Mozilla Firefox Esr vulnerabilities

CVE-2024-7526 [MEDIUM] CWE-908 CVE-2024-7526: ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.

CVE-2024-7518 [MEDIUM] CWE-1021 CVE-2024-7518: Select options could obscure the fullscreen notification dialog. This could be used by a malicious s Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a spoofing attack. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1.

CVE-2022-38472 [MEDIUM] CWE-346 CVE-2022-38472: An attacker could have abused XSLT error handling to associate attacker-controlled content with anot An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR <

CVE-2026-100812 [MEDIUM] Mozilla Foundation Security Advisory 2026-100: CVE-2026-100812 Mozilla Foundation Security Advisory 2026-100 CVE: CVE-2026-100812 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.4

CVE-2026-12325 [MEDIUM] Mozilla Foundation Security Advisory 2026-59: CVE-2026-12325 Mozilla Foundation Security Advisory 2026-59 CVE: CVE-2026-12325 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.37

CVE-2019-9793 [MEDIUM] CWE-119 CVE-2019-9793: A mechanism was discovered that removes some bounds checking for string, array, or typed array acces A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnerability could allow an attacker to create an arbitrary value in compiled JavaScript, for which the range analysis will infer a fully controlled, incorrect range in circumstances where users have

CVE-2024-2605 [MEDIUM] CVE-2024-2605: An attacker could have leveraged the Windows Error Reporter to run arbitrary code on the system esca An attacker could have leveraged the Windows Error Reporter to run arbitrary code on the system escaping the sandbox. *Note:* This issue only affected Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.

CVE-2018-12366 [MEDIUM] CWE-125 CVE-2018-12366: An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds rea An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value. This could leak private data into the output. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

CVE-2017-7830 [MEDIUM] CVE-2017-7830: The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-ori The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5.

CVE-2026-74948 Mozilla Foundation Security Advisory 2026-76: CVE-2026-74948 Mozilla Foundation Security Advisory 2026-76 CVE: CVE-2026-74948 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.14

CVE-2026-74945 Mozilla Foundation Security Advisory 2026-76: CVE-2026-74945 Mozilla Foundation Security Advisory 2026-76 CVE: CVE-2026-74945 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.14

CVE-2026-74976 Mozilla Foundation Security Advisory 2026-76: CVE-2026-74976 Mozilla Foundation Security Advisory 2026-76 CVE: CVE-2026-74976 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.14

CVE-2026-8961 Mozilla Foundation Security Advisory 2026-48: CVE-2026-8961 Mozilla Foundation Security Advisory 2026-48 CVE: CVE-2026-8961 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.11

CVE-2026-92031 Mozilla Foundation Security Advisory 2026-93: CVE-2026-92031 Mozilla Foundation Security Advisory 2026-93 CVE: CVE-2026-92031 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.3

CVE-2026-100792 Mozilla Foundation Security Advisory 2026-100: CVE-2026-100792 Mozilla Foundation Security Advisory 2026-100 CVE: CVE-2026-100792 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.4

CVE-2026-109712 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109712 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109712 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2026-92039 Mozilla Foundation Security Advisory 2026-93: CVE-2026-92039 Mozilla Foundation Security Advisory 2026-93 CVE: CVE-2026-92039 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.3

CVE-2018-12397 [HIGH] CWE-200 CVE-2018-12397: A WebExtension can request access to local files without the warning prompt stating that the extensi A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63

CVE-2021-43536 [MEDIUM] CWE-200 CVE-2021-43536: Under certain circumstances, asynchronous functions could have caused a navigation to fail but expos Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

CVE-2019-11742 [MEDIUM] CWE-829 CVE-2019-11742: A same-origin policy violation occurs allowing the theft of cross-origin images through a combinatio A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbir