Mozilla Firefox Esr vulnerabilities

• mozilla firefox, firefox esr, thunderbird +2 more Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of... CVE-2024-11699 Fix available 8.8 HighNovember 26, 2024
• mozilla firefox, firefox esr, thunderbird +2 more A flaw in handling fullscreen transitions may have inadvertently caused the application to become... CVE-2024-11698 9.8 CriticalNovember 26, 2024
• mozilla firefox, firefox esr, thunderbird +2 more A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an... CVE-2024-11704 Fix available 9.8 CriticalNovember 26, 2024
• mozilla firefox, firefox esr, thunderbird +2 more When handling keypress events, an attacker may have been able to trick a user into bypassing the ... CVE-2024-11697 Fix available 8.8 HighNovember 26, 2024
• mozilla firefox, firefox esr, thunderbird +2 more The application failed to account for exceptions thrown by the `loadManifestFromFile` method... CVE-2024-11696 Fix available 5.4 MediumNovember 26, 2024
• mozilla firefox, firefox esr, thunderbird +2 more A crafted URL containing Arabic script and whitespace characters could have hidden the true... CVE-2024-11695 Fix available 5.4 MediumNovember 26, 2024
• mozilla firefox, firefox esr, thunderbird +2 more Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src`... CVE-2024-11694 Fix available 6.1 MediumNovember 26, 2024
• mozilla firefox, firefox esr, thunderbird +2 more The executable file warning was not presented when downloading .library-ms files. *Note: This... CVE-2024-11693 Fix available 9.8 CriticalNovember 26, 2024
• mozilla firefox, firefox esr, thunderbird +2 more An attacker could cause a select dropdown to be shown over another tab; this could have led to... CVE-2024-11692 Fix available 4.3 MediumNovember 26, 2024
• mozilla firefox, firefox esr, thunderbird +2 more An attacker could have caused memory corruption due to a flaw in Apple's GPU driver; this can be... CVE-2024-11691 Fix available 8.8 HighNovember 26, 2024
• mozilla firefox, firefox esr, thunderbird +2 more Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of... CVE-2024-10467 Fix available 8.8 HighOctober 29, 2024
• mozilla firefox, firefox esr, thunderbird +2 more By sending a specially crafted push message, a remote server could have hung the parent process,... CVE-2024-10466 Fix available 7.5 HighOctober 29, 2024
• mozilla firefox, firefox esr, thunderbird +2 more A clipboard "paste" button could persist across tabs which allowed a spoofing attack. This... CVE-2024-10465 Fix available 6.5 MediumOctober 29, 2024
• mozilla firefox, firefox esr, thunderbird +2 more Repeated writes to history interface attributes could have been used to cause a Denial of Service... CVE-2024-10464 Fix available 6.5 MediumOctober 29, 2024
• mozilla firefox, firefox esr, thunderbird +2 more Video frames could have been leaked between origins in some situations. This vulnerability... CVE-2024-10463 Fix available 6.5 MediumOctober 29, 2024
• mozilla firefox, firefox esr, thunderbird +2 more Truncation of a long URL could have allowed origin spoofing in a permission prompt. This... CVE-2024-10462 Fix available 6.5 MediumOctober 29, 2024
• mozilla firefox, firefox esr, thunderbird +2 more In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header... CVE-2024-10461 Fix available 6.1 MediumOctober 29, 2024
• mozilla firefox, firefox esr, thunderbird +2 more The origin of an external protocol handler prompt could have been obscured using a data: URL... CVE-2024-10460 Fix available 5.3 MediumOctober 29, 2024
• mozilla firefox, firefox esr, thunderbird +2 more An attacker could have caused a use-after-free when accessibility was enabled, leading to a... CVE-2024-10459 Fix available 7.5 HighOctober 29, 2024
• mozilla firefox, firefox esr, thunderbird +2 more A permission leak could have occurred from a trusted site to an untrusted site via `embed` or ... CVE-2024-10458 Fix available 7.5 HighOctober 29, 2024
• mozilla firefox, firefox esr, thunderbird +1 more +3 more An attacker was able to achieve code execution in the content process by exploiting a use-after... CVE-2024-9680 In KEVPublic exploitFix available EPSS 23.2% 9.8 CriticalOctober 9, 2024
• mozilla firefox, firefox esr, thunderbird +2 more Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of... CVE-2024-9402 Fix available 9.8 CriticalOctober 1, 2024
• mozilla firefox, firefox esr, thunderbird +2 more Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird... CVE-2024-9401 Fix available 9.8 CriticalOctober 1, 2024
• mozilla firefox, firefox esr, thunderbird +2 more A potential memory corruption vulnerability could be triggered if an attacker had the ability to... CVE-2024-9400 Fix available 8.8 HighOctober 1, 2024
