# Mozilla Firefox.

Every CVE that names Mozilla Firefox among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Mozilla Firefox ESR: Due to confusion about ValueTags on JavaScript Objects…](https://agentprime.io/advisories/CVE-2020-12417.md)
  `CVE-2020-12417` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 9 Jul 2020
- [Mozilla Firefox: When "%2F" was present in a manifest URL…](https://agentprime.io/advisories/CVE-2020-12415.md)
  `CVE-2020-12415` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 9 Jul 2020
- [Mozilla developers and community members reported memory safety bugs present in Firefox 77.](https://agentprime.io/advisories/CVE-2020-12426.md)
  `CVE-2020-12426` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 9 Jul 2020
- [Mozilla Firefox ESR: Manipulating individual parts of a URL object could have caused an out-of-bounds read…](https://agentprime.io/advisories/CVE-2020-12418.md)
  `CVE-2020-12418` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 9 Jul 2020
- [When constructing a permission prompt for WebRTC, a URI was supplied from the content process.](https://agentprime.io/advisories/CVE-2020-12424.md)
  `CVE-2020-12424` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 9 Jul 2020
- [Mozilla Firefox ESR: An integer overflow vulnerability in the Skia library when allocating memory for edge…](https://agentprime.io/advisories/CVE-2018-12371.md)
  `CVE-2018-12371` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 9 Jul 2020
- [A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC.](https://agentprime.io/advisories/CVE-2020-6831.md)
  `CVE-2020-6831` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 26 May 2020
- [A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability.](https://agentprime.io/advisories/CVE-2020-12387.md)
  `CVE-2020-12387` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 26 May 2020
- [Mozilla Firefox ESR: The Firefox content processes did not sufficiently lockdown access control which could…](https://agentprime.io/advisories/CVE-2020-12388.md)
  `CVE-2020-12388` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 26 May 2020
- [Mozilla Firefox ESR: The Firefox content processes did not sufficiently lockdown access control which could…](https://agentprime.io/advisories/CVE-2020-12389.md)
  `CVE-2020-12389` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 26 May 2020
- [Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks.](https://agentprime.io/advisories/CVE-2020-12390.md)
  `CVE-2020-12390` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 26 May 2020
- [Mozilla Firefox: Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the…](https://agentprime.io/advisories/CVE-2020-12391.md)
  `CVE-2020-12391` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 26 May 2020
- [Mozilla Firefox ESR: The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST…](https://agentprime.io/advisories/CVE-2020-12392.md)
  `CVE-2020-12392` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 26 May 2020
- [Mozilla Firefox ESR: The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP…](https://agentprime.io/advisories/CVE-2020-12393.md)
  `CVE-2020-12393` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 26 May 2020
- [Mozilla Firefox: A logic flaw in our location bar implementation could have allowed a local attacker to…](https://agentprime.io/advisories/CVE-2020-12394.md)
  `CVE-2020-12394` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 26 May 2020
- [Mozilla Firefox ESR: Mozilla developers and community members reported memory safety bugs present in Firefox…](https://agentprime.io/advisories/CVE-2020-12395.md)
  `CVE-2020-12395` · CVE record: Mozilla Firefox ESR and 2 more · No CVSS score · Not analysed yet · Published 26 May 2020
- [Mozilla developers and community members reported memory safety bugs present in Firefox 75.](https://agentprime.io/advisories/CVE-2020-12396.md)
  `CVE-2020-12396` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 26 May 2020
- [Use after free in Mozilla Thunderbird and others](https://agentprime.io/advisories/CVE-2020-6819.md)
  `CVE-2020-6819` · CVE record: Mozilla Thunderbird and 2 more · CVSS 8.1 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 24 Apr 2020 · Tags: Memory corruption
- [Race condition in Mozilla Thunderbird and others](https://agentprime.io/advisories/CVE-2020-6820.md)
  `CVE-2020-6820` · CVE record: Mozilla Thunderbird and 2 more · CVSS 8.1 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 24 Apr 2020 · Tags: Race condition
- [Mozilla Thunderbird: When reading from areas partially or fully outside the source resource with WebGL's…](https://agentprime.io/advisories/CVE-2020-6821.md)
  `CVE-2020-6821` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 24 Apr 2020
