE-2023-25729 CVE record

CVSS 8.8 High

Incorrect authorization in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
Not analysed yet 2 Jun 2023
CVE-2023-25728 CVE record

CVSS 6.5 Medium

Observable discrepancy in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 2 Jun 2023
CVE-2023-23605 CVE record

CVSS 8.8 High

Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 2 Jun 2023
CVE-2023-23603 CVE record

CVSS 6.5 Medium

Calls to console.log allowed bypassing Content Security Policy via format directive
- Mozilla Firefox
- Mozilla Firefox ESR
- Denial of service
Not analysed yet 2 Jun 2023
CVE-2023-23602 CVE record

CVSS 6.5 Medium

Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-754
Not analysed yet 2 Jun 2023
CVE-2023-23601 CVE record

URL being dragged from cross-origin iframe into same tab triggers navigation
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-23599 CVE record

Malicious command could be hidden in devtools output on Windows
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-23598 CVE record

Arbitrary file read from GTK drag and drop on Linux
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-1945 CVE record

CVSS 6.5 Medium

Out-of-bounds write in Mozilla Thunderbird and others
- Mozilla Thunderbird
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 2 Jun 2023
CVE-2023-0767 CVE record

CVSS 8.8 High

Mozilla Firefox: An attacker could construct a PKCS 12 cert bundle in such a way that could allow for…
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 2 Jun 2023
CVE-2020-12413 CVE record

CVSS 5.9 Medium

Observable discrepancy in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Information disclosure
Not analysed yet 16 Feb 2023
CVE-2022-46882 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 22 Dec 2022
CVE-2022-46881 CVE record

CVSS 8.8 High

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 22 Dec 2022
CVE-2022-46880 CVE record

CVSS 6.5 Medium

Use after free in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Firefox
- Memory corruption
Not analysed yet 22 Dec 2022
CVE-2022-46878 CVE record

CVSS 8.8 High

Mozilla Firefox: Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 22 Dec 2022
CVE-2022-46875 CVE record

CVSS 6.5 Medium

Improper authentication in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Authentication bypass
Not analysed yet 22 Dec 2022
CVE-2022-46874 CVE record

CVSS 8.8 High

Code injection in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Code injection
Not analysed yet 22 Dec 2022
CVE-2022-46872 CVE record

CVSS 8.6 High

Out-of-bounds read in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 22 Dec 2022
CVE-2022-45421 CVE record

CVSS 8.8 High

Out-of-bounds write in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 22 Dec 2022
CVE-2022-45420 CVE record

CVSS 6.5 Medium

Clickjacking in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- CWE-1021
Not analysed yet 22 Dec 2022
CVE-2022-45418 CVE record

CVSS 6.1 Medium

Clickjacking in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- CWE-1021
Not analysed yet 22 Dec 2022
CVE-2022-45416 CVE record

CVSS 6.5 Medium

Observable discrepancy in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 22 Dec 2022
CVE-2022-45412 CVE record

CVSS 8.8 High

Symlink following in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Path traversal
Not analysed yet 22 Dec 2022
CVE-2022-45411 CVE record

CVSS 6.1 Medium

Cross-site scripting in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Cross-site scripting (XSS)
Not analysed yet 22 Dec 2022
CVE-2022-45410 CVE record

CVSS 6.5 Medium

Missing authorization in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Broken access control
Not analysed yet 22 Dec 2022
CVE-2022-45409 CVE record

CVSS 8.8 High

Use after free in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 22 Dec 2022
CVE-2022-45408 CVE record

CVSS 6.5 Medium

Cross-site scripting in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Cross-site scripting (XSS)
Not analysed yet 22 Dec 2022
CVE-2022-45406 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use after free in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 22 Dec 2022
CVE-2022-45405 CVE record

CVSS 6.5 Medium

Use after free in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 22 Dec 2022
CVE-2022-45404 CVE record

CVSS 6.5 Medium

Mozilla Firefox ESR: Through a series of popup and <code>window.print()</code> calls…
- Mozilla Firefox ESR
- Mozilla Thunderbird
- CWE-451
Not analysed yet 22 Dec 2022
CVE-2022-45403 CVE record

CVSS 6.5 Medium

Observable discrepancy in Mozilla Firefox ESR and others
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 22 Dec 2022
CVE-2022-42932 CVE record

CVSS 8.8 High

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 22 Dec 2022
CVE-2022-42929 CVE record

CVSS 6.5 Medium

Uncontrolled resource consumption in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Denial of service
Not analysed yet 22 Dec 2022
CVE-2022-42928 CVE record

CVSS 8.8 High

NULL pointer dereference in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 22 Dec 2022