Mozilla Firefox Esr vulnerabilities

CVE-2015-2740 [CRITICAL] CWE-119 CVE-2015-2740: Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39. Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 might allow remote attackers to cause a denial of service or have unspecified other impact via unknown vectors.

CVE-2026-74946 Mozilla Foundation Security Advisory 2026-77: CVE-2026-74946 Mozilla Foundation Security Advisory 2026-77 CVE: CVE-2026-74946 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 153.1

CVE-2026-74947 Mozilla Foundation Security Advisory 2026-77: CVE-2026-74947 Mozilla Foundation Security Advisory 2026-77 CVE: CVE-2026-74947 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 153.1

CVE-2026-74965 Mozilla Foundation Security Advisory 2026-76: CVE-2026-74965 Mozilla Foundation Security Advisory 2026-76 CVE: CVE-2026-74965 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.14

CVE-2026-74953 Mozilla Foundation Security Advisory 2026-77: CVE-2026-74953 Mozilla Foundation Security Advisory 2026-77 CVE: CVE-2026-74953 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 153.1

CVE-2026-109730 Mozilla Foundation Security Advisory 2026-107: CVE-2026-109730 Mozilla Foundation Security Advisory 2026-107 CVE: CVE-2026-109730 Product: Firefox ESR Impact: moderate Fixed in: Firefox ESR 115.43

CVE-2026-100775 Mozilla Foundation Security Advisory 2026-100: CVE-2026-100775 Mozilla Foundation Security Advisory 2026-100 CVE: CVE-2026-100775 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.4

CVE-2026-109782 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109782 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109782 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2026-109783 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109783 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109783 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2020-6800 [HIGH] CWE-787 CVE-2020-6800: Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firef Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. In general, these flaws cannot be exploited through email in the Thunderbird product

CVE-2026-92064 Mozilla Foundation Security Advisory 2026-93: CVE-2026-92064 Mozilla Foundation Security Advisory 2026-93 CVE: CVE-2026-92064 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.3

CVE-2026-92065 Mozilla Foundation Security Advisory 2026-93: CVE-2026-92065 Mozilla Foundation Security Advisory 2026-93 CVE: CVE-2026-92065 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.3

CVE-2020-12410 [HIGH] CWE-787 CVE-2020-12410: Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of t Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.

CVE-2019-11746 [HIGH] CWE-416 CVE-2019-11746: A use-after-free vulnerability can occur while manipulating video elements if the body is freed whil A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.

CVE-2019-11711 [HIGH] CVE-2019-11711: When an inner window is reused, it does not consider the use of document.domain for cross-origin pro When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did not use document.domain to relax their origin security. This vul

CVE-2020-6807 [HIGH] CWE-416 CVE-2020-6807: When a device was changed while a stream was about to be destroyed, the <code>stream-reinit</code> t When a device was changed while a stream was about to be destroyed, the stream-reinit task may have been executed after the stream was destroyed, causing a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.

CVE-2019-11764 [HIGH] CWE-787 CVE-2019-11764: Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firef Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

CVE-2015-2743 [HIGH] CWE-17 CVE-2015-2743: PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables excessive privileges for internal Workers, which might allow remote attackers to execute arbitrary code by leveraging a Same Origin Policy bypass.

CVE-2021-29985 [HIGH] CWE-416 CVE-2021-29985: A use-after-free vulnerability in media channels could have led to memory corruption and a potential A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.

CVE-2021-29970 [HIGH] CWE-416 CVE-2021-29970: A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially expl A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. *This bug could only be triggered when accessibility was enabled.*. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90.