- [Mozilla Thunderbird: On 32-bit builds, an out of bounds write could have occurred when processing an image…](https://agentprime.io/advisories/CVE-2020-6822.md)
  `CVE-2020-6822` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 24 Apr 2020
- [Mozilla Firefox: A malicious extension could have called \<code>browser.identity.launchWebAuthFlow\</code>…](https://agentprime.io/advisories/CVE-2020-6823.md)
  `CVE-2020-6823` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 24 Apr 2020
- [Mozilla Firefox: Initially, a user opens a Private Browsing Window and generates a password for a site…](https://agentprime.io/advisories/CVE-2020-6824.md)
  `CVE-2020-6824` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 24 Apr 2020
- [Mozilla Firefox: Mozilla developers Tyson Smith, Bob Clary…](https://agentprime.io/advisories/CVE-2020-6826.md)
  `CVE-2020-6826` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 24 Apr 2020
- [Mozilla Thunderbird: Mozilla developers and community members Tyson Smith and Christian Holler reported memory…](https://agentprime.io/advisories/CVE-2020-6825.md)
  `CVE-2020-6825` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 24 Apr 2020
- [Mozilla Thunderbird: When removing data about an origin whose tab was recently closed…](https://agentprime.io/advisories/CVE-2020-6805.md)
  `CVE-2020-6805` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 25 Mar 2020
- [Mozilla Thunderbird: By carefully crafting promise resolutions…](https://agentprime.io/advisories/CVE-2020-6806.md)
  `CVE-2020-6806` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 25 Mar 2020
- [Mozilla Thunderbird: When a device was changed while a stream was about to be destroyed…](https://agentprime.io/advisories/CVE-2020-6807.md)
  `CVE-2020-6807` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 25 Mar 2020
- [Mozilla Firefox: When a JavaScript URL (javascript:) is evaluated and the result is a string…](https://agentprime.io/advisories/CVE-2020-6808.md)
  `CVE-2020-6808` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 25 Mar 2020
- [Mozilla Firefox: When a Web Extension had the all-urls permission and made a fetch request with a mode set…](https://agentprime.io/advisories/CVE-2020-6809.md)
  `CVE-2020-6809` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 25 Mar 2020
- [Mozilla Firefox: After a website had entered fullscreen mode…](https://agentprime.io/advisories/CVE-2020-6810.md)
  `CVE-2020-6810` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 25 Mar 2020
- [Mozilla Thunderbird: The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP…](https://agentprime.io/advisories/CVE-2020-6811.md)
  `CVE-2020-6811` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 25 Mar 2020
- [Mozilla Thunderbird: The first time AirPods are connected to an iPhone…](https://agentprime.io/advisories/CVE-2020-6812.md)
  `CVE-2020-6812` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 25 Mar 2020
- [Mozilla Firefox: When protecting CSS blocks with the nonce feature of Content Security Policy…](https://agentprime.io/advisories/CVE-2020-6813.md)
  `CVE-2020-6813` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 25 Mar 2020
- [Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5.](https://agentprime.io/advisories/CVE-2020-6814.md)
  `CVE-2020-6814` · CVE record: Mozilla Thunderbird and 2 more · No CVSS score · Not analysed yet · Published 25 Mar 2020
- [Mozilla developers reported memory safety and script safety bugs present in Firefox 73.](https://agentprime.io/advisories/CVE-2020-6815.md)
  `CVE-2020-6815` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 25 Mar 2020
- [Mozilla developers reported memory safety bugs present in Firefox 72.](https://agentprime.io/advisories/CVE-2020-6801.md)
  `CVE-2020-6801` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 2 Mar 2020
- [Mozilla Thunderbird: Mozilla developers and community members reported memory safety bugs present in Firefox…](https://agentprime.io/advisories/CVE-2020-6800.md)
  `CVE-2020-6800` · CVE record: Mozilla Thunderbird and 1 more · No CVSS score · Not analysed yet · Published 2 Mar 2020
- [Mozilla Firefox: Command line arguments could have been injected during Firefox invocation as a shell…](https://agentprime.io/advisories/CVE-2020-6799.md)
  `CVE-2020-6799` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 2 Mar 2020
- [Mozilla Thunderbird: If a template tag was used in a select tag…](https://agentprime.io/advisories/CVE-2020-6798.md)
  `CVE-2020-6798` · CVE record: Mozilla Thunderbird and 1 more · No CVSS score · Not analysed yet · Published 2 Mar 2020
- [Mozilla Thunderbird: By downloading a file with the .fileloc extension…](https://agentprime.io/advisories/CVE-2020-6797.md)
  `CVE-2020-6797` · CVE record: Mozilla Thunderbird and 1 more · No CVSS score · Not analysed yet · Published 2 Mar 2020
- [Mozilla Firefox: A content process could have modified shared memory relating to crash reporting…](https://agentprime.io/advisories/CVE-2020-6796.md)
