FE
Product
Firefox ESR
On CISA KEVExploited in the wildRansomware-linked
506
CVEs
9
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 54High 212Medium 185Low 3
Watch
Add Firefox ESR to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-17011 | 7.5 | Jan 8 | Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially… Affected: before 68.3 |
| CVE-2019-17010 | 7.5 | Jan 8 | Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a… Affected: before 68.3 |
| CVE-2018-12393 | 7.5 | Feb 28 | A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a… Affected: before 60.3 |
| CVE-2018-12395 | 7.5 | Feb 28 | By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting Affected: before 60.3 |
| CVE-2017-7787 | 7.5 | Jun 11 | Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to… Affected: before 52.3 |
| CVE-2017-5467 | 7.5 | Jun 11 | A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region Affected: before 52.1 |
| CVE-2016-9897 | 7.5 | Jun 11 | Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES Affected: before 45.6 |
| CVE-2022-22753 | 7.1 | Dec 22 | A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory Affected: before 91.6 |
| CVE-2021-29964 | 7.1 | Jun 24 | A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read Affected: before 78.11 |
| CVE-2018-12397 | 7.1 | Feb 28 | A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user Affected: before 60.3 |
| CVE-2019-11736 | 7.0 | Sep 27 | The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the… Affected: before 68.1.0 |
| CVE-2018-12385 | 7.0 | Oct 18 | A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory Affected: before 60.2.1 |
The 500 most important CVEs for this product (exploited first, then by severity)