Skip to contentMozilla Firefox Esr vulnerabilities
- mozilla firefox, firefox esr, thunderbird +2 moreFreeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have...CVE-2022-45405Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThrough a series of popup and <code>window.print()</code> calls, an attacker can cause a window...CVE-2022-45404Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreService Workers should not be able to infer information about opaque cross-origin responses; but...CVE-2022-45403Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present...CVE-2022-42932Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreIf a website called <code>window.print()</code> in a particular way, it could cause a denial of...CVE-2022-42929Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreCertain types of allocations were missing annotations that, if the Garbage Collector was in a...CVE-2022-42928Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking...CVE-2022-42927Fix available8.1 High
- mozilla firefox, firefox esr, thunderbird +2 moreInconsistent data in instruction and data cache when creating wasm code could lead to a...CVE-2022-40957Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn out-of-bounds read can occur when decoding H264 video. This results in a potentially...CVE-2022-3266Fix available5.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the...CVE-2022-40962Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreConcurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a...CVE-2022-40960Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreDuring iframe navigation, certain pages did not have their FeaturePolicy fully initialized...CVE-2022-40959Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreBy injecting a cookie with certain special characters, an attacker on a shared subdomain which is...CVE-2022-40958Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen injecting an HTML base element, some requests would ignore the CSP's base-uri settings and...CVE-2022-40956Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen opening a Windows shortcut from the local filesystem, an attacker could supply a remote path...CVE-2022-36314Fix available5.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMembers the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR...CVE-2022-38478Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present...CVE-2022-38477Fix available8.8 High
- mozilla firefox esr, thunderbird +1 moreA data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use...CVE-2022-38476Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreA cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions ...CVE-2022-38473Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox...CVE-2022-2505Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen combining CSS properties for overflow and transform, the mouse cursor could interact with...CVE-2022-36319Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen visiting directory listings for `chrome://` URLs as source text, some parameters were...CVE-2022-36318Fix available5.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver...CVE-2022-34478Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of...CVE-2022-34484Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreIn the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have...CVE-2022-34481Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA malicious website that could create a popup could have resized the popup to overlay the address...CVE-2022-34479Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIf there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests...CVE-2022-34472Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreSession history navigations may have led to a use-after-free and potentially exploitable crash....CVE-2022-34470Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreAn iframe that was not permitted to run scripts could do so if the user clicked on a <code...CVE-2022-34468Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreIf an object prototype was corrupted by an attacker, they would have been able to set undesired...CVE-2022-2200Fix availableEPSS 23.9%8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen downloading files on Windows, the % character was not escaped, which could have lead to a...CVE-2022-31739Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported...CVE-2022-31747Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have injected CSS into stylesheets accessible via internal URIs, such as...CVE-2022-31744Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have exploited a timing attack by sending a large number of allowCredential...CVE-2022-31742Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA crafted CMS message could have been processed incorrectly, leading to an invalid memory read,...CVE-2022-31741Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreOn arm64, WASM code could have resulted in incorrect assembly generation leading to a register...CVE-2022-31740Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen exiting fullscreen mode, an iframe could have confused the browser about the current state...CVE-2022-31738Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory...CVE-2022-31737Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreA malicious website could have learned the size of a cross-origin resource that supported Range...CVE-2022-31736Fix available9.8 Critical
- mozilla firefox, firefox esr, firefox for android +1 more +3 moreIf an attacker was able to corrupt the methods of an Array object in JavaScript via prototype...CVE-2022-1802Public exploitFix availableEPSS 28.5%8.8 High
- mozilla firefox, firefox esr, firefox for android +1 more +3 moreAn attacker could have sent a message to the parent process where the contents were used to...CVE-2022-1529Fix availableEPSS 17.6%8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team...CVE-2022-29917Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreFirefox behaved slightly differently for already known resources when loading CSS resources...CVE-2022-29916Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen reusing existing popups Firefox would have allowed them to cover the fullscreen notification...CVE-2022-29914Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreRequests initiated through reader mode did not properly omit cookies with a SameSite attribute....CVE-2022-29912Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user...CVE-2022-29911Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreDocuments in deeply-nested cross-origin browsing contexts could have obtained permissions granted...CVE-2022-29909Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the...CVE-2022-28289Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreDue to a layout change, iframe contents could have been rendered outside of its border. This...CVE-2022-28286Fix available5.4 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect...CVE-2022-28285Fix available6.5 Medium
- Show moreLoading…