FE
Product
Firefox ESR
On CISA KEVExploited in the wildRansomware-linked
506
CVEs
9
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 54High 212Medium 185Low 3
Watch
Add Firefox ESR to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-11749 | 4.3 | Sep 27 | A vulnerability exists in WebRTC where malicious web content can use probing techniques on the getUserMedia API using constraints to reveal device properties of cameras on the… Affected: before 68.1.0 |
| CVE-2019-11743 | 3.7 | Sep 27 | Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload event, which restricts access to detailed… Affected: 68.0 before 68.1.0 |
| CVE-2015-4000 | 3.7 | May 21 | The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows… Affected: 31.8 |
| CVE-2023-34414 | 3.1 | Jun 19 | The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that exploit human… Affected: before 102.12 |
| CVE-2015-2743 | – | Jul 6 | PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables excessive privileges for internal Workers, which might allow remote attackers… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2741 | – | Jul 6 | Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 do not enforce key pinning upon encountering an X.509 certificate problem that generates a… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2740 | – | Jul 6 | Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2739 | – | Jul 6 | The ArrayBufferBuilder::append function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2738 | – | Jul 6 | The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2737 | – | Jul 6 | The rx::d3d11::SetBufferData function in the Direct3D 11 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2736 | – | Jul 6 | The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2735 | – | Jul 6 | nsZipArchive.cpp in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2734 | – | Jul 6 | The CairoTextureClientD3D9::BorrowDrawTarget function in the Direct3D 9 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2733 | – | Jul 6 | Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2731 | – | Jul 6 | Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2729 | – | Jul 6 | The AudioParamTimeline::AudioNodeInputValue function in the Web Audio implementation in Mozilla Firefox before 39.0 and Firefox ESR 38.x before 38.1 does not properly calculate an… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2728 | – | Jul 6 | The IndexedDatabaseManager class in the IndexedDB implementation in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 misinterprets an unspecified… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2725 | – | Jul 6 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2724 | – | Jul 6 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 allow… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2722 | – | Jul 6 | Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0; +1 more |
| CVE-2015-2716 | – | May 14 | Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0 |
| CVE-2015-2713 | – | May 14 | Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0 |
| CVE-2015-2710 | – | May 14 | Heap-based buffer overflow in the SVGTextFrame class in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0 |
| CVE-2015-2708 | – | May 14 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allow remote attackers to… Affected: 31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0 |
| CVE-2015-0807 | – | Apr 1 | The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects… Affected: 31.1; 31.2; 31.3; 31.4; 31.5 |
| CVE-2015-0801 | – | Apr 1 | Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript… Affected: 31.1; 31.2; 31.3; 31.4; 31.5 |
| CVE-2015-0818 | – | Mar 24 | Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript… Affected: 31.1; 31.2; 31.3; 31.4; 31.5 |
| CVE-2015-0817 | – | Mar 24 | The asm.js implementation in Mozilla Firefox before 36.0.3, Firefox ESR 31.x before 31.5.2, and SeaMonkey before 2.33.1 does not properly determine the cases in which bounds… Affected: 31.1; 31.2; 31.3; 31.4; 31.5 |
| CVE-2015-0836 | – | Feb 25 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allow remote attackers to… Affected: 31.1; 31.2; 31.3; 31.4; 31.5 |
| CVE-2015-0833 | – | Feb 25 | Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 on Windows, when the… Affected: 31.1; 31.2; 31.3; 31.4; 31.5 |
| CVE-2015-0831 | – | Feb 25 | Use-after-free vulnerability in the mozilla::dom::IndexedDB::IDBObjectStore::CreateIndex function in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird… Affected: 31.1; 31.2; 31.3; 31.4; 31.5 |
| CVE-2015-0827 | – | Feb 25 | Heap-based buffer overflow in the mozilla::gfx::CopyRect function in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers… Affected: 31.1; 31.2; 31.3; 31.4; 31.5 |
| CVE-2015-0822 | – | Feb 25 | The Form Autocompletion feature in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to read arbitrary files via… Affected: 31.1; 31.2; 31.3; 31.4; 31.5 |
| CVE-2014-8641 | – | Jan 14 | Use-after-free vulnerability in the WebRTC implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, and SeaMonkey before 2.32 allows remote attackers to… Affected: 31.2 |
| CVE-2014-8639 | – | Jan 14 | Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that… Affected: 31.2 |
| CVE-2014-8638 | – | Jan 14 | The navigator.sendBeacon implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 omits the CORS Origin… Affected: 31.2 |
| CVE-2014-8634 | – | Jan 14 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 allow… Affected: 31.2 |
| CVE-2014-1595 | – | Dec 11 | Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, and Thunderbird before 31.3 on Apple OS X 10.10 omit a CoreGraphics disable-logging action that is needed by… Affected: 31.2 |
| CVE-2014-1568 | – | Sep 25 | Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before… Affected: 24.8.0 |
| CVE-2014-1567 | – | Sep 3 | Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and… Affected: 24.2; 24.3; 24.4; 24.5; 24.6; 24.7 |
| CVE-2014-1562 | – | Sep 3 | Unspecified vulnerability in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before… Affected: 24.2; 24.3; 24.4; 24.5; 24.6; 24.7 |
| CVE-2014-1557 | – | Jul 23 | The ConvolveHorizontally function in Skia, as used in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, does not properly handle the… Affected: 24.2; 24.3; 24.4; 24.5; 24.6 |
| CVE-2014-1556 | – | Jul 23 | Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to execute arbitrary code via crafted WebGL content constructed with… Affected: 24.2; 24.3; 24.4; 24.5; 24.6 |
| CVE-2014-1555 | – | Jul 23 | Use-after-free vulnerability in the nsDocLoader::OnProgress function in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allows remote… Affected: 24.2; 24.3; 24.4; 24.5; 24.6 |
| CVE-2014-1551 | – | Jul 23 | Use-after-free vulnerability in the FontTableRec destructor in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 on Windows allows remote… Affected: 24.2; 24.3; 24.4; 24.5; 24.6 |
| CVE-2014-1547 | – | Jul 23 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to… Affected: 24.2; 24.3; 24.4; 24.5; 24.6 |
| CVE-2014-1544 | – | Jul 23 | Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x… Affected: 24.2; 24.3; 24.4; 24.5; 24.6 |
| CVE-2014-1541 | – | Jun 11 | Use-after-free vulnerability in the RefreshDriverTimer::TickDriver function in the SMIL Animation Controller in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and… Affected: 24.2; 24.3; 24.4; 24.5 |
| CVE-2014-1538 | – | Jun 11 | Use-after-free vulnerability in the nsTextEditRules::CreateMozBR function in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote… Affected: 24.2; 24.3; 24.4; 24.5 |
| CVE-2014-1533 | – | Jun 11 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allow remote attackers to… Affected: 24.2; 24.3; 24.4; 24.5 |
The 500 most important CVEs for this product (exploited first, then by severity)