Mozilla Firefox Esr
712 CVEs affecting Mozilla Firefox Esr. Latest disclosed: 2024-11-26. Critical: 160, High: 298.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-4140 | Critical | 10.0 | 2022-12-22 | It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96… |
CVE-2021-38503 | Critical | 10.0 | 2021-12-08 | The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the… |
CVE-2020-12389 | Critical | 10.0 | 2020-05-26 | The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Wi… |
CVE-2020-12388 | Critical | 10.0 | 2020-05-26 | The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Wi… |
CVE-2019-11708 | Critical | 10.0 | 2019-07-23 | Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process op… |
CVE-2018-18505 | Critical | 10.0 | 2019-02-05 | An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server pa… |
CVE-2024-11704 | Critical | 9.8 | 2024-11-26 | A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specific conditions, the same symmetric key c… |
CVE-2024-11698 | Critical | 9.8 | 2024-11-26 | A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dialog was opened durin… |
CVE-2024-11693 | Critical | 9.8 | 2024-11-26 | The executable file warning was not presented when downloading .library-ms files. *Note: This issue only affected Windows operating systems. Other operating… |
CVE-2024-9680 | Critical | 9.8 | 2024-10-09 | An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulner… |
CVE-2024-9402 | Critical | 9.8 | 2024-10-01 | Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2024-9401 | Critical | 9.8 | 2024-10-01 | Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruptio… |
CVE-2024-9392 | Critical | 9.8 | 2024-10-01 | A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox < 131, Firefox ESR < 128.3… |
CVE-2024-8387 | Critical | 9.8 | 2024-09-03 | Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2024-8385 | Critical | 9.8 | 2024-09-03 | A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability. This vulnerability af… |
CVE-2024-8384 | Critical | 9.8 | 2024-09-03 | The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes. This could ha… |
CVE-2024-8381 | Critical | 9.8 | 2024-09-03 | A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment. This vulnerabili… |
CVE-2024-6602 | Critical | 9.8 | 2024-07-09 | A mismatch between allocator and deallocator could have led to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird <… |
CVE-2024-3863 | Critical | 9.8 | 2024-04-16 | The executable file warning was not presented when downloading .xrm-ms files. *Note: This issue only affected Windows operating systems. Other operating syst… |
CVE-2023-5730 | Critical | 9.8 | 2023-10-25 | Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs showed evidence of memory corruption and we presume tha… |