Mozilla Firefox ESR

• CVE-2023-25746 High 8.8 Memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary 0.7%
• CVE-2023-25742 Unrated When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102 0.6%
• CVE-2023-25730 Medium 5.4 A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofi 0.5%
• CVE-2023-25735 High 8.8 Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free after unwrapping the proxy. Th 0.7%
• CVE-2023-25751 Unrated Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lead to a potentially exploitable crash. This vulnerability aff 0.7%
• CVE-2023-25739 High 8.8 Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in <code>ScriptLoadContext</code>. This vulnerability affects Firefox < 110, T 0.7%
• CVE-2023-25743 Unrated A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>*This bug only affects Firefox Focus. Other versions of Firefox are unaffe 0.6%
• CVE-2023-25729 High 8.8 Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensions being able to open them without user interaction via <code>ExpandedPrincipals 0.7%
• CVE-2023-28164 Medium 6.5 Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, 0.3%
• CVE-2023-28163 Medium 6.5 When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. <br>* 0.8%
• CVE-2023-28176 High 8.8 Memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited 0.7%
• CVE-2023-28162 High 8.8 While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentially exploitable crash. This vulnerability affects Firefox < 111 0.7%
• CVE-2023-1945 Medium 6.5 Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 102.10 and Firefox ESR < 102.10. 0.6%
• CVE-2023-29535 Unrated Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash. This vulnerability 0.7%
• CVE-2023-23601 Unrated URL being dragged from cross-origin iframe into same tab triggers navigation 0.3%
• CVE-2023-29536 Unrated An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash. Th 0.7%
• CVE-2023-29539 Unrated When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attac 0.7%
• CVE-2023-29550 High 8.8 Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited 0.7%
• CVE-2023-29533 Unrated A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and <code>setInterval</code> ca 0.6%
• CVE-2023-29548 Medium 6.5 A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for And 0.7%
• CVE-2023-29541 High 8.8 Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands. <br>*This bug only affects Firefox for Linux on certai 0.7%
• CVE-2023-23603 Medium 6.5 Calls to console.log allowed bypassing Content Security Policy via format directive 0.6%
• CVE-2023-23598 Unrated Arbitrary file read from GTK drag and drop on Linux 0.6%
• CVE-2023-23605 High 8.8 Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7 0.7%
• CVE-2023-23602 Medium 6.5 Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers 0.6%
• CVE-2020-12413 Medium 5.9 The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites. 0.6%
• CVE-2022-31747 Critical 9.8 Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100 and Firefox ESR 91.9. Some of these bugs showed evidence of mem 0.9%
• CVE-2022-31737 Critical 9.8 A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox < 101, 0.9%
• CVE-2022-31744 Medium 6.5 An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy. This vulnerability affects Firefox ESR < 0.6%
• CVE-2022-31741 High 8.8 A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption. This vulnerability affects Thunderbird < 91.10, Firefox < 101 0.7%
• CVE-2022-31742 Medium 6.5 An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key handles. This could 0.6%
• CVE-2022-31740 High 8.8 On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, 0.7%
• CVE-2022-31738 Medium 6.5 When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. This vulnerability affects Thu 0.6%
• CVE-2022-31736 Critical 9.8 A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. 1.1%
• CVE-2022-31739 High 8.8 When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or % 0.7%
• CVE-2022-40957 Medium 6.5 Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<br>*This bug only affects Firefox on ARM64 platforms.*. This vulnerability affect 1.2%
• CVE-2022-40958 Medium 6.5 By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context, leading to session fi 1.2%
• CVE-2022-40959 Medium 6.5 During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted subdocuments. This vulnerability affects Fi 1.5%
• CVE-2022-40962 High 8.8 Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 104 and Firefox ESR 102.2. Some of these 1.4%
• CVE-2022-40956 Medium 6.1 When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR < 102.3, Thunderbird 0.9%
• CVE-2022-40960 Medium 6.5 Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.3, T 1.1%
• CVE-2022-2200 High 8.8 If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code execution. This vulnerability affects Fire 23.9%
• CVE-2022-2505 High 8.8 Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some 0.8%
• CVE-2022-45404 Medium 6.5 Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion 0.7%
• CVE-2022-45408 Medium 6.5 Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing att 0.7%
• CVE-2022-22746 Medium 5.9 A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed.<br>*This bug only affects Firefox for Windows. Other opera 0.6%
• CVE-2022-45411 Medium 6.1 Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript (such as cookies 0.6%
• CVE-2022-45421 High 8.8 Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some of these bugs showed evidence of memory corruption and we presume that with enoug 0.7%
• CVE-2022-45403 Medium 6.5 Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range requests might have allowed them to deter 0.7%
• CVE-2022-45420 Medium 6.5 Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks. This vulne 0.6%