Advisories · Technology

Mozilla Firefox.

Every CVE that names Mozilla Firefox among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-1932 CVE record

CVSS 8.1 High

Inconsistent comparator in XSLT sorting led to out-of-bounds access
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Mar 2025
CVE-2025-1931 CVE record

CVSS 7.5 High

Use-after-free in WebTransportChild
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Mar 2025
CVE-2025-1939 CVE record

CVSS 3.9 Low

Tapjacking in Android Custom Tabs using transition animations
- Mozilla Firefox
- Information disclosure
Not analysed yet 4 Mar 2025
CVE-2025-1930 CVE record

CVSS 8.8 High

AudioIPC StreamData could trigger a use-after-free in the Browser process
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Mar 2025
CVE-2025-1414 CVE record

CVSS 6.5 Medium

Memory safety bugs fixed in Firefox 135.0.1
- Mozilla Firefox
- Memory corruption
Not analysed yet 18 Feb 2025
CVE-2025-1020 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Firefox 135 and Thunderbird 135
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Feb 2025
CVE-2025-1017 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Feb 2025
CVE-2025-1016 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Feb 2025
CVE-2025-1014 CVE record

CVSS 8.8 High

Certificate length was not properly checked
- Mozilla Firefox
- Mozilla Thunderbird
- Weak cryptography or TLS
Not analysed yet 4 Feb 2025
CVE-2025-1013 CVE record

CVSS 6.5 Medium

Potential opening of private browsing tabs in normal browsing windows
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
Not analysed yet 4 Feb 2025
CVE-2025-1019 CVE record

CVSS 4.3 Medium

Fullscreen notification not properly displayed
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
Not analysed yet 4 Feb 2025
CVE-2025-1012 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free during concurrent delazification
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Feb 2025
CVE-2025-1011 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

A bug in WebAssembly code generation could result in a crash
- Mozilla Firefox
- Mozilla Thunderbird
- Code injection
Not analysed yet 4 Feb 2025
CVE-2025-1018 CVE record

CVSS 7.3 High

Fullscreen notification is not displayed when fullscreen is re-requested
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
Not analysed yet 4 Feb 2025
CVE-2025-1010 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in Custom Highlight
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Feb 2025
CVE-2025-1009 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in XSLT
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 4 Feb 2025
CVE-2025-0247 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Memory safety bugs fixed in Firefox 134 and Thunderbird 134
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 7 Jan 2025
CVE-2025-0243 CVE record

CVSS 5.1 Medium

Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6
- Mozilla Firefox
- Mozilla Thunderbird
Not analysed yet 7 Jan 2025
CVE-2025-0242 CVE record

CVSS 6.5 Medium

Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 7 Jan 2025
CVE-2025-0241 CVE record

CVSS 7.7 High

Memory corruption when using JavaScript Text Segmentation
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 7 Jan 2025
CVE-2025-0240 CVE record

CVSS 4.0 Medium

Compartment mismatch when parsing JavaScript JSON module
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 7 Jan 2025
CVE-2025-0239 CVE record

CVSS 4.0 Medium

Alt-Svc ALPN validation failure when redirected
- Mozilla Firefox
- Mozilla Thunderbird
- Weak cryptography or TLS
Not analysed yet 7 Jan 2025
CVE-2025-0238 CVE record

CVSS 5.3 Medium

Use-after-free when breaking lines in text
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 7 Jan 2025
CVE-2025-0237 CVE record

CVSS 5.4 Medium

WebChannel APIs susceptible to confused deputy attack
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
Not analysed yet 7 Jan 2025
CVE-2025-0246 CVE record

CVSS 6.5 Medium

Address bar spoofing using an invalid protocol scheme on Firefox for Android
- Mozilla Firefox
Not analysed yet 7 Jan 2025
CVE-2025-0245 CVE record

CVSS 3.3 Low

Lock screen setting bypass in Firefox Focus for Android
- Mozilla Firefox
Not analysed yet 7 Jan 2025
CVE-2025-0244 CVE record

CVSS 5.3 Medium

Address bar spoofing using an invalid protocol scheme on Firefox for Android
- Mozilla Firefox
- Open redirect
Not analysed yet 7 Jan 2025
CVE-2024-11699 CVE record

CVSS 8.8 High

Code injection in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Code injection
Not analysed yet 26 Nov 2024
CVE-2024-11708 CVE record

CVSS 6.5 Medium

Race condition in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
Not analysed yet 26 Nov 2024
CVE-2024-11706 CVE record

CVSS 6.5 Medium

NULL pointer dereference in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 26 Nov 2024
CVE-2024-11705 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

