Mozilla Firefox ESR
712 published vulnerabilities name this product. The 200 most recent are listed.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2024-11699 | unspecified – < 128.5 | Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence of memory corruption | HIGH 8.8 | 0.7 % | ||
| CVE-2024-11698 | unspecified – < 128.5 | A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dial | CRITICAL 9.8 | 0.7 % | ||
| CVE-2024-11704 | unspecified – < 128.7 | A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specific conditions, the s | CRITICAL 9.8 | 0.9 % | ||
| CVE-2024-11697 | unspecified – < 128.5 | When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog | HIGH 8.8 | 0.8 % | ||
| CVE-2024-11696 | unspecified – < 128.5 | The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw | MEDIUM 5.4 | 0.3 % | ||
| CVE-2024-11695 | unspecified – < 128.5 | A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spo | MEDIUM 5.4 | 0.4 % | ||
| CVE-2024-11694 | unspecified – < 128.5 | Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google Safe | MEDIUM 6.1 | 0.5 % | ||
| CVE-2024-11693 | unspecified – < 128.5 | The executable file warning was not presented when downloading .library-ms files. *Note: This issue only affected Windows operating system | CRITICAL 9.8 | 0.8 % | ||
| CVE-2024-11692 | unspecified – < 128.5 | An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks. | MEDIUM 4.3 | 0.5 % | ||
| CVE-2024-11691 | unspecified – < 128.5 | Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corruption due to a flaw in | HIGH 8.8 | 0.7 % | ||
| CVE-2024-10467 | unspecified – < 128.4 | Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence of memory corruption | CRITICAL 9.8 | 0.6 % | ||
| CVE-2024-10466 | unspecified – < 128.4 | By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive. | HIGH 7.5 | 0.8 % | ||
| CVE-2024-10465 | unspecified – < 128.4 | A clipboard "paste" button could persist across tabs which allowed a spoofing attack. This vulnerability affects Firefox < 132, Firefox ESR | HIGH 7.5 | 0.6 % | ||
| CVE-2024-10464 | unspecified – < 128.4 | Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser. This was address | HIGH 7.5 | 0.6 % | ||
| CVE-2024-10463 | unspecified – < 128.4 | Video frames could have been leaked between origins in some situations. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firef | HIGH 7.5 | 0.7 % | ||
| CVE-2024-10462 | unspecified – < 128.4 | Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox < 132, Firefox ESR < | HIGH 7.5 | 0.6 % | ||
| CVE-2024-10461 | unspecified – < 128.4 | In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a downl | MEDIUM 6.1 | 0.6 % | ||
| CVE-2024-10460 | unspecified – < 128.4 | The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects | MEDIUM 5.4 | 0.3 % | ||
| CVE-2024-10459 | unspecified – < 128.4 | An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerabilit | HIGH 7.5 | 0.6 % | ||
| CVE-2024-10458 | unspecified – < 128.4 | A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects | HIGH 7.5 | 0.6 % | ||
| CVE-2024-9680 | unspecified – < 128.3.1 | An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had rep | CRITICAL 9.8 | 23 % | KEV | |
| CVE-2024-9402 | unspecified – < 128.3 | Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption | CRITICAL 9.8 | 0.6 % | ||
| CVE-2024-9401 | unspecified – < 128.3 | Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence | CRITICAL 9.8 | 0.7 % | ||
| CVE-2024-9400 | unspecified – < 128.3 | A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during | HIGH 8.8 | 0.5 % | ||
| CVE-2024-9399 | unspecified – < 128.3 | A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a denial of service con | HIGH 7.5 | 0.5 % | ||
| CVE-2024-9398 | unspecified – < 128.3 | By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application whi | MEDIUM 5.3 | 0.6 % | ||
| CVE-2024-9397 | unspecified – < 128.3 | A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking | MEDIUM 6.1 | 0.4 % | ||