  `CVE-2020-6796` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 2 Mar 2020
- [Type confusion in Mozilla Firefox ESR and others](https://agentprime.io/advisories/CVE-2019-17026.md)
  `CVE-2019-17026` · CVE record: Mozilla Firefox ESR and 2 more · CVSS 8.8 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.46 · Not analysed yet · Published 2 Mar 2020 · Tags: Memory corruption
- [Mozilla Firefox before 25 allows modification of anonymous content of pluginProblem.xml binding](https://agentprime.io/advisories/CVE-2013-5594.md)
  `CVE-2013-5594` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 18 Feb 2020
- [Mozilla Firefox: Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of…](https://agentprime.io/advisories/CVE-2011-2669.md)
  `CVE-2011-2669` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 21 Jan 2020
- [Mozilla Firefox through 1.5.0.3 has a vulnerability in processing the content-length header](https://agentprime.io/advisories/CVE-2011-2668.md)
  `CVE-2011-2668` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 21 Jan 2020
- [Mozilla Firefox before 3.6 is vulnerable to XSS via the rendering of Cascading Style Sheets](https://agentprime.io/advisories/CVE-2011-2670.md)
  `CVE-2011-2670` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 13 Jan 2020
- [Mozilla Firefox: A Content-Security-Policy that blocks in-line scripts could be bypassed using an object…](https://agentprime.io/advisories/CVE-2019-17001.md)
  `CVE-2019-17001` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 8 Jan 2020
- [Mozilla Firefox ESR: Given a compromised sandboxed content process due to a separate vulnerability…](https://agentprime.io/advisories/CVE-2019-9812.md)
  `CVE-2019-9812` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 8 Jan 2020
- [Mozilla developers reported memory safety bugs present in Firefox 71.](https://agentprime.io/advisories/CVE-2019-17025.md)
  `CVE-2019-17025` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 8 Jan 2020
- [Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3.](https://agentprime.io/advisories/CVE-2019-17024.md)
  `CVE-2019-17024` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 8 Jan 2020
- [Mozilla Firefox: After a HelloRetryRequest has been sent…](https://agentprime.io/advisories/CVE-2019-17023.md)
  `CVE-2019-17023` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 8 Jan 2020
- [Mozilla Firefox ESR: When pasting a \&lt;style\&gt; tag from the clipboard into a rich text editor…](https://agentprime.io/advisories/CVE-2019-17022.md)
  `CVE-2019-17022` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 8 Jan 2020
- [Mozilla Firefox ESR: During the initialization of a new content process…](https://agentprime.io/advisories/CVE-2019-17021.md)
  `CVE-2019-17021` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 8 Jan 2020
- [Mozilla Firefox: If an XML file is served with a Content Security Policy and the XML file includes an XSL…](https://agentprime.io/advisories/CVE-2019-17020.md)
  `CVE-2019-17020` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 8 Jan 2020
- [Mozilla Firefox: When Python was installed on Windows…](https://agentprime.io/advisories/CVE-2019-17019.md)
  `CVE-2019-17019` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 8 Jan 2020
- [Mozilla Firefox: When in Private Browsing Mode on Windows 10…](https://agentprime.io/advisories/CVE-2019-17018.md)
  `CVE-2019-17018` · CVE record: Mozilla Firefox · No CVSS score · Not analysed yet · Published 8 Jan 2020
- [Mozilla Firefox ESR: Due to a missing case handling object types, a type confusion vulnerability could occur…](https://agentprime.io/advisories/CVE-2019-17017.md)
  `CVE-2019-17017` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 8 Jan 2020
- [Mozilla Firefox ESR: When pasting a \&lt;style\&gt; tag from the clipboard into a rich text editor…](https://agentprime.io/advisories/CVE-2019-17016.md)
  `CVE-2019-17016` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 8 Jan 2020
- [Mozilla Firefox ESR: During the initialization of a new content process…](https://agentprime.io/advisories/CVE-2019-17015.md)
  `CVE-2019-17015` · CVE record: Mozilla Firefox ESR and 1 more · No CVSS score · Not analysed yet · Published 8 Jan 2020

Newest: <https://agentprime.io/advisories/technology/mozilla-firefox.md>
Older: <https://agentprime.io/advisories/technology/mozilla-firefox.md?cursor=WyIyMDIwLTAxLTA4VDIxOjI2OjE1LjAwMDAwMFoiLCJDVkUtMjAxOS0xNzAxNSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mozilla-firefox&cursor=WyIyMDIwLTA3LTA5VDE0OjM5OjM3LjAwMDAwMFoiLCJDVkUtMjAyMC0xMjQxOSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mozilla-firefox/?cursor=WyIyMDIwLTA3LTA5VDE0OjM5OjM3LjAwMDAwMFoiLCJDVkUtMjAyMC0xMjQxOSJd>. Everything for agents: <https://agentprime.io/llms.txt>.