Firefox ESR vulnerabilities

167 known vulnerabilities in Firefox ESR from Mozilla. 167 are rated high or critical, and 9 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Firefox ESR: Improperly Controlled Modification of Object Prototype Attributes

  CVE-2022-1529Dec 22, 2022MozillaEPSS 17.6%

  An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the privileged parent process. This vul

• 8.1 High severity

  Mozilla Firefox And Thunderbird Use-After-Free Exploited

  CVE-2020-6820Apr 24, 2020MozillaEPSS 7.06%

  Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.

• 8.1 High severity

  Mozilla Firefox And Thunderbird Use-After-Free Exploited

  CVE-2020-6819Apr 24, 2020MozillaEPSS 3.04%

  Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR <

• 8.8 High severity

  Mozilla Firefox And Thunderbird Type Confusion Exploited

  CVE-2019-17026Mar 2, 2020MozillaEPSS 46.3%

  Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox

• 10.0 Critical severity

  Mozilla Firefox and Thunderbird Sandbox Escape Exploited

  CVE-2019-11708Jul 23, 2019MozillaEPSS 55.9%

  Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilitie

• 8.8 High severity

  Mozilla Firefox and Thunderbird Type Confusion Exploited

  CVE-2019-11707Jul 23, 2019MozillaEPSS 38%

  A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1,

• 7.5 High severity

  Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Exploited

  CVE-2016-9079Jun 11, 2018MozillaEPSS 87.4%

  A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, a