Skip to contentMozilla Firefox Esr vulnerabilities
- mozilla firefox, firefox esr, thunderbird +2 moreSelect options could obscure the fullscreen notification dialog. This could be used by a...CVE-2024-7518Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreType Confusion in Async Generators in Javascript EngineCVE-2024-7652Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreMemory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13CVE-2024-6604Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreMemory corruption in thread creationCVE-2024-6603Fix available7.4 High
- mozilla firefox, firefox esr, thunderbird +2 moreMemory corruption in NSSCVE-2024-6602Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreRace condition in permission assignmentCVE-2024-6601Fix available4.7 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMemory corruption in WebGL APICVE-2024-66006.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreOn Windows, when using the 'Save As' functionality, an attacker could have tricked the browser...CVE-2024-56926.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMemory corruption in the networking stack could have led to a potentially exploitable crash. This...CVE-2024-5702Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreMemory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of...CVE-2024-5700Fix available7.0 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreBy manipulating the text in an `<input>` tag, an attacker could have caused corrupt memory...CVE-2024-5696Fix available8.6 High
- mozilla firefox, firefox esr, thunderbird +2 moreOffscreen Canvas did not properly track cross-origin tainting, which could be used to access...CVE-2024-5693Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreBy tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented...CVE-2024-5691Fix available4.7 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreBy monitoring the time certain operations take, an attacker could have guessed which external...CVE-2024-5690Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIf a garbage collection was triggered at the right time, a use-after-free could have occurred...CVE-2024-5688Fix available8.1 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMemory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of...CVE-2024-4777Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen saving a page to PDF, certain font styles could have led to a potential use-after-free crash...CVE-2024-4770Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreWhen importing resources using Web Workers, error messages would distinguish the difference...CVE-2024-4769Fix available5.9 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a...CVE-2024-4768Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIf the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not...CVE-2024-4767Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +5 more +7 morePDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDFCVE-2024-4367Public exploitFix availableEPSS 70.7%8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMemory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug...CVE-2024-3864Fix available8.1 High
- mozilla firefox, firefox esr, thunderbird +2 moreThere was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server...CVE-2024-3302Fix available3.7 Low
- mozilla firefox, firefox esr, thunderbird +2 moreThe executable file warning was not presented when downloading .xrm-ms files.
*Note: This issue...CVE-2024-38639.8 Critical
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIf an AlignedBuffer were assigned to itself, the subsequent self-move could result in an...CVE-2024-3861Fix available4.0 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreOn 32-bit versions there were integer-overflows that led to an out-of-bounds-read that...CVE-2024-3859Fix available5.9 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreThe JIT created incorrect code for arguments in certain cases. This led to potential use-after...CVE-2024-3857Fix available7.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreIn some code patterns the JIT incorrectly optimized switch statements and generated code with out...CVE-2024-3854Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreGetBoundName could return the wrong version of an object when JIT optimizations were applied....CVE-2024-3852Fix available7.5 High
- mozilla firefox, firefox esr, debian linux +2 moreAn attacker was able to inject an event handler into a privileged object that would allow...CVE-2024-29944Fix available8.4 High
- mozilla firefox, firefox esr, thunderbird +2 moreTo harden ICU against exploitation, the behavior for out-of-memory conditions was changed to...CVE-2024-2616Fix available2.7 Low
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have leveraged the Windows Error Reporter to run arbitrary code on the system...CVE-2024-2605Fix available5.9 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMemory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of...CVE-2024-2614Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreIf an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have...CVE-2024-2612Fix available8.1 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA missing delay on when pointer lock was used could have allowed a malicious page to trick a user...CVE-2024-2611Fix available5.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreUsing a markup injection an attacker could have stolen nonce values. This could have been used to...CVE-2024-2610Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreThe permission prompt input delay could have expired while the window is not in focus, which made...CVE-2024-2609Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 more`AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()...CVE-2024-2608Fix available8.4 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreReturn registers were overwritten which could have allowed an attacker to execute arbitrary code....CVE-2024-2607Fix available8.1 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMemory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of...CVE-2024-1553Fix available8.1 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIncorrect code generation could have led to unexpected numeric conversions and potential...CVE-2024-1552Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreSet-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an...CVE-2024-1551Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA malicious website could have used a combination of exiting fullscreen mode and ...CVE-2024-1550Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIf a website set a large custom cursor, portions of the cursor could have overlapped with the...CVE-2024-1549Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA website could have obscured the fullscreen notification by using a dropdown select input...CVE-2024-1548Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreThrough a series of API calls and redirects, an attacker-controlled alert dialog could have been...CVE-2024-1547Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreWhen storing and re-accessing data on a networking channel, the length of buffers may have been...CVE-2024-1546Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreAn unchecked return value in TLS handshake code could have caused a potentially exploitable crash...CVE-2024-0743Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMemory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of...CVE-2024-0755Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIn specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This...CVE-2024-0753Fix available6.5 Medium
- Show moreLoading…