Skip to contentMozilla Firefox Esr vulnerabilities
- mozilla firefox, firefox esr +1 moreThe Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To...CVE-2020-12413Fix available5.9 Medium
- mozilla firefox esr, thunderbird +1 moreMozilla developers Philipp and Gabriele Svelto reported memory safety bugs present in Firefox ESR...CVE-2023-25746Fix available8.8 High
- mozilla firefox, firefox esr +1 moreMozilla developers Kershaw Chang and the Mozilla Fuzzing Team reported memory safety bugs present...CVE-2023-25744Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing...CVE-2023-25742Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreModule load requests that failed were not being checked as to whether or not they were cancelled...CVE-2023-25739Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreAn invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to...CVE-2023-25737Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreCross-compartment wrappers wrapping a scripted proxy could have caused objects from other...CVE-2023-25735Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input...CVE-2023-25732Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA background script invoking <code>requestFullscreen</code> and then blocking the main thread...CVE-2023-25730Fix available5.4 Medium
- mozilla firefox, firefox esr, thunderbird +2 morePermission prompts for opening external schemes were only shown for <code>ContentPrincipals</code...CVE-2023-25729Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreThe <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a...CVE-2023-25728Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary...CVE-2023-0767Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreMemory safety bugs fixed in Firefox 109 and Firefox ESR 102.7CVE-2023-23605Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreCalls to console.log allowed bypassing Content Security Policy via format directiveCVE-2023-23603Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreContent Security Policy wasn't being correctly applied to WebSockets in WebWorkersCVE-2023-23602Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreURL being dragged from cross-origin iframe into same tab triggers navigationCVE-2023-23601Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMalicious command could be hidden in devtools output on WindowsCVE-2023-23599Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreArbitrary file read from GTK drag and drop on LinuxCVE-2023-23598Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA use-after-free in WebGL extensions could have led to a potentially exploitable crash. This...CVE-2022-46882Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreAn optimization in WebGL was incorrect in some cases, and could have led to memory corruption and...CVE-2022-46881Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA missing check related to tex units could have led to a use-after-free and potentially...CVE-2022-46880Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team...CVE-2022-46878Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreThe executable file warning was not presented when downloading .atloc and .ftploc files, which...CVE-2022-46875Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA file with a long filename could have had its filename truncated to remove the valid extension,...CVE-2022-46874Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker who compromised a content process could have partially escaped the sandbox to read...CVE-2022-46872Fix available8.6 High
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in...CVE-2022-45421Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreUse tables inside of an iframe, an attacker could have caused iframe contents to be rendered...CVE-2022-45420Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIf a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have...CVE-2022-45418Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreKeyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread...CVE-2022-45416Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be...CVE-2022-45412Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreCross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing...CVE-2022-45411Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the...CVE-2022-45410Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe garbage collector could have been aborted in several states and zones and <code>GCRuntime:...CVE-2022-45409Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreThrough a series of popups that reuse windowName, an attacker can cause a window to go fullscreen...CVE-2022-45408Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIf an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may...CVE-2022-45406Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreFreeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have...CVE-2022-45405Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThrough a series of popup and <code>window.print()</code> calls, an attacker can cause a window...CVE-2022-45404Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreService Workers should not be able to infer information about opaque cross-origin responses; but...CVE-2022-45403Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present...CVE-2022-42932Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreIf a website called <code>window.print()</code> in a particular way, it could cause a denial of...CVE-2022-42929Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreCertain types of allocations were missing annotations that, if the Garbage Collector was in a...CVE-2022-42928Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking...CVE-2022-42927Fix available8.1 High
- mozilla firefox, firefox esr, thunderbird +2 moreInconsistent data in instruction and data cache when creating wasm code could lead to a...CVE-2022-40957Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn out-of-bounds read can occur when decoding H264 video. This results in a potentially...CVE-2022-3266Fix available5.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the...CVE-2022-40962Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreConcurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a...CVE-2022-40960Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreDuring iframe navigation, certain pages did not have their FeaturePolicy fully initialized...CVE-2022-40959Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreBy injecting a cookie with certain special characters, an attacker on a shared subdomain which is...CVE-2022-40958Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen injecting an HTML base element, some requests would ignore the CSP's base-uri settings and...CVE-2022-40956Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen opening a Windows shortcut from the local filesystem, an attacker could supply a remote path...CVE-2022-36314Fix available5.5 Medium
- Show moreLoading…