Advisories · Technology

Mozilla Firefox ESR.

Every CVE that names Mozilla Firefox ESR among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2023-6207 CVE record

Mozilla Firefox: Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 21 Nov 2023
CVE-2023-6206 CVE record

Mozilla Firefox: The black fade animation when exiting fullscreen is roughly the length of the…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 21 Nov 2023
CVE-2023-6205 CVE record

Mozilla Firefox: It was possible to cause the use of a MessagePort after it had already been freed…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 21 Nov 2023
CVE-2023-6204 CVE record

Mozilla Firefox: On some systems—depending on the graphics settings and drivers—it was possible to force…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 21 Nov 2023
CVE-2023-5732 CVE record

Address bar spoofing via bidirectional characters
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 24 Oct 2023
CVE-2023-5730 CVE record

Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 24 Oct 2023
CVE-2023-5728 CVE record

CVSS 7.5 High

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 24 Oct 2023
CVE-2023-5727 CVE record

Mozilla Firefox: The executable file warning was not presented when downloading .msix, .msixbundle, .appx…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 24 Oct 2023
CVE-2023-5726 CVE record

A website could have obscured the full screen notification by using the file open dialog.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 24 Oct 2023
CVE-2023-5725 CVE record

Mozilla Firefox: A malicious installed WebExtension could open arbitrary URLs…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 24 Oct 2023
CVE-2023-5724 CVE record

CVSS 7.5 High

Uncontrolled resource consumption in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Denial of service
Not analysed yet 24 Oct 2023
CVE-2023-5721 CVE record

Mozilla Firefox: It was possible for certain browser prompts and dialogs to be activated or dismissed…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 24 Oct 2023
CVE-2023-5176 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 27 Sept 2023
CVE-2023-5174 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 27 Sept 2023
CVE-2023-5171 CVE record

Mozilla Firefox: During Ion compilation, a Garbage Collection could have resulted in a use-after-free…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 27 Sept 2023
CVE-2023-5169 CVE record

Mozilla Firefox: A compromised content process could have provided malicious data in a `PathRecording`…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 27 Sept 2023
CVE-2023-5168 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 27 Sept 2023
CVE-2023-4585 CVE record

CVSS 8.8 High

Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 11 Sept 2023
CVE-2023-4584 CVE record

Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Sept 2023
CVE-2023-4583 CVE record

CVSS 7.5 High

Browsing Context potentially not cleared when closing Private Window
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-754
Not analysed yet 11 Sept 2023
CVE-2023-4582 CVE record

CVSS 8.8 High

Buffer Overflow in WebGL glGetProgramiv
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 11 Sept 2023
CVE-2023-4581 CVE record

XLL file extensions were downloadable without warnings
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Sept 2023
CVE-2023-4580 CVE record

Push notifications saved to disk unencrypted
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Sept 2023
CVE-2023-4578 CVE record

Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Sept 2023
CVE-2023-4577 CVE record

Memory corruption in JIT UpdateRegExpStatics
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Sept 2023
CVE-2023-4576 CVE record

Integer Overflow in RecordedSourceSurfaceCreation
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Sept 2023
CVE-2023-4575 CVE record

Memory corruption in IPC FilePickerShownCallback
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Sept 2023
CVE-2023-4574 CVE record

Memory corruption in IPC ColorPickerShownCallback
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Sept 2023
CVE-2023-4573 CVE record

Memory corruption in IPC CanvasTranslator
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 11 Sept 2023
CVE-2023-4057 CVE record

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 1 Aug 2023
CVE-2023-4056 CVE record

Mozilla Firefox: Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 1 Aug 2023
CVE-2023-4055 CVE record

Buffer overflow in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 1 Aug 2023
CVE-2023-4054 CVE record

Mozilla Firefox: When opening appref-ms files, Firefox did not warn the user that these files may contain…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 1 Aug 2023
CVE-2023-4053 CVE record

Full screen notification obscured by external program
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 1 Aug 2023
CVE-2023-4052 CVE record

The Firefox updater created a directory writable by non-privileged users.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 1 Aug 2023
CVE-2023-4051 CVE record

Full screen notification obscured by file open dialog
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 1 Aug 2023
CVE-2023-4050 CVE record

In some cases, an untrusted input stream was copied to a stack buffer without checking its size.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 1 Aug 2023
CVE-2023-4049 CVE record

Race conditions in reference counting code were found through code inspection.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 1 Aug 2023
CVE-2023-4048 CVE record

Mozilla Firefox: An out-of-bounds read could have led to an exploitable crash when parsing HTML with…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 1 Aug 2023
CVE-2023-4047 CVE record

Cross-site request forgery in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Cross-site request forgery (CSRF)
Not analysed yet 1 Aug 2023
CVE-2023-4046 CVE record

Resource allocation without limits in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Denial of service
Not analysed yet 1 Aug 2023
CVE-2023-4045 CVE record

Mozilla Firefox: Offscreen Canvas did not properly track cross-origin tainting…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 1 Aug 2023
CVE-2023-3600 CVE record

Use-after-free in workers
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 12 Jul 2023
CVE-2023-37211 CVE record

Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 5 Jul 2023
CVE-2023-37208 CVE record

Unrestricted file upload in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Unrestricted file upload
Not analysed yet 5 Jul 2023
CVE-2023-37207 CVE record

Mozilla Firefox: A website could have obscured the fullscreen notification by using a URL with a scheme…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 5 Jul 2023
CVE-2023-37202 CVE record

Mozilla Firefox: Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 5 Jul 2023
CVE-2023-37201 CVE record

Mozilla Firefox: An attacker could have triggered a use-after-free condition when creating a WebRTC…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 5 Jul 2023
CVE-2023-34416 CVE record

Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12.
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 19 Jun 2023
CVE-2023-34414 CVE record

Mozilla Firefox ESR: The error page for sites with invalid TLS certificates was missing the activation-delay…
- Mozilla Firefox ESR
- Mozilla Firefox
Not analysed yet 19 Jun 2023
CVE-2023-29545 CVE record

CVSS 6.5 Medium

Mozilla Firefox: Similar to CVE-2023-28163, this time when choosing 'Save Link As'…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 19 Jun 2023
CVE-2023-29542 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mozilla Firefox: A newline in a filename could have been used to bypass the file extension security…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 19 Jun 2023
CVE-2023-29532 CVE record

CVSS 5.5 Medium

Mozilla Firefox: A local attacker can trick the Mozilla Maintenance Service into applying an unsigned…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 19 Jun 2023
CVE-2023-29531 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 19 Jun 2023
CVE-2023-32214 CVE record

Mozilla Firefox: Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 19 Jun 2023
CVE-2023-32215 CVE record

Mozilla Firefox: Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-32213 CVE record

When reading a file, an uninitialized value could have been used as read limit.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-32212 CVE record

An attacker could have positioned a `datalist` element to obscure the address bar.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-32211 CVE record

A type checking bug would have led to invalid code being compiled.
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 2 Jun 2023
CVE-2023-32207 CVE record

CVSS 8.8 High

Authentication bypass by spoofing in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Authentication bypass
Not analysed yet 2 Jun 2023