Debian Firefox-Esr vulnerabilities

CVE-2026-4713 [HIGH] CVE-2026-4713: firefox - Incorrect boundary conditions in the Graphics component. This vulnerability affe... Incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. Scope: local sid: resolved (fixed in 149.0-1)

CVE-2016-5264 [HIGH] CVE-2016-5264: firefox - Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange ... Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application. Scope: local sid: resolved (fixed in 48.0-1)

CVE-2025-13012 [HIGH] CVE-2025-13012: firefox - Race condition in the Graphics component. This vulnerability affects Firefox < 1... Race condition in the Graphics component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Firefox ESR < 115.30, Thunderbird < 145, and Thunderbird < 140.5. Scope: local sid: resolved (fixed in 145.0-1)

CVE-2006-5747 [HIGH] CVE-2006-5747: firefox - Unspecified vulnerability in Mozilla Firefox before 1.5.0.8, Thunderbird before ... Unspecified vulnerability in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6 allows remote attackers to execute arbitrary code via the XML.prototype.hasOwnProperty JavaScript function. Scope: local sid: resolved (fixed in 45.0-1)

CVE-2022-22759 [CRITICAL] CVE-2022-22759: firefox - If a document created a sandboxed iframe without <code>allow-scripts</code>, and... If a document created a sandboxed iframe without allow-scripts, and subsequently appended an element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have run despite the iframe's sandbox. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. Scope: local sid: resolved (fixed in 97.0-1)

CVE-2025-1936 [HIGH] CVE-2025-1936: firefox - jar: URLs retrieve local file content packaged in a ZIP archive. The null and ev... jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension disguised as something else like an image. This vulnerability affects Firef

CVE-2018-5125 [HIGH] CVE-2018-5125: firefox - Memory safety bugs were reported in Firefox 58 and Firefox ESR 52.6. Some of the... Memory safety bugs were reported in Firefox 58 and Firefox ESR 52.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox < 59. Scope: local sid: resolved (fixed in 59.0-1)

CVE-2016-9905 [HIGH] CVE-2016-9905: firefox - A potentially exploitable crash in "EnumerateSubDocuments" while adding or remov... A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability affects Firefox ESR < 45.6 and Thunderbird < 45.6. Scope: local sid: resolved

CVE-2016-2795 [HIGH] CVE-2016-2795: firefox - The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as us... The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font. Scope: local sid: resolved (

CVE-2016-2790 [HIGH] CVE-2016-2790: firefox - The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as use... The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font. Scope: local sid: resolved (f

CVE-2016-1949 [HIGH] CVE-2016-1949: firefox - Mozilla Firefox before 44.0.2 does not properly restrict the interaction between... Mozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers and plugins, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that triggers spoofed responses to requests that use NPAPI, as demonstrated by a request for a crossdomain.xml file. Scope: local sid: resolved (fixed in 45.0-1)

CVE-2019-11760 [HIGH] CVE-2019-11760: firefox - A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling... A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Scope: local sid: resolved (fixed in 70.0-1)

CVE-2021-29946 [HIGH] CVE-2021-29946: firefox - Ports that were written as an integer overflow above the bounds of a 16-bit inte... Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. Scope: local sid: resolved (fixed in 88.0-1)

CVE-2021-23954 [HIGH] CVE-2021-23954: firefox - Using the new logical assignment operators in a JavaScript switch statement coul... Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. Scope: local sid: resolved (fixed in 85.0-1)

CVE-2019-11735 [HIGH] CVE-2019-11735: firefox - Mozilla developers and community members reported memory safety bugs present in ... Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1. Scope: local sid: resolved (fixed in

CVE-2021-43535 [HIGH] CVE-2021-43535: firefox - A use-after-free could have occured when an HTTP2 session object was released on... A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 93, Thunderbird < 91.3, and Firefox ESR < 91.3. Scope: local sid: resolved (fixed in 93.0-1)

CVE-2022-31741 [HIGH] CVE-2022-31741: firefox - A crafted CMS message could have been processed incorrectly, leading to an inval... A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. Scope: local sid: resolved (fixed in 101.0-1)

CVE-2017-5378 [HIGH] CVE-2017-5378: firefox - Hashed codes of JavaScript objects are shared between pages. This allows for poi... Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address can be discovered through hash codes, and also allows for data leakage of an object's content using these hash codes. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Scope: local sid: resolved (fixed in 51.0-1)

CVE-2016-5297 [CRITICAL] CVE-2016-5297: firefox - An error in argument length checking in JavaScript, leading to potential integer... An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50. Scope: local sid: resolved (fixed in 50.0-1)

CVE-2017-5410 [CRITICAL] CVE-2017-5410: firefox - Memory corruption resulting in a potentially exploitable crash during garbage co... Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for memory cleanup. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Scope: local sid: resolved (fixed in 52.0-1)