Lucene search

K

Firefox ESR Security Vulnerabilities

cve
cve

CVE-2017-7754

An out-of-bounds read in WebGL with a maliciously crafted "ImageInfo" object during WebGL operations. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird <...

7.5CVSS

7.6AI Score

0.004EPSS

2018-06-11 09:29 PM
67
cve
cve

CVE-2017-5460

A use-after-free vulnerability in frame selection triggered by a combination of malicious script content and key presses by a user. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox <...

9.8CVSS

8.3AI Score

0.01EPSS

2018-06-11 09:29 PM
76
cve
cve

CVE-2017-5456

A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and write access to the local file system. This vulnerability affects Firefox ESR < 52.1 and Firefox <...

9.8CVSS

7.6AI Score

0.052EPSS

2018-06-11 09:29 PM
55
cve
cve

CVE-2017-5444

A buffer overflow vulnerability while parsing "application/http-index-format" format content when the header contains improperly formatted data. This allows for an out-of-bounds read of data from memory. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1,...

7.5CVSS

8.2AI Score

0.249EPSS

2018-06-11 09:29 PM
86
cve
cve

CVE-2017-5454

A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. This vulnerability affects Thunderbird < 52.1,...

7.5CVSS

7.7AI Score

0.003EPSS

2018-06-11 09:29 PM
64
cve
cve

CVE-2017-5447

An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitable crash and could allow an attacker to read otherwise inaccessible memory. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Fire...

9.1CVSS

7.9AI Score

0.019EPSS

2018-06-11 09:29 PM
92
cve
cve

CVE-2017-5442

A use-after-free vulnerability during changes in style when manipulating DOM elements. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox <...

9.8CVSS

8.3AI Score

0.007EPSS

2018-06-11 09:29 PM
77
cve
cve

CVE-2017-5449

A possibly exploitable crash triggered during layout and manipulation of bidirectional unicode text in concert with CSS animations. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox <...

7.5CVSS

8.1AI Score

0.01EPSS

2018-06-11 09:29 PM
69
cve
cve

CVE-2017-5443

An out-of-bounds write vulnerability while decoding improperly formed BinHex format archives. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox <...

9.8CVSS

8.1AI Score

0.012EPSS

2018-06-11 09:29 PM
101
cve
cve

CVE-2017-5459

A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox <...

9.8CVSS

8.5AI Score

0.579EPSS

2018-06-11 09:29 PM
84
cve
cve

CVE-2017-5441

A use-after-free vulnerability when holding a selection during scroll events. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox <...

9.8CVSS

8.3AI Score

0.009EPSS

2018-06-11 09:29 PM
92
cve
cve

CVE-2017-5445

A vulnerability while parsing "application/http-index-format" format content where uninitialized values are used to create an array. This could allow the reading of uninitialized memory into the arrays affected. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR &l...

7.5CVSS

7.9AI Score

0.006EPSS

2018-06-11 09:29 PM
91
cve
cve

CVE-2017-5451

A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event. The event could be used by script to affect text display to make the loaded site appear to be different from the one actually loaded within the addressbar. This vulnerability affects...

4.3CVSS

5.7AI Score

0.002EPSS

2018-06-11 09:29 PM
53
cve
cve

CVE-2017-5448

An out-of-bounds write in "ClearKeyDecryptor" while decrypting some Clearkey-encrypted media content. The "ClearKeyDecryptor" code runs within the Gecko Media Plugin (GMP) sandbox. If a second mechanism is found to escape the sandbox, this vulnerability allows for the writing of arbitrary data...

8.6CVSS

8.2AI Score

0.011EPSS

2018-06-11 09:29 PM
75
cve
cve

CVE-2017-5446

An out-of-bounds read when an HTTP/2 connection to a servers sends "DATA" frames with incorrect data content. This leads to a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox <...

9.8CVSS

8AI Score

0.007EPSS

2018-06-11 09:29 PM
79
cve
cve

CVE-2017-5455

The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege if combined with another vulnerability that resulted in remote code execution inside the sandboxed process. This vulnerability affects Firefox ESR < 52.1 and Firefox <...

7.5CVSS

8.3AI Score

0.02EPSS

2018-06-11 09:29 PM
56
cve
cve

CVE-2017-5433

A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the animation controller while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9,.....

9.8CVSS

8.3AI Score

0.01EPSS

2018-06-11 09:29 PM
82
cve
cve

CVE-2017-5439

A use-after-free vulnerability during XSLT processing due to poor handling of template parameters. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox <...

9.8CVSS

8.3AI Score

0.007EPSS

2018-06-11 09:29 PM
94
cve
cve

CVE-2017-5432

A use-after-free vulnerability occurs during certain text input selection resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox <...

9.8CVSS

8.3AI Score

0.007EPSS

2018-06-11 09:29 PM
94
cve
cve

CVE-2017-5429

Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird &l...

9.8CVSS

9AI Score

0.006EPSS

2018-06-11 09:29 PM
75
cve
cve

CVE-2017-5438

A use-after-free vulnerability during XSLT processing due to the result handler being held by a freed handler during handling. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox <...

9.8CVSS

8.3AI Score

0.01EPSS

2018-06-11 09:29 PM
91
cve
cve

CVE-2017-5440

A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating context, leading to objects being used when they no longer exist. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1,....

9.8CVSS

8.3AI Score

0.01EPSS

2018-06-11 09:29 PM
78
cve
cve

CVE-2017-5430

Memory safety bugs were reported in Firefox 52, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.1, Firefox E...