| CVE-2024-9396 | unspecified – < 128.3 | It is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain objects could lead to m | HIGH 8.8 | 0.6 % | ||
| CVE-2024-9394 | unspecified – < 128.3 | An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin. This co | HIGH 7.5 | 0.5 % | ||
| CVE-2024-9393 | unspecified – < 128.3 | An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin. This coul | HIGH 7.5 | 0.4 % | ||
| CVE-2024-9392 | unspecified – < 128.3 | A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox < 131, | CRITICAL 9.8 | 0.5 % | ||
| CVE-2024-8900 | unspecified – < 128.3 | An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. This vuln | HIGH 7.5 | 0.4 % | ||
| CVE-2024-7652 | unspecified – < 115.13 | Type Confusion in Async Generators in Javascript Engine | HIGH 7.5 | 0.7 % | ||
| CVE-2024-8387 | unspecified – < 128.2 | Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence of memory corruption | CRITICAL 9.8 | 0.6 % | ||
| CVE-2024-8386 | unspecified – < 128.2 | If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform | MEDIUM 6.1 | 0.4 % | ||
| CVE-2024-8385 | unspecified – < 128.2 | A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability. Th | CRITICAL 9.8 | 0.6 % | ||
| CVE-2024-8384 | unspecified – < 128.2 | The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two pa | CRITICAL 9.8 | 0.7 % | ||
| CVE-2024-8383 | unspecified – < 128.2 | Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does no | HIGH 7.5 | 0.6 % | ||
| CVE-2024-8382 | unspecified – < 128.2 | Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web cont | HIGH 8.8 | 0.6 % | ||
| CVE-2024-8381 | unspecified – < 128.2 | A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environmen | CRITICAL 9.8 | 4.4 % | ||
| CVE-2024-7531 | unspecified – < 115.14 | Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge | MEDIUM 6.5 | 0.4 % | ||
| CVE-2024-7529 | unspecified – < 115.14 | The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. | HIGH 8.1 | 0.5 % | ||
| CVE-2024-7528 | unspecified – < 128.1 | Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox | CRITICAL 9.8 | 0.5 % | ||
| CVE-2024-7527 | unspecified – < 115.14 | Unexpected marking work at the start of sweeping could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < | HIGH 8.8 | 0.6 % | ||
| CVE-2024-7526 | unspecified – < 115.14 | ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from m | HIGH 7.5 | 0.6 % | ||
| CVE-2024-7525 | unspecified – < 115.14 | It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response | CRITICAL 9.1 | 0.6 % | ||
| CVE-2024-7524 | unspecified – < 115.14 | Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a site protected by Cont | MEDIUM 6.1 | 0.5 % | ||
| CVE-2024-7522 | unspecified – < 115.14 | Editor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 129, Fire | CRITICAL 9.1 | 0.6 % | ||
| CVE-2024-7521 | unspecified – < 115.14 | Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, | CRITICAL 9.8 | 0.6 % | ||
| CVE-2024-7520 | unspecified – < 128.1 | A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution. This vulnerability affects Fire | HIGH 8.8 | 0.6 % | ||
| CVE-2024-7519 | unspecified – < 115.14 | Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to pe | CRITICAL 9.6 | 0.6 % | ||
| CVE-2024-7518 | unspecified – < 128.1 | Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a spoofing attack. This v | MEDIUM 6.5 | 0.5 % | ||
| CVE-2024-6604 | unspecified – < 115.13 | Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13 | HIGH 7.5 | 0.5 % | ||
| CVE-2024-6603 | unspecified – < 115.13 | Memory corruption in thread creation | HIGH 7.4 | 0.5 % | ||
| CVE-2024-6602 | unspecified – < 115.13 | Memory corruption in NSS | CRITICAL 9.8 | 1.0 % | ||
| CVE-2024-6601 | unspecified – < 115.13 | Race condition in permission assignment | MEDIUM 4.7 | 0.4 % | ||
| CVE-2024-6600 | unspecified – < 115.13 | Memory corruption in WebGL API | MEDIUM 6.3 | 0.4 % | ||
| CVE-2024-5700 | unspecified – < 115.12 | Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed evidence of memory corrupti | HIGH 7.0 | 0.4 % | ||
