Skip to contentMozilla Firefox Esr vulnerabilities
- mozilla firefox, firefox esr, thunderbird +2 moreMemory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of...CVE-2023-4057Fix available9.8 Critical
- mozilla firefox, firefox esr, debian linux +2 moreMemory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115...CVE-2023-4056Fix available9.8 Critical
- mozilla firefox, firefox esr, debian linux +2 moreWhen the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar...CVE-2023-4055Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen opening appref-ms files, Firefox did not warn the user that these files may contain...CVE-2023-4054Fix available5.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe Firefox updater created a directory writable by non-privileged users. When uninstalling...CVE-2023-4052Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreFull screen notification obscured by external programCVE-2023-4053Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreFull screen notification obscured by file open dialogCVE-2023-4051Fix available7.5 High
- mozilla firefox, firefox esr, debian linux +2 moreIn some cases, an untrusted input stream was copied to a stack buffer without checking its size....CVE-2023-4050Fix availableEPSS 12.6%7.5 High
- mozilla firefox, firefox esr, debian linux +2 moreRace conditions in reference counting code were found through code inspection. These could have...CVE-2023-4049Fix available5.9 Medium
- mozilla firefox, firefox esr, debian linux +2 moreAn out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in...CVE-2023-4048Fix available7.5 High
- mozilla firefox, firefox esr, debian linux +2 moreA bug in popup notifications delay calculation could have made it possible for an attacker to...CVE-2023-4047Fix available8.8 High
- mozilla firefox, firefox esr, debian linux +2 moreIn some circumstances, a stale value could have been used for a global variable in WASM JIT...CVE-2023-4046Fix available5.3 Medium
- mozilla firefox, firefox esr, debian linux +2 moreOffscreen Canvas did not properly track cross-origin tainting, which could have been used to...CVE-2023-4045Fix available5.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreUse-after-free in workersCVE-2023-3600Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMemory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of...CVE-2023-37211Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreWhen opening Diagcab files, Firefox did not warn the user that these files may contain malicious...CVE-2023-37208Fix available7.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA website could have obscured the fullscreen notification by using a URL with a scheme handled by...CVE-2023-37207Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreCross-compartment wrappers wrapping a scripted proxy could have caused objects from other...CVE-2023-37202Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreAn attacker could have triggered a use-after-free condition when creating a WebRTC connection...CVE-2023-37201Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreMemory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of...CVE-2023-34416Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreThe error page for sites with invalid TLS certificates was missing the
activation-delay Firefox...CVE-2023-34414Fix available3.1 Low
- mozilla firefox, firefox esr, thunderbird +2 moreProtocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of...CVE-2023-32214Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough,...CVE-2023-32215Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen reading a file, an uninitialized value could have been used as read limit. This...CVE-2023-32213Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have positioned a <code>datalist</code> element to obscure the address bar....CVE-2023-32212Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA type checking bug would have led to invalid code being compiled. This vulnerability affects...CVE-2023-32211Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA missing delay in popup notifications could have made it possible for an attacker to trick a...CVE-2023-32207Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreAn out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability...CVE-2023-32206Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIn multiple cases browser prompts could have been obscured by popups controlled by content. These...CVE-2023-32205Fix available4.3 Medium
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreMozilla developers Randell Jesup, Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the...CVE-2023-29550Fix available8.8 High
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result....CVE-2023-29548Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreSimilar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing...CVE-2023-29545Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA newline in a filename could have been used to bypass the file extension security mechanisms...CVE-2023-29542Fix available9.8 Critical
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreFirefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be...CVE-2023-29541Fix available8.8 High
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreWhen handling the filename directive in the Content-Disposition header, the filename would be...CVE-2023-29539Fix available8.8 High
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker...CVE-2023-29536Fix available8.8 High
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreFollowing a Garbage Collector compaction, weak maps may have been accessed before they were...CVE-2023-29535Fix available6.5 Medium
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreA website could have obscured the fullscreen notification by using a combination of <code>window...CVE-2023-29533Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file...CVE-2023-29532Fix available5.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory...CVE-2023-29531Fix available9.8 Critical
- mozilla firefox esr, thunderbird +1 moreUnexpected data returned from the Safe Browsing API could have led to memory corruption and a...CVE-2023-1945Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Timothy Nikkel, Andrew McCreight, and the Mozilla Fuzzing Team reported memory...CVE-2023-28176Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreDragging a URL from a cross-origin iframe that was removed during the drag could have led to user...CVE-2023-28164Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen downloading files through the Save As dialog on Windows with suggested filenames containing...CVE-2023-28163Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhile implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic...CVE-2023-28162Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen accessing throttled streams, the count of available bytes needed to be checked in the...CVE-2023-25752Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreSometimes, when invalidating JIT code while following an iterator, the newly generated code could...CVE-2023-25751Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMembers of the <code>DEVMODEW</code> struct set by the printer device driver weren't being...CVE-2023-25738Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAfter downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker...CVE-2023-25734Fix available8.1 High
- mozilla firefox, firefox esr, firefox focus +2 moreA lack of in app notification for entering fullscreen mode could have lead to a malicious website...CVE-2023-257437.5 High
- Show moreLoading…