Mozilla Firefox Esr vulnerabilities

CVE-2022-34470 [CRITICAL] CWE-416 CVE-2022-34470: Session history navigations may have led to a use-after-free and potentially exploitable crash. This Session history navigations may have led to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11.

CVE-2018-5097 [CRITICAL] CWE-416 CVE-2018-5097: A use-after-free vulnerability can occur during XSL transformations when the source document for the A use-after-free vulnerability can occur during XSL transformations when the source document for the transformation is manipulated by script content during the transformation. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.

CVE-2024-6602 [CRITICAL] CWE-94 CVE-2024-6602: A mismatch between allocator and deallocator could have led to memory corruption. This vulnerability A mismatch between allocator and deallocator could have led to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.

CVE-2022-46882 [CRITICAL] CWE-416 CVE-2022-46882: A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnera A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability affects Firefox < 107, Firefox ESR < 102.6, and Thunderbird < 102.6.

CVE-2023-34416 [CRITICAL] CWE-787 CVE-2023-34416: Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12.

CVE-2018-5102 [CRITICAL] CWE-416 CVE-2018-5102: A use-after-free vulnerability can occur when manipulating HTML media elements with media streams, r A use-after-free vulnerability can occur when manipulating HTML media elements with media streams, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.

CVE-2024-9393 [HIGH] CWE-346 CVE-2024-9393: An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under th An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin. This could allow them to access cross-origin PDF content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vu

CVE-2024-9402 [CRITICAL] CWE-119 CVE-2024-9402: Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of these b Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.

CVE-2024-8387 [CRITICAL] CWE-787 CVE-2024-8387: Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these b Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2.

CVE-2018-12368 [HIGH] CVE-2018-12368: Windows 10 does not warn users before opening executable files with the SettingContent-ms extension Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and have the "Mark of the Web." Without the warning, unsuspecting users unfamiliar with this new file type might run an unwanted executable. This also allows a WebExtension with the limited downloads.open per

CVE-2015-2731 [CRITICAL] CVE-2015-2731: Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allows remote attackers to execute arbitrary code by leveraging client-side JavaScript that triggers removal of a DOM object on the basis of a Content Policy.

CVE-2026-74964 Mozilla Foundation Security Advisory 2026-77: CVE-2026-74964 Mozilla Foundation Security Advisory 2026-77 CVE: CVE-2026-74964 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 153.1

CVE-2026-16369 Mozilla Foundation Security Advisory 2026-70: CVE-2026-16369 Mozilla Foundation Security Advisory 2026-70 CVE: CVE-2026-16369 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.13

CVE-2026-8970 [HIGH] Mozilla Foundation Security Advisory 2026-48: CVE-2026-8970 Mozilla Foundation Security Advisory 2026-48 CVE: CVE-2026-8970 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.11

CVE-2026-8959 [CRITICAL] Mozilla Foundation Security Advisory 2026-48: CVE-2026-8959 Mozilla Foundation Security Advisory 2026-48 CVE: CVE-2026-8959 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.11

CVE-2026-100788 Mozilla Foundation Security Advisory 2026-99: CVE-2026-100788 Mozilla Foundation Security Advisory 2026-99 CVE: CVE-2026-100788 Product: Firefox ESR Impact: moderate Fixed in: Firefox ESR 140.17

CVE-2026-16387 Mozilla Foundation Security Advisory 2026-70: CVE-2026-16387 Mozilla Foundation Security Advisory 2026-70 CVE: CVE-2026-16387 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.13

CVE-2026-100829 Mozilla Foundation Security Advisory 2026-100: CVE-2026-100829 Mozilla Foundation Security Advisory 2026-100 CVE: CVE-2026-100829 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.4

CVE-2026-16381 Mozilla Foundation Security Advisory 2026-70: CVE-2026-16381 Mozilla Foundation Security Advisory 2026-70 CVE: CVE-2026-16381 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.13

CVE-2014-1551 [CRITICAL] CVE-2014-1551: Use-after-free vulnerability in the FontTableRec destructor in Mozilla Firefox before 31.0, Firefox Use-after-free vulnerability in the FontTableRec destructor in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 on Windows allows remote attackers to execute arbitrary code via crafted use of fonts in MathML content, leading to improper handling of a DirectWrite font-face object.