| CVE-2024-5696 | unspecified – < 115.12 | By manipulating the text in an `<input>` tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash. | HIGH 8.6 | 0.8 % | ||
| CVE-2024-5693 | unspecified – < 115.12 | Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of sa | MEDIUM 6.1 | 0.6 % | ||
| CVE-2024-5692 | unspecified – < 115.12 | On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed ext | MEDIUM 6.5 | 0.6 % | ||
| CVE-2024-5691 | unspecified – < 115.12 | By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would | MEDIUM 4.7 | 0.7 % | ||
| CVE-2024-5702 | unspecified – < 115.12 | Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125, Firef | HIGH 7.5 | 0.9 % | ||
| CVE-2024-5690 | unspecified – < 115.12 | By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's | MEDIUM 4.3 | 0.7 % | ||
| CVE-2024-5688 | unspecified – < 115.12 | If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant. This vulnerability a | HIGH 8.1 | 1.1 % | ||
| CVE-2024-4777 | unspecified – < 115.11 | Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed evidence of memory corrupti | HIGH 8.8 | 0.5 % | ||
| CVE-2024-4770 | unspecified – < 115.11 | When saving a page to PDF, certain font styles could have led to a potential use-after-free crash. This vulnerability affects Firefox < 126, | HIGH 8.8 | 0.6 % | ||
| CVE-2024-4769 | unspecified – < 115.11 | When importing resources using Web Workers, error messages would distinguish the difference between `application/javascript` responses and n | MEDIUM 5.9 | 0.4 % | ||
| CVE-2024-4768 | unspecified – < 115.11 | A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting permissions. This vulne | MEDIUM 6.1 | 0.5 % | ||
| CVE-2024-4767 | unspecified – < 115.11 | If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the window was closed. This | MEDIUM 4.3 | 0.5 % | ||
| CVE-2024-4367 | unspecified – < 115.11 | A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnera | HIGH 8.8 | 71 % | ||
| CVE-2024-3864 | unspecified – < 115.10 | Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed evidence of memory corruption and we pre | HIGH 8.1 | 0.9 % | ||
| CVE-2024-3302 | unspecified – < 115.10 | There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory | LOW 3.7 | 0.8 % | ||
| CVE-2024-3863 | unspecified – < 115.10 | The executable file warning was not presented when downloading .xrm-ms files. *Note: This issue only affected Windows operating systems. O | CRITICAL 9.8 | 0.8 % | ||
| CVE-2024-3861 | unspecified – < 115.10 | If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and later use-after-free. | MEDIUM 4.0 | 0.2 % | ||
| CVE-2024-3859 | unspecified – < 115.10 | On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered by a malformed OpenTyp | MEDIUM 5.9 | 0.7 % | ||
| CVE-2024-3857 | unspecified – < 115.10 | The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free crashes during garbage collection. This | HIGH 7.8 | 0.2 % | ||
| CVE-2024-3854 | unspecified – < 115.10 | In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-bounds-reads. This vulnerability affect | HIGH 8.8 | 0.7 % | ||
| CVE-2024-3852 | unspecified – < 115.10 | GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects Firefox < 125, Fire | HIGH 7.5 | 0.6 % | ||
| CVE-2024-29944 | unspecified – < 115.9.1 | An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent proce | HIGH 8.4 | 4.7 % | ||
| CVE-2024-2616 | unspecified – < 115.9 | To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead of attempt to continue. This vuln | LOW 2.7 | 0.7 % | ||
| CVE-2024-2614 | unspecified – < 115.9 | Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence of memory corruption | HIGH 8.8 | 0.9 % | ||
| CVE-2024-2612 | unspecified – < 115.9 | If an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have triggered a crash or potentially be leverag | HIGH 8.1 | 1.0 % | ||
| CVE-2024-2611 | unspecified – < 115.9 | A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions. This vulnerabil | MEDIUM 5.5 | 0.6 % | ||
