FE
Product
Firefox ESR
On CISA KEVExploited in the wildRansomware-linked
534
CVEs
9
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 60High 223Medium 196Low 3
Watch
Add Firefox ESR to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-5691 | 4.7 | Jun 11 | By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions to open a new… Affected: before 115.12 |
| CVE-2020-6827 | 4.7 | Apr 24 | When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into displaying the incorrect URI Affected: before 68.7.0 |
| CVE-2020-12399 | 4.4 | Jul 9 | NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys Affected: before 68.9.0 |
| CVE-2024-11692 | 4.3 | Nov 26 | An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks Affected: before 128.5 |
| CVE-2024-5690 | 4.3 | Jun 11 | By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system Affected: before 115.12 |
| CVE-2024-0749 | 4.3 | Jan 23 | A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the address bar Affected: before 115.7 |
| CVE-2024-0742 | 4.3 | Jan 23 | It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent input after page… Affected: before 115.7 |
| CVE-2023-5726 | 4.3 | Oct 25 | A website could have obscured the full screen notification by using the file open dialog Affected: before 115.4 |
| CVE-2023-5725 | 4.3 | Oct 25 | A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data Affected: before 115.4 |
| CVE-2023-5721 | 4.3 | Oct 25 | It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay Affected: before 115.4 |
| CVE-2023-4581 | 4.3 | Sep 11 | Excel `.xll` add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm Affected: before 102.15 |
| CVE-2023-32212 | 4.3 | Jun 2 | An attacker could have positioned a `datalist` element to obscure the address bar Affected: before 102.11 |
| CVE-2023-32205 | 4.3 | Jun 2 | In multiple cases browser prompts could have been obscured by popups controlled by content Affected: before 102.11 |
| CVE-2023-29533 | 4.3 | Jun 2 | A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and… Affected: before 102.10 |
| CVE-2022-34472 | 4.3 | Dec 22 | If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrect error pages being shown Affected: before 91.11 |
| CVE-2022-26383 | 4.3 | Dec 22 | When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification Affected: before 91.7 |
| CVE-2022-22743 | 4.3 | Dec 22 | When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode Affected: before 91.5 |
| CVE-2021-43546 | 4.3 | Dec 8 | It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor Affected: before 91.4.0 |
| CVE-2021-43538 | 4.3 | Dec 8 | By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could… Affected: before 91.4.0 |
| CVE-2021-38509 | 4.3 | Dec 8 | Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed over top an uncontrolled… Affected: before 91.3.0 |
| CVE-2021-38508 | 4.3 | Dec 8 | By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could have obscured the… Affected: before 91.3.0 |
| CVE-2021-38506 | 4.3 | Dec 8 | Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user Affected: before 91.3.0 |
| CVE-2021-23953 | 4.3 | Feb 26 | If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data Affected: before 78.7 |
| CVE-2021-23969 | 4.3 | Feb 26 | As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page,… Affected: before 78.8 |
| CVE-2021-23968 | 4.3 | Feb 26 | If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame… Affected: before 78.8 |
| CVE-2020-35111 | 4.3 | Jan 7 | When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs Affected: before 78.6.0 |
| CVE-2020-26953 | 4.3 | Dec 9 | It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the… Affected: before 78.5 |
| CVE-2020-6797 | 4.3 | Mar 2 | By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer Affected: before 68.5.0 |
| CVE-2019-11749 | 4.3 | Sep 27 | A vulnerability exists in WebRTC where malicious web content can use probing techniques on the getUserMedia API using constraints to reveal device properties of cameras on the… Affected: before 68.1.0 |
| CVE-2019-11743 | 3.7 | Sep 27 | Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload event, which restricts access to detailed… Affected: 68.0 before 68.1.0 |
| CVE-2015-4000 | 3.7 | May 21 | The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows… Affected: 31.8 |
| CVE-2023-34414 | 3.1 | Jun 19 | The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that exploit human… Affected: before 102.12 |
| CVE-2015-2743 | – | Jul 6 | PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables excessive privileges for internal Workers, which might allow remote attackers… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2741 | – | Jul 6 | Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 do not enforce key pinning upon encountering an X.509 certificate problem that generates a… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2740 | – | Jul 6 | Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2739 | – | Jul 6 | The ArrayBufferBuilder::append function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2738 | – | Jul 6 | The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2737 | – | Jul 6 | The rx::d3d11::SetBufferData function in the Direct3D 11 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2736 | – | Jul 6 | The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2735 | – | Jul 6 | nsZipArchive.cpp in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2734 | – | Jul 6 | The CairoTextureClientD3D9::BorrowDrawTarget function in the Direct3D 9 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2733 | – | Jul 6 | Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2731 | – | Jul 6 | Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2729 | – | Jul 6 | The AudioParamTimeline::AudioNodeInputValue function in the Web Audio implementation in Mozilla Firefox before 39.0 and Firefox ESR 38.x before 38.1 does not properly calculate an… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2728 | – | Jul 6 | The IndexedDatabaseManager class in the IndexedDB implementation in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 misinterprets an unspecified… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2725 | – | Jul 6 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2724 | – | Jul 6 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 allow… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2722 | – | Jul 6 | Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2716 | – | May 14 | Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0 |
| CVE-2015-2713 | – | May 14 | Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0 |
The 500 most important CVEs for this product (exploited first, then by severity)