9.8CVSS

8.8AI Score

0.013EPSS

2018-06-11 09:29 PM
62
cve
cve

CVE-2017-5434

A use-after-free vulnerability occurs when redirecting focus handling which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox <...

9.8CVSS

8.3AI Score

0.009EPSS

2018-06-11 09:29 PM
86
cve
cve

CVE-2017-5435

A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox <...

9.8CVSS

8.3AI Score

0.005EPSS

2018-06-11 09:29 PM
87
cve
cve

CVE-2017-5428

An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the "createImageBitmap" API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer....

9.8CVSS

8.8AI Score

0.604EPSS

2018-06-11 09:29 PM
69
cve
cve

CVE-2017-5436

An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9,....

8.8CVSS

8.2AI Score

0.005EPSS

2018-06-11 09:29 PM
124
cve
cve

CVE-2017-5409

The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter through the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows....

5.5CVSS

6.2AI Score

0.001EPSS

2018-06-11 09:29 PM
48
cve
cve

CVE-2017-5402

A use-after-free can occur when events are fired for a "FontFace" object after the object has been already been destroyed while working with fonts. This results in a potentially exploitable crash. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbir...

9.8CVSS

8.1AI Score

0.006EPSS

2018-06-11 09:29 PM
103
cve
cve

CVE-2017-5400

JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird <...

9.8CVSS

8.1AI Score

0.005EPSS

2018-06-11 09:29 PM
75
cve
cve

CVE-2017-5408

Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird ...

5.3CVSS

6.1AI Score

0.002EPSS

2018-06-11 09:29 PM
79
cve
cve

CVE-2017-5401

A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error. The resulting crash may be exploitable. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird <...

9.8CVSS

7.7AI Score

0.015EPSS

2018-06-11 09:29 PM
76
cve
cve

CVE-2017-5405

Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird <...

5.3CVSS

6.4AI Score

0.005EPSS

2018-06-11 09:29 PM
86
cve
cve

CVE-2017-5410

Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for memory cleanup. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird <...

9.8CVSS

8.2AI Score

0.009EPSS

2018-06-11 09:29 PM
77
cve
cve

CVE-2017-5404

A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of it. This results in a potentially exploitable crash. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird &...

9.8CVSS

8.1AI Score

0.924EPSS

2018-06-11 09:29 PM
79
cve
cve

CVE-2017-5407

Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This can be used to extract history information and read text values across domains. This violates same-origin policy and leads to information...

6.5CVSS

6.7AI Score

0.003EPSS

2018-06-11 09:29 PM
80
cve
cve

CVE-2017-5386

WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions. This vulnerability affects Firefox ESR < 45.7 and Firefox <...

7.3CVSS

7.6AI Score

0.004EPSS

2018-06-11 09:29 PM
109
4
cve
cve

CVE-2017-5396

A use-after-free vulnerability in the Media Decoder when working with media files when some events are fired after the media elements are freed from memory. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox <...

9.8CVSS

9.1AI Score

0.008EPSS

2018-06-11 09:29 PM
109
cve
cve

CVE-2017-5390

The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing JSON or HTTP headers data, allowing for potential privilege escalation. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox <...

9.8CVSS

8.9AI Score

0.004EPSS

2018-06-11 09:29 PM
126
2
cve
cve

CVE-2017-5380

A potential use-after-free found through fuzzing during DOM manipulation of SVG content. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox <...

9.8CVSS

9.1AI Score

0.005EPSS

2018-06-11 09:29 PM
121
cve
cve

CVE-2017-5383

URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox <...

5.3CVSS

6.5AI Score

0.004EPSS

2018-06-11 09:29 PM
102
cve
cve

CVE-2017-5398

Memory safety bugs were reported in Thunderbird 45.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, a...

9.8CVSS

8.8AI Score

0.005EPSS

2018-06-11 09:29 PM
71
cve
cve

CVE-2017-5376

Use-after-free while manipulating XSL in XSLT documents. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox <...

9.8CVSS

9AI Score

0.005EPSS

2018-06-11 09:29 PM
104
cve
cve

CVE-2016-9897

Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird <...

7.5CVSS

8.1AI Score

0.004EPSS

2018-06-11 09:29 PM
89
cve
cve

CVE-2016-9905

A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability affects Firefox ESR < 45.6 and Thunderbird <...

8.8CVSS

8.7AI Score

0.016EPSS

2018-06-11 09:29 PM
296
cve
cve

CVE-2016-9899

Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird <...

9.8CVSS

8.8AI Score

0.852EPSS

2018-06-11 09:29 PM
108
cve
cve

CVE-2017-5375

JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox <...

9.8CVSS

9.2AI Score

0.935EPSS

2018-06-11 09:29 PM
131
cve
cve

CVE-2016-9901

HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" (unprivileged) page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR < 45.6 and...

9.8CVSS

8.8AI Score

0.014EPSS

2018-06-11 09:29 PM
92
4
cve
cve

CVE-2016-9898

Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird <...

9.8CVSS

8.9AI Score

0.009EPSS

2018-06-11 09:29 PM
90
cve
cve

CVE-2016-9900

External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs. This could allow for cross-domain data leakage. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird <...

7.5CVSS

7.8AI Score

0.006EPSS

2018-06-11 09:29 PM
101
Total number of security vulnerabilities1129