• mozilla firefox, firefox esr, thunderbird +2 more A website configured to initiate a specially crafted WebTransport session could crash the Firefox... CVE-2024-9399 Fix available 7.5 HighOctober 1, 2024
• mozilla firefox, firefox esr, thunderbird +2 more By checking the result of calls to `window.open` with specifically set protocol handlers, an... CVE-2024-9398 Fix available 5.3 MediumOctober 1, 2024
• mozilla firefox, firefox esr, thunderbird +2 more A missing delay in directory upload UI could have made it possible for an attacker to trick a... CVE-2024-9397 Fix available 6.1 MediumOctober 1, 2024
• mozilla firefox, firefox esr, thunderbird +2 more It is currently unknown if this issue is exploitable but a condition may arise where the... CVE-2024-9396 Fix available 8.8 HighOctober 1, 2024
• mozilla firefox, firefox esr, thunderbird +2 more An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under... CVE-2024-9394 Fix available 7.5 HighOctober 1, 2024
• mozilla firefox, firefox esr, thunderbird +2 more An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under... CVE-2024-9393 Fix available 7.5 HighOctober 1, 2024
• mozilla firefox, firefox esr, thunderbird +2 more A compromised content process could have allowed for the arbitrary loading of cross-origin pages.... CVE-2024-9392 Fix available 9.8 CriticalOctober 1, 2024
• mozilla firefox, firefox esr, thunderbird +2 more An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain... CVE-2024-8900 Fix available 7.5 HighSeptember 17, 2024
• mozilla firefox, firefox esr, thunderbird +2 more Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of... CVE-2024-8387 Fix available 9.8 CriticalSeptember 3, 2024
• mozilla firefox, firefox esr, thunderbird +2 more If a site had been granted the permission to open popup windows, it could cause Select elements... CVE-2024-8386 Fix available 6.1 MediumSeptember 3, 2024
• mozilla firefox, firefox esr, thunderbird +2 more A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an... CVE-2024-8385 Fix available 9.8 CriticalSeptember 3, 2024
• mozilla firefox, firefox esr, thunderbird +2 more The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were... CVE-2024-8384 Fix available 9.8 CriticalSeptember 3, 2024
• mozilla firefox, firefox esr +1 more Firefox normally asks for confirmation before asking the operating system to find an application... CVE-2024-8383 Fix available 7.5 HighSeptember 3, 2024
• mozilla firefox, firefox esr, thunderbird +2 more Internal browser event interfaces were exposed to web content when privileged EventHandler... CVE-2024-8382 Fix available 8.8 HighSeptember 3, 2024
• mozilla firefox, firefox esr, thunderbird +2 more A potentially exploitable type confusion could be triggered when looking up a property name on an... CVE-2024-8381 Public exploitFix available 9.8 CriticalSeptember 3, 2024
• mozilla firefox, firefox esr +1 more Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can... CVE-2024-7531 Fix available 6.5 MediumAugust 6, 2024
• mozilla firefox, firefox esr, thunderbird +2 more The date picker could partially obscure security prompts. This could be used by a malicious site... CVE-2024-7529 Fix available 6.5 MediumAugust 6, 2024
• mozilla firefox, firefox esr, thunderbird +2 more Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This... CVE-2024-7528 Fix available 8.8 HighAugust 6, 2024
• mozilla firefox, firefox esr, thunderbird +2 more Unexpected marking work at the start of sweeping could have led to a use-after-free. This... CVE-2024-7527 Fix available 8.8 HighAugust 6, 2024
• mozilla firefox, firefox esr, thunderbird +2 more ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could... CVE-2024-7526 Fix available 6.5 MediumAugust 6, 2024
• mozilla firefox, firefox esr, thunderbird +2 more It was possible for a web extension with minimal permissions to create a `StreamFilter` which... CVE-2024-7525 Fix available 8.1 HighAugust 6, 2024
• mozilla firefox, firefox esr +1 more Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced... CVE-2024-7524 Fix available 6.1 MediumAugust 6, 2024
• mozilla firefox, firefox esr, thunderbird +2 more Editor code failed to check an attribute value. This could have led to an out-of-bounds read.... CVE-2024-7522 Fix available 8.8 HighAugust 6, 2024
• mozilla firefox, firefox esr, thunderbird +2 more Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability... CVE-2024-7521 Fix available 8.8 HighAugust 6, 2024
• mozilla firefox, firefox esr, thunderbird +2 more A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code... CVE-2024-7520 Fix available 8.8 HighAugust 6, 2024
• mozilla firefox, firefox esr, thunderbird +2 more Insufficient checks when processing graphics shared memory could have led to memory corruption.... CVE-2024-7519 Fix available 9.6 CriticalAugust 6, 2024
• Show olderLoading…