Mozilla Firefox_esr
490 CVEs affecting Mozilla Firefox_esr. Latest disclosed: 2024-10-01. Critical: 45, High: 203.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-4140 | Critical | 10.0 | 2022-12-22 | It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96… |
CVE-2021-38503 | Critical | 10.0 | 2021-12-08 | The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the… |
CVE-2020-12389 | Critical | 10.0 | 2020-05-26 | The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Wi… |
CVE-2020-12388 | Critical | 10.0 | 2020-05-26 | The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Wi… |
CVE-2024-8387 | Critical | 9.8 | 2024-09-03 | Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2024-8385 | Critical | 9.8 | 2024-09-03 | A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability. This vulnerability af… |
CVE-2024-8384 | Critical | 9.8 | 2024-09-03 | The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes. This could ha… |
CVE-2024-8381 | Critical | 9.8 | 2024-09-03 | A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment. This vulnerabili… |
CVE-2023-5730 | Critical | 9.8 | 2023-10-25 | Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2023-5176 | Critical | 9.8 | 2023-09-27 | Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2023-5174 | Critical | 9.8 | 2023-09-27 | If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free a… |
CVE-2023-5168 | Critical | 9.8 | 2023-09-27 | A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a potentially exploitable… |
CVE-2023-4057 | Critical | 9.8 | 2023-08-01 | Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2023-34416 | Critical | 9.8 | 2023-06-19 | Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume t… |
CVE-2023-29542 | Critical | 9.8 | 2023-06-19 | A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .downlo… |
CVE-2023-29531 | Critical | 9.8 | 2023-06-19 | An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash. *This bug onl… |
CVE-2022-46882 | Critical | 9.8 | 2022-12-22 | A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability affects Firefox < 107, Firefox ESR < 102.6, and Thun… |
CVE-2022-45406 | Critical | 9.8 | 2022-12-22 | If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. Thi… |
CVE-2022-34470 | Critical | 9.8 | 2022-12-22 | Session history navigations may have led to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox < 102, Firefox ESR < 91.11… |
CVE-2022-31747 | Critical | 9.8 | 2022-12-22 | Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100 and Firefox ESR 91.9… |