Lucene search

K

Firefox ESR Security Vulnerabilities

cve
cve

CVE-2020-15669

When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. This results in a use-after-free and we presume that with enough effort it could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.12 and...

8.8CVSS

8.4AI Score

0.003EPSS

2020-10-01 07:15 PM
309
cve
cve

CVE-2020-15664

By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious...

6.5CVSS

6.7AI Score

0.003EPSS

2020-10-01 07:15 PM
229
cve
cve

CVE-2020-15663

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back to a....

8.8CVSS

8.2AI Score

0.007EPSS

2020-10-01 07:15 PM
176
cve
cve

CVE-2020-15650

Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile). Note: This issue only affected Firefox for Android. Other operating systems are unaffected.. This vulnerability affects...

5.5CVSS

5.1AI Score

0.001EPSS

2020-08-10 06:15 PM
86
3
cve
cve

CVE-2020-15655

A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential disclosure of cross-origin information. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird <...

6.5CVSS

6.3AI Score

0.002EPSS

2020-08-10 06:15 PM
166
cve
cve

CVE-2020-15659

Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects.....

8.8CVSS

9.2AI Score

0.006EPSS

2020-08-10 06:15 PM
199
cve
cve

CVE-2020-15653

An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79...

6.5CVSS

6.7AI Score

0.002EPSS

2020-08-10 06:15 PM
174
cve
cve

CVE-2020-15658

The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog. This vulnerability affects Firefox ESR < 78.1, Firef...

6.5CVSS

6.5AI Score

0.004EPSS

2020-08-10 06:15 PM
185
cve
cve

CVE-2020-15652

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68...

6.5CVSS

6.6AI Score

0.003EPSS

2020-08-10 06:15 PM
194
cve
cve

CVE-2020-15656

JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the code, resulting in this bug rated at only moderate severity. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbir...

8.8CVSS

7.8AI Score

0.005EPSS

2020-08-10 06:15 PM
187
cve
cve

CVE-2020-15649

Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked. Note: This issue only affected Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox ESR....

5.5CVSS

5.2AI Score

0.001EPSS

2020-08-10 06:15 PM
80
4
cve
cve

CVE-2020-15657

Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker that is already capable of placing files in the installation directory. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This...

7.8CVSS

7.2AI Score

0.001EPSS

2020-08-10 06:15 PM
180
cve
cve

CVE-2020-15654

When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. This....

6.5CVSS

6.3AI Score

0.004EPSS

2020-08-10 06:15 PM
167
cve
cve

CVE-2020-12421

When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have caused add-ons to become out-of-date silently without notification to the user. This vulnerability affects Firefox ESR <....

6.5CVSS

6.7AI Score

0.005EPSS

2020-07-09 03:15 PM
183
cve
cve

CVE-2020-12417

Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash. Note: this issue only affects Firefox on ARM64 platforms. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and....

8.8CVSS

8.4AI Score

0.008EPSS

2020-07-09 03:15 PM
189
cve
cve

CVE-2020-12418

Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird <...

6.5CVSS

6.6AI Score

0.01EPSS

2020-07-09 03:15 PM
180
cve
cve

CVE-2020-12420

When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird <...

8.8CVSS

8.4AI Score

0.008EPSS

2020-07-09 03:15 PM
186
cve
cve

CVE-2020-12419

When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, ...

8.8CVSS

8.4AI Score

0.009EPSS

2020-07-09 03:15 PM
185
cve
cve

CVE-2020-12406

Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR <...

8.8CVSS

8.3AI Score

0.003EPSS

2020-07-09 03:15 PM
199
cve
cve

CVE-2020-12410

Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0...

8.8CVSS

9.2AI Score

0.003EPSS

2020-07-09 03:15 PM
192
cve
cve

CVE-2020-12399

NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR <...

4.4CVSS

5.9AI Score

0.001EPSS

2020-07-09 03:15 PM
331
cve
cve

CVE-2020-12405

When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR <...

5.3CVSS

6.3AI Score

0.002EPSS

2020-07-09 03:15 PM
197
cve
cve

CVE-2018-12371

An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 60.1, Thunderbird &lt...

8.8CVSS

8.2AI Score

0.004EPSS

2020-07-09 02:15 PM
86
cve
cve

CVE-2020-12389

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. Note: this issue only affects Firefox on Windows operating systems.. This vulnerability affects Firefox ESR < 68.8 and Firefox <...

10CVSS

8.8AI Score

0.005EPSS

2020-05-26 06:15 PM
195
cve
cve

CVE-2020-12388

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. Note: this issue only affects Firefox on Windows operating systems.. This vulnerability affects Firefox ESR < 68.8 and Firefox <...

10CVSS

8.8AI Score

0.005EPSS

2020-05-26 06:15 PM
206
cve
cve

CVE-2020-6831

A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird <...