NULL pointer dereference in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 26 Nov 2024
CVE-2024-11698 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mozilla Firefox: A flaw in handling fullscreen transitions may have inadvertently caused the application…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 26 Nov 2024
CVE-2024-11704 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Double free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 26 Nov 2024
CVE-2024-11697 CVE record

CVSS 8.8 High

Code injection in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Code injection
Not analysed yet 26 Nov 2024
CVE-2024-11696 CVE record

CVSS 5.4 Medium

Improper signature verification in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Weak cryptography or TLS
Not analysed yet 26 Nov 2024
CVE-2024-11703 CVE record

CVSS 5.7 Medium

Insufficiently protected credentials in Mozilla Firefox
- Mozilla Firefox
- Hard-coded credentials
Not analysed yet 26 Nov 2024
CVE-2024-11695 CVE record

CVSS 5.4 Medium

Clickjacking in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-1021
Not analysed yet 26 Nov 2024
CVE-2024-11694 CVE record

CVSS 6.1 Medium

Cross-site scripting in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Cross-site scripting (XSS)
Not analysed yet 26 Nov 2024
CVE-2024-11693 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mozilla Firefox: The executable file warning was not presented when downloading .library-ms files. *Note…
- Mozilla Firefox
- Mozilla Firefox ESR
Not analysed yet 26 Nov 2024
CVE-2024-11702 CVE record

CVSS 7.5 High

Mozilla Firefox: Copying sensitive information from Private Browsing tabs on Android, such as passwords…
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-838
Not analysed yet 26 Nov 2024
CVE-2024-11701 CVE record

CVSS 4.3 Medium

Authentication bypass by spoofing in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 26 Nov 2024
CVE-2024-11692 CVE record

CVSS 4.3 Medium

Authentication bypass by spoofing in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Authentication bypass
Not analysed yet 26 Nov 2024
CVE-2024-11700 CVE record

CVSS 8.1 High

Clickjacking in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
Not analysed yet 26 Nov 2024
CVE-2024-11691 CVE record

CVSS 8.8 High

Out-of-bounds write in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 26 Nov 2024
CVE-2024-10941 CVE record

CVSS 4.3 Medium

Mozilla Firefox: A malicious website could have included an iframe with an malformed URI resulting in a…
- Mozilla Firefox
- CWE-86
Not analysed yet 6 Nov 2024
CVE-2024-10468 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Resource allocation without limits in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 29 Oct 2024
CVE-2024-10467 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Out-of-bounds read in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 29 Oct 2024
CVE-2024-10466 CVE record

CVSS 7.5 High

Uncontrolled resource consumption in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Denial of service
Not analysed yet 29 Oct 2024
CVE-2024-10465 CVE record

CVSS 7.5 High

Authentication bypass by spoofing in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Authentication bypass
Not analysed yet 29 Oct 2024
CVE-2024-10464 CVE record

CVSS 7.5 High

Out-of-bounds read in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 29 Oct 2024
CVE-2024-10463 CVE record

CVSS 7.5 High

Observable discrepancy in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Information disclosure
Not analysed yet 29 Oct 2024
CVE-2024-10462 CVE record

CVSS 7.5 High

Authentication bypass by spoofing in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Authentication bypass
Not analysed yet 29 Oct 2024
CVE-2024-10461 CVE record

CVSS 6.1 Medium

Cross-site scripting in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Cross-site scripting (XSS)
Not analysed yet 29 Oct 2024
CVE-2024-10460 CVE record

CVSS 5.4 Medium

Origin validation error in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-346
Not analysed yet 29 Oct 2024
CVE-2024-10459 CVE record

CVSS 6.5 Medium

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 29 Oct 2024
CVE-2024-10458 CVE record

CVSS 6.5 Medium

Mozilla Firefox: A permission leak could have occurred from a trusted site to an untrusted site via…
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-281
Not analysed yet 29 Oct 2024
CVE-2024-9936 CVE record

CVSS 6.5 Medium

Race condition in Mozilla Firefox
- Mozilla Firefox
- Race condition
Not analysed yet 14 Oct 2024
CVE-2024-9680 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Use after free in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Firefox ESR
- Memory corruption
Not analysed yet 9 Oct 2024
CVE-2024-9403 CVE record

CVSS 7.3 High

Buffer overflow in Mozilla Firefox and others
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Oct 2024
CVE-2024-9395 CVE record

CVSS 5.3 Medium

Mozilla Firefox: A specially crafted filename containing a large number of spaces could obscure the file's…
- Mozilla Firefox
Not analysed yet 1 Oct 2024