Mozilla Firefox Esr vulnerabilities

CVE-2022-29912 [MEDIUM] CWE-601 CVE-2022-29912: Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.

CVE-2017-5405 [MEDIUM] CWE-1187 CVE-2017-5405: Certain response codes in FTP connections can result in the use of uninitialized values for ports in Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVE-2017-5383 [MEDIUM] CWE-20 CVE-2017-5383: URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger pu URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

CVE-2017-7823 [MEDIUM] CWE-79 CVE-2017-7823: The content security policy (CSP) "sandbox" directive did not create a unique origin for the documen The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to behave as if the "allow-same-origin" keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 5

CVE-2019-9801 [MEDIUM] CWE-20 CVE-2019-9801: Firefox will accept any registered Program ID as an external protocol handler and offer to launch th Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows operating systems. This should only happen if the program has specifically registered itself as a "URL Handler" in the Windows registry. *Note: This issue only affects Windows operating systems. O

CVE-2016-5291 [MEDIUM] CWE-20 CVE-2016-5291: A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. Thi A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

CVE-2020-12392 [MEDIUM] CWE-22 CVE-2020-12392: The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and

CVE-2022-28286 [MEDIUM] CWE-1021 CVE-2022-28286: Due to a layout change, iframe contents could have been rendered outside of its border. This could h Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.

CVE-2023-29532 [MEDIUM] CVE-2023-29532: A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server. The update file can be replaced after the signature check, before the use, because the write-lock requested by the service does not work on a SMB server. *Note: This attack requires local syste

CVE-2023-6857 [MEDIUM] CWE-362 CVE-2023-6857: When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be sma When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary. *This bug only affects Firefox on Unix-based operating systems (Android, Linux, MacOS). Windows is unaffected.* This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.

CVE-2026-12299 [MEDIUM] Mozilla Foundation Security Advisory 2026-58: CVE-2026-12299 Mozilla Foundation Security Advisory 2026-58 CVE: CVE-2026-12299 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.12

CVE-2015-0822 [MEDIUM] CWE-200 CVE-2015-0822: The Form Autocompletion feature in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Th The Form Autocompletion feature in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to read arbitrary files via crafted JavaScript code.

CVE-2026-109721 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109721 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109721 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2026-109731 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109731 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109731 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2026-92030 Mozilla Foundation Security Advisory 2026-92: CVE-2026-92030 Mozilla Foundation Security Advisory 2026-92 CVE: CVE-2026-92030 Product: Firefox ESR Impact: moderate Fixed in: Firefox ESR 140.16

CVE-2026-117928 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117928 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117928 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117967 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117967 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117967 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117965 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117965 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117965 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117906 Mozilla Foundation Security Advisory 2026-119: CVE-2026-117906 Mozilla Foundation Security Advisory 2026-119 CVE: CVE-2026-117906 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 115.44

CVE-2026-117992 Mozilla Foundation Security Advisory 2026-119: CVE-2026-117992 Mozilla Foundation Security Advisory 2026-119 CVE: CVE-2026-117992 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 115.44