9.8CVSS

9.5AI Score

0.015EPSS

2020-05-26 06:15 PM
233
cve
cve

CVE-2020-12392

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files. This...

5.5CVSS

6.4AI Score

0.0005EPSS

2020-05-26 06:15 PM
214
cve
cve

CVE-2020-12387

A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird <...

8.1CVSS

8.4AI Score

0.01EPSS

2020-05-26 06:15 PM
280
cve
cve

CVE-2020-12393

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command...

7.8CVSS

8.1AI Score

0.001EPSS

2020-05-26 05:15 PM
172
cve
cve

CVE-2020-12395

Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects.....

9.8CVSS

9.8AI Score

0.008EPSS

2020-05-26 05:15 PM
223
cve
cve

CVE-2020-6828

A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file overwrite in the user's profile directory. One exploitation vector for this would be to supply a user.js file providing arbitrary malicious preference...

7.5CVSS

8AI Score

0.001EPSS

2020-04-24 04:15 PM
178
cve
cve

CVE-2020-6820

Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR <...

8.1CVSS

7.3AI Score

0.009EPSS

2020-04-24 04:15 PM
1046
In Wild
cve
cve

CVE-2020-6819

Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR <...

8.1CVSS

7.3AI Score

0.024EPSS

2020-04-24 04:15 PM
1076
In Wild
cve
cve

CVE-2020-6821

When reading from areas partially or fully outside the source resource with WebGL's copyTexSubImage method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially sensitive data disclosure. This vulnerability affects Thunderbird &lt...

7.5CVSS

7.9AI Score

0.002EPSS

2020-04-24 04:15 PM
238
cve
cve

CVE-2020-6822

On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in GMPDecodeData. It is possible that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefo...

8.8CVSS

8.9AI Score

0.003EPSS

2020-04-24 04:15 PM
223
cve
cve

CVE-2020-6827

When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into displaying the incorrect URI. Note: This issue only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox ESR.....

4.7CVSS

5.8AI Score

0.001EPSS

2020-04-24 04:15 PM
165
cve
cve

CVE-2020-6825

Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary.....

9.8CVSS

9.9AI Score

0.003EPSS

2020-04-24 04:15 PM
244
cve
cve

CVE-2020-6814

Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.6,...

9.8CVSS

9.9AI Score

0.007EPSS

2020-03-25 10:15 PM
234
cve
cve

CVE-2020-6811

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as Curl' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command...

8.8CVSS

9.1AI Score

0.011EPSS

2020-03-25 10:15 PM
269
cve
cve

CVE-2020-6807

When a device was changed while a stream was about to be destroyed, the stream-reinit task may have been executed after the stream was destroyed, causing a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, an...

8.8CVSS

9AI Score

0.008EPSS

2020-03-25 10:15 PM
202
cve
cve

CVE-2020-6806

By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox...

8.8CVSS

9AI Score

0.526EPSS

2020-03-25 10:15 PM
218
cve
cve

CVE-2020-6812

The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microphone permission are able to enumerate device names, disclosing the user's name. To resolve this issue, Firefox added a special case that...

5.3CVSS

6.6AI Score

0.002EPSS

2020-03-25 10:15 PM
212
cve
cve

CVE-2020-6805

When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR <...

8.8CVSS

9AI Score

0.008EPSS

2020-03-25 10:15 PM
196
cve
cve

CVE-2020-6796

A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write. This could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 73 and Firefox <...

8.8CVSS

8.2AI Score

0.006EPSS

2020-03-02 05:15 AM
308
cve
cve

CVE-2020-6800

Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. In general, these flaws...

8.8CVSS

9.2AI Score

0.006EPSS

2020-03-02 05:15 AM
287
cve
cve

CVE-2020-6798

If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed. A site that relied on the browser behaving correctly could suffer a cross-site scripting vulnerability as a result. In general, this flaw cannot be...

6.1CVSS

6.6AI Score

0.013EPSS

2020-03-02 05:15 AM
265
cve
cve

CVE-2020-6797

By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer. The attacker is restricted as they are unable to download non-quarantined files or supply command line arguments to the application, limiting the impact....

4.3CVSS

5.5AI Score

0.001EPSS

2020-03-02 05:15 AM
230
cve
cve

CVE-2020-6799

Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types. This required Firefox to be configured as the default handler for a given file type and for a file downloaded to be opened in a third party application that...

8.8CVSS

8.2AI Score

0.003EPSS

2020-03-02 05:15 AM
242
cve
cve

CVE-2019-17026

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox <...

8.8CVSS

8.1AI Score

0.534EPSS

2020-03-02 05:15 AM
1119
In Wild
7
cve
cve

CVE-2019-9812

Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a malicious Firefox Sync account. Preference settings that disable the sandbox are then synchronized to the...

9.3CVSS

8.6AI Score

0.005EPSS

2020-01-08 10:15 PM
203
Total number of security vulnerabilities1129