Mozilla Firefox Esr vulnerabilities

CVE-2017-7825 [MEDIUM] CWE-20 CVE-2017-7825: Several fonts on OS X display some Tibetan and Arabic characters as whitespace. When used in the add Several fonts on OS X display some Tibetan and Arabic characters as whitespace. When used in the addressbar as part of an IDN this can be used for domain name spoofing attacks. Note: This attack only affects OS X operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.

CVE-2024-2611 [MEDIUM] CVE-2024-2611: A missing delay on when pointer lock was used could have allowed a malicious page to trick a user in A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.

CVE-2019-11761 [MEDIUM] CWE-362 CVE-2019-11761: By using a form with a data URI it was possible to gain access to the privileged JSONView object tha By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

CVE-2024-11696 [MEDIUM] CWE-347 CVE-2024-11696: The application failed to account for exceptions thrown by the `loadManifestFromFile` method during The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated ad

CVE-2026-12298 [MEDIUM] Mozilla Foundation Security Advisory 2026-58: CVE-2026-12298 Mozilla Foundation Security Advisory 2026-58 CVE: CVE-2026-12298 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.12

CVE-2026-109725 [MEDIUM] Mozilla Foundation Security Advisory 2026-107: CVE-2026-109725 Mozilla Foundation Security Advisory 2026-107 CVE: CVE-2026-109725 Product: Firefox ESR Impact: moderate Fixed in: Firefox ESR 115.43

CVE-2026-84120 [MEDIUM] Mozilla Foundation Security Advisory 2026-85: CVE-2026-84120 Mozilla Foundation Security Advisory 2026-85 CVE: CVE-2026-84120 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 153.2

CVE-2026-109713 [MEDIUM] Mozilla Foundation Security Advisory 2026-108: CVE-2026-109713 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109713 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2026-84122 [MEDIUM] Mozilla Foundation Security Advisory 2026-84: CVE-2026-84122 Mozilla Foundation Security Advisory 2026-84 CVE: CVE-2026-84122 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.15

CVE-2026-8391 [MEDIUM] Mozilla Foundation Security Advisory 2026-47: CVE-2026-8391 Mozilla Foundation Security Advisory 2026-47 CVE: CVE-2026-8391 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.36

CVE-2026-92005 Mozilla Foundation Security Advisory 2026-93: CVE-2026-92005 Mozilla Foundation Security Advisory 2026-93 CVE: CVE-2026-92005 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.3

CVE-2026-84139 Mozilla Foundation Security Advisory 2026-85: CVE-2026-84139 Mozilla Foundation Security Advisory 2026-85 CVE: CVE-2026-84139 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 153.2

CVE-2014-8638 [MEDIUM] CWE-352 CVE-2014-8638: The navigator.sendBeacon implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4 The navigator.sendBeacon implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 omits the CORS Origin header, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site.

CVE-2019-17022 [MEDIUM] CWE-79 CVE-2019-17022: When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer does When pasting a tag from the clipboard into a rich text editor, the CSS sanitizer does not escape characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, th

CVE-2021-43543 [MEDIUM] CWE-79 CVE-2021-43543: Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

CVE-2022-40956 [MEDIUM] CWE-79 CVE-2022-40956: When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and acce When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.

CVE-2022-45418 [MEDIUM] CWE-1021 CVE-2022-45418: If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.

CVE-2019-11762 [MEDIUM] CWE-346 CVE-2019-11762: If two same-origin documents set document.domain differently to become cross-origin, it was possible If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin window. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

CVE-2017-5408 [MEDIUM] CWE-200 CVE-2017-5408: Video files loaded video captions cross-origin without checking for the presence of CORS headers per Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVE-2024-8386 [MEDIUM] CWE-601 CVE-2024-8386: If a site had been granted the permission to open popup windows, it could cause Select elements to a If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2.