| CVE-2024-2610 | unspecified – < 115.9 | Using a markup injection an attacker could have stolen nonce values. This could have been used to bypass strict content security policies. T | MEDIUM 6.1 | 0.7 % | ||
| CVE-2024-2609 | unspecified – < 115.10 | The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websi | MEDIUM 6.1 | 0.6 % | ||
| CVE-2023-5388 | unspecified – < 115.9 | NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recov | MEDIUM 6.5 | 1.0 % | ||
| CVE-2024-2608 | unspecified – < 115.9 | `AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienced integer overflows, | HIGH 8.4 | 0.4 % | ||
| CVE-2024-2607 | unspecified – < 115.9 | Return registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:* This issue only affected Armv7-A s | HIGH 8.1 | 1.1 % | ||
| CVE-2024-2605 | unspecified – < 115.9 | An attacker could have leveraged the Windows Error Reporter to run arbitrary code on the system escaping the sandbox. *Note:* This issue onl | MEDIUM 5.9 | 0.6 % | ||
| CVE-2024-1553 | unspecified – < 115.8 | Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs showed evidence of memory corruption | HIGH 8.1 | 0.9 % | ||
| CVE-2024-1552 | unspecified – < 115.8 | Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* This issue only affects | HIGH 7.5 | 0.7 % | ||
| CVE-2024-1551 | unspecified – < 115.8 | Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type respon | MEDIUM 6.1 | 0.7 % | ||
| CVE-2024-1550 | unspecified – < 115.8 | A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-pos | MEDIUM 6.1 | 0.6 % | ||
| CVE-2024-1549 | unspecified – < 115.8 | If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potentially resulting in us | MEDIUM 6.1 | 0.5 % | ||
| CVE-2024-1548 | unspecified – < 115.8 | A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led to user confusion an | MEDIUM 4.3 | 0.9 % | ||
| CVE-2024-1547 | unspecified – < 115.8 | Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another website (with the vict | MEDIUM 6.5 | 0.7 % | ||
| CVE-2024-1546 | unspecified – < 115.8 | When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memo | HIGH 7.5 | 0.7 % | ||
| CVE-2024-0743 | unspecified – < 115.9 | An unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This vulnerability affects Firefox < 122, | HIGH 7.5 | 1.3 % | ||
| CVE-2024-0755 | unspecified – < 115.7 | Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidence of memory corruption | HIGH 8.8 | 0.8 % | ||
| CVE-2024-0753 | unspecified – < 115.7 | In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability affects Firefox < 122, Firefox ESR < | MEDIUM 6.5 | 0.7 % | ||
| CVE-2024-0751 | unspecified – < 115.7 | A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, a | HIGH 8.8 | 0.6 % | ||
| CVE-2024-0750 | unspecified – < 115.7 | A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This v | HIGH 8.8 | 0.8 % | ||
| CVE-2024-0747 | unspecified – < 115.7 | When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have overridden the child Cont | MEDIUM 6.5 | 0.6 % | ||
| CVE-2024-0746 | unspecified – < 115.7 | A Linux user opening the print preview dialog could have caused the browser to crash. This vulnerability affects Firefox < 122, Firefox ESR | MEDIUM 6.5 | 0.7 % | ||
| CVE-2024-0742 | unspecified – < 115.7 | It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timesta | MEDIUM 4.3 | 0.6 % | ||
| CVE-2024-0741 | unspecified – < 115.7 | An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerabil | MEDIUM 6.5 | 2.2 % | ||
| CVE-2023-6867 | unspecified – < 115.6 | The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission pro | MEDIUM 6.1 | 0.7 % | ||
| CVE-2023-6865 | unspecified – < 115.6 | `EncryptingOutputStream` was susceptible to exposing uninitialized data. This issue could only be abused in order to write data to a local | MEDIUM 6.5 | 0.9 % | ||
| CVE-2023-6864 | unspecified – < 115.6 | Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence of memory corruption | HIGH 8.8 | 1.2 % | ||
| CVE-2023-6863 | unspecified – < 115.6 | The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destr | HIGH 8.8 | 1.0 % | ||
| CVE-2023-6862 | unspecified – < 115.6 | A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during start-up. This vulnerability affe | HIGH 8.8 | 1.0 % | ||
| CVE-2023-6861 | unspecified – < 115.6 | The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode. This vulnerability affects | HIGH 8.8 | 1.4 % | ||
| CVE-2023-6860 | unspecified – < 115.6 | The `VideoBridge` allowed any content process to use textures produced by remote decoders. This could be abused to escape the sandbox. This | MEDIUM 6.5 | 1.0 % | ||
| CVE-2023-6859 | unspecified – < 115.6 | A use-after-free condition affected TLS socket creation when under memory pressure. This vulnerability affects Firefox ESR < 115.6, Thunderb | HIGH 8.8 | 1.1 % | ||
| CVE-2023-6858 | unspecified – < 115.6 | Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling. This vulnerability affects Firefox E | HIGH 8.8 | 1.5 % | ||
| CVE-2023-6857 | unspecified – < 115.6 | When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary. *This bug only aff | MEDIUM 5.3 | 0.7 % | ||
| CVE-2023-6856 | unspecified – < 115.6 | The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue | HIGH 8.8 | 21 % | ||
| CVE-2023-6212 | unspecified – < 115.5.0 | Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence of memory corruption | HIGH 8.8 | 0.9 % | ||
| CVE-2023-6209 | unspecified – < 115.5.0 | Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override th | MEDIUM 6.5 | 1.4 % | ||
| CVE-2023-6208 | unspecified – < 115.5.0 | When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not | HIGH 8.8 | 0.9 % | ||
| CVE-2023-6207 | unspecified – < 115.5.0 | Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and | HIGH 8.8 | 0.9 % | ||
| CVE-2023-6206 | unspecified – < 115.5.0 | The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible | MEDIUM 5.4 | 0.6 % | ||
| CVE-2023-6205 | unspecified – < 115.5.0 | It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash. | MEDIUM 6.5 | 0.9 % | ||
| CVE-2023-6204 | unspecified – < 115.5.0 | On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the | MEDIUM 6.5 | 0.8 % | ||
| CVE-2023-5732 | unspecified – < 115.4 | Address bar spoofing via bidirectional characters | MEDIUM 6.5 | 1.0 % | ||
| CVE-2023-5730 | unspecified – < 115.4 | Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs showed evidence of memory corruption | CRITICAL 9.8 | 1.6 % | ||
| CVE-2023-5728 | unspecified – < 115.4 | During garbage collection extra operations were performed on a object that should not be. This could have led to a potentially exploitable c | HIGH 7.5 | 1.3 % | ||
| CVE-2023-5727 | unspecified – < 115.4 | The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle files, which can run commands on a | MEDIUM 6.5 | 0.8 % | ||
| CVE-2023-5726 | unspecified – < 115.4 | A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible | MEDIUM 4.3 | 0.7 % | ||
| CVE-2023-5725 | unspecified – < 115.4 | A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive use | MEDIUM 4.3 | 1.0 % | ||
| CVE-2023-5724 | unspecified – < 115.4 | Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash. This vulnerability af | HIGH 7.5 | 1.6 % | ||
| CVE-2023-5721 | unspecified – < 115.4 | It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient acti | MEDIUM 4.3 | 0.9 % | ||
| CVE-2023-5176 | unspecified – < 115.3 | Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption | CRITICAL 9.8 | 1.4 % | ||
| CVE-2023-5174 | unspecified – < 115.3 | If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in | CRITICAL 9.8 | 1.2 % | ||
| CVE-2023-5171 | unspecified – < 115.3 | During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, | MEDIUM 6.5 | 1.1 % | ||
| CVE-2023-5169 | unspecified – < 115.3 | A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds write, leading to a pote | MEDIUM 6.5 | 1.1 % | ||
| CVE-2023-5168 | unspecified – < 115.3 | A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a poten | CRITICAL 9.8 | 1.1 % | ||
