Mozilla Firefox ESR vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Mozilla Firefox ESR: 10 record(s), with affected versions and fixes.
CVE-2024-9680
Critical · 9.8
KEV Urgent · 79 Public exploit Ransomware CWE-416 Oct 9, 2024
Mozilla Firefox Use-After-Free Vulnerability
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.
CVE-2024-9398
Medium · 5.3
CWE-203 Oct 1, 2024
Observable Discrepancy in Mozilla Firefox
By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.
CVE-2022-26485
High · 8.8
KEV High · 61 Public exploit CWE-416 Dec 22, 2022
Mozilla Firefox Use-After-Free Vulnerability
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
CVE-2022-26486
Critical · 9.6
KEV High · 58 CWE-416 Dec 22, 2022
Mozilla Firefox Use-After-Free Vulnerability
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
CVE-2020-6820
High · 8.1
KEV High · 55 CWE-362 Apr 24, 2020
Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.
CVE-2020-6819
High · 8.1
KEV High · 54 CWE-362 Apr 24, 2020
Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.
CVE-2019-17026
High · 8.8
KEV Urgent · 70 Public exploit CWE-843 Mar 2, 2020
Mozilla Firefox And Thunderbird Type Confusion Vulnerability
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.
CVE-2019-11708
Critical · 10.0
KEV High · 68 Public exploit CWE-20 Jul 23, 2019
Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.
CVE-2019-11707
High · 8.8
KEV High · 64 Public exploit CWE-843 Jul 23, 2019
Mozilla Firefox and Thunderbird Type Confusion Vulnerability
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.
CVE-2016-9079
High · 7.5
KEV Urgent · 79 Public exploit CWE-416 Jun 11, 2018
Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.