Vulnerabilidades do Mozilla Firefox ESR
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Mozilla Firefox ESR: 10 registro(s), com versões afetadas e correções.
CVE-2024-9680
Crítica · 9.8
KEV Urgente · 79 Exploit público Ransomware CWE-416 09/10/2024
Mozilla Firefox Use-After-Free Vulnerability
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.
CVE-2024-9398
Média · 5.3
CWE-203 01/10/2024
Observable Discrepancy em Mozilla Firefox
By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.
CVE-2022-26485
Alta · 8.8
KEV Alta · 61 Exploit público CWE-416 22/12/2022
Mozilla Firefox Use-After-Free Vulnerability
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
CVE-2022-26486
Crítica · 9.6
KEV Alta · 58 CWE-416 22/12/2022
Mozilla Firefox Use-After-Free Vulnerability
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
CVE-2020-6820
Alta · 8.1
KEV Alta · 55 CWE-362 24/04/2020
Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.
CVE-2020-6819
Alta · 8.1
KEV Alta · 54 CWE-362 24/04/2020
Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.
CVE-2019-17026
Alta · 8.8
KEV Alta · 64 Exploit público CWE-843 02/03/2020
Mozilla Firefox And Thunderbird Type Confusion Vulnerability
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.
CVE-2019-11708
Crítica · 10.0
KEV Alta · 68 Exploit público CWE-20 23/07/2019
Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.
CVE-2019-11707
Alta · 8.8
KEV Alta · 64 Exploit público CWE-843 23/07/2019
Mozilla Firefox and Thunderbird Type Confusion Vulnerability
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.
CVE-2016-9079
Alta · 7.5
KEV Urgente · 79 Exploit público CWE-416 11/06/2018
Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.