| CVE-2023-4585 | unspecified – < 115.2 | Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2 | HIGH 8.8 | 0.8 % | ||
| CVE-2023-4584 | unspecified – < 102.15 | Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 | HIGH 8.8 | 0.8 % | ||
| CVE-2023-4583 | unspecified – < 115.2 | Browsing Context potentially not cleared when closing Private Window | HIGH 7.5 | 0.7 % | ||
| CVE-2023-4582 | unspecified – < 115.2 | Buffer Overflow in WebGL glGetProgramiv | HIGH 8.8 | 0.9 % | ||
| CVE-2023-4581 | unspecified – < 102.15 | XLL file extensions were downloadable without warnings | MEDIUM 4.3 | 0.6 % | ||
| CVE-2023-4580 | unspecified – < 115.2 | Push notifications saved to disk unencrypted | MEDIUM 6.5 | 0.4 % | ||
| CVE-2023-4578 | unspecified – < 115.2 | Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception | MEDIUM 6.5 | 0.6 % | ||
| CVE-2023-4577 | unspecified – < 115.2 | Memory corruption in JIT UpdateRegExpStatics | MEDIUM 6.5 | 0.7 % | ||
| CVE-2023-4576 | unspecified – < 102.15 | Integer Overflow in RecordedSourceSurfaceCreation | HIGH 8.6 | 0.8 % | ||
| CVE-2023-4575 | unspecified – < 102.15 | Memory corruption in IPC FilePickerShownCallback | MEDIUM 6.5 | 0.7 % | ||
| CVE-2023-4574 | unspecified – < 102.15 | Memory corruption in IPC ColorPickerShownCallback | MEDIUM 6.5 | 0.7 % | ||
| CVE-2023-4573 | unspecified – < 102.15 | Memory corruption in IPC CanvasTranslator | MEDIUM 6.5 | 0.6 % | ||
| CVE-2023-4057 | unspecified – < 115.1 | Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence of memory corruption | CRITICAL 9.8 | 0.9 % | ||
| CVE-2023-4056 | unspecified – < 102.14 | Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. Some of these b | CRITICAL 9.8 | 0.9 % | ||
| CVE-2023-4055 | unspecified – < 102.14 | When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent wit | HIGH 7.5 | 0.7 % | ||
| CVE-2023-4054 | unspecified – < 102.14 | When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only affects Firefox on | MEDIUM 5.5 | 0.2 % | ||
| CVE-2023-4053 | unspecified – < 115.2 | Full screen notification obscured by external program | MEDIUM 6.5 | 0.8 % | ||
| CVE-2023-4052 | unspecified – < 115.1 | The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be re | MEDIUM 6.5 | 0.7 % | ||
| CVE-2023-4051 | unspecified – < 115.2 | Full screen notification obscured by file open dialog | HIGH 7.5 | 0.7 % | ||
| CVE-2023-4050 | unspecified – < 102.14 | In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a potentially exploitable | HIGH 7.5 | 13 % | ||
| CVE-2023-4049 | unspecified – < 102.14 | Race conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-afte | MEDIUM 5.9 | 0.6 % | ||
| CVE-2023-4048 | unspecified – < 102.14 | An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations. This vulnerability a | HIGH 7.5 | 0.9 % | ||
| CVE-2023-4047 | unspecified – < 102.14 | A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This v | HIGH 8.8 | 0.6 % | ||
| CVE-2023-4046 | unspecified – < 102.14 | In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation | MEDIUM 5.3 | 1.1 % | ||
| CVE-2023-4045 | unspecified – < 102.14 | Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violatio | MEDIUM 5.3 | 0.6 % | ||
| CVE-2023-3600 | unspecified – < 115.0.2 | Use-after-free in workers | HIGH 8.8 | 0.6 % | ||
| CVE-2023-37211 | unspecified – < 102.13 | Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corrupti | HIGH 8.8 | 0.8 % | ||
| CVE-2023-37208 | unspecified – < 102.13 | When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox < | HIGH 7.8 | 0.2 % | ||
| CVE-2023-37207 | unspecified – < 102.13 | A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. | MEDIUM 6.5 | 0.7 % | ||
| CVE-2023-37202 | unspecified – < 102.13 | Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment | HIGH 8.8 | 0.8 % | ||
| CVE-2023-37201 | unspecified – < 102.13 | An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerability affects Firefox | HIGH 8.8 | 0.8 % | ||
| CVE-2023-34416 | unspecified – < 102.12 | Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corrupti | CRITICAL 9.8 | 0.9 % | ||
| CVE-2023-34414 | unspecified – < 102.12 | The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialo | LOW 3.1 | 0.9 % | ||
| CVE-2023-29545 | unspecified – < 102.10 | Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have reso | MEDIUM 6.5 | 0.6 % | ||
| CVE-2023-29542 | unspecified – < 102.10 | A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as | CRITICAL 9.8 | 0.9 % | ||
| CVE-2023-29532 | unspecified – < 102.10 | A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file o | MEDIUM 5.5 | 0.2 % | ||
| CVE-2023-29531 | unspecified – < 102.10 | An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable cr | CRITICAL 9.8 | 1.0 % | ||
| CVE-2023-32214 | unspecified – < 102.11 | Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service. *Note: This attack only affects Windo | HIGH 7.5 | 0.9 % | ||
| CVE-2023-32215 | unspecified – < 102.11 | Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla | HIGH 8.8 | 0.8 % | ||
| CVE-2023-32213 | unspecified – < 102.11 | When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox < 113, Firefox ESR < 102. | HIGH 8.8 | 0.8 % | ||
| CVE-2023-32212 | unspecified – < 102.11 | An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 1 | MEDIUM 4.3 | 0.6 % | ||
| CVE-2023-32211 | unspecified – < 102.11 | A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thund | MEDIUM 6.5 | 0.7 % | ||
| CVE-2023-32207 | unspecified – < 102.11 | A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerabi | HIGH 8.8 | 0.7 % | ||
| CVE-2023-32206 | unspecified – < 102.11 | An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, an | MEDIUM 6.5 | 0.7 % | ||
| CVE-2023-32205 | unspecified – < 102.11 | In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion | MEDIUM 4.3 | 0.6 % | ||
| CVE-2023-29550 | unspecified – < 102.10 | Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that | HIGH 8.8 | 0.7 % | ||
| CVE-2023-29548 | unspecified – < 102.10 | A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Fo | MEDIUM 6.5 | 0.7 % | ||
| CVE-2023-29541 | unspecified – < 102.10 | Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled comm | HIGH 8.8 | 0.7 % | ||
| CVE-2023-29539 | unspecified – < 102.10 | When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL cha | HIGH 8.8 | 0.7 % | ||
| CVE-2023-29536 | unspecified – < 102.10 | An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertio | HIGH 8.8 | 0.7 % | ||
| CVE-2023-29535 | unspecified – < 102.10 | Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corrup | MEDIUM 6.5 | 0.7 % | ||
| CVE-2023-29533 | unspecified – < 102.10 | A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>win | MEDIUM 4.3 | 0.6 % | ||
| CVE-2023-28176 | unspecified – < 102.9 | Memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruption and we presume that | HIGH 8.8 | 0.7 % | ||
| CVE-2023-28164 | unspecified – < 102.9 | Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. Th | MEDIUM 6.5 | 0.3 % | ||
| CVE-2023-28163 | unspecified – < 102.9 | When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would h | MEDIUM 6.5 | 0.8 % | ||
| CVE-2023-28162 | unspecified – < 102.9 | While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentially | HIGH 8.8 | 0.7 % | ||
| CVE-2023-25752 | unspecified – < 102.9 | When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may ha | MEDIUM 6.5 | 0.6 % | ||
| CVE-2023-25751 | unspecified – < 102.9 | Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lea | MEDIUM 6.5 | 0.7 % | ||
| CVE-2023-25746 | unspecified – < 102.8 | Memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough eff | HIGH 8.8 | 0.7 % | ||
| CVE-2023-25744 | unspecified – < 102.8 | Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume tha | HIGH 8.8 | 0.7 % | ||
| CVE-2023-25743 | unspecified – < 102.8 | A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>*This bug only | HIGH 7.5 | 0.6 % | ||
| CVE-2023-25742 | unspecified – < 102.8 | When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. This vulnerability affec | MEDIUM 6.5 | 0.6 % |