Filtered by vendor Mozilla Subscriptions
Filtered by product Firefox Esr Subscriptions
Total 774 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-15653 3 Canonical, Mozilla, Redhat 7 Ubuntu Linux, Firefox, Firefox Esr and 4 more 2024-11-21 6.5 Medium
An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
CVE-2020-15652 3 Canonical, Mozilla, Redhat 7 Ubuntu Linux, Firefox, Firefox Esr and 4 more 2024-11-21 6.5 Medium
By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1.
CVE-2020-15650 2 Google, Mozilla 2 Android, Firefox Esr 2024-11-21 5.5 Medium
Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile). *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.11.
CVE-2020-15649 2 Google, Mozilla 2 Android, Firefox Esr 2024-11-21 5.5 Medium
Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.11.
CVE-2020-12421 3 Canonical, Mozilla, Redhat 7 Ubuntu Linux, Firefox, Firefox Esr and 4 more 2024-11-21 6.5 Medium
When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have caused add-ons to become out-of-date silently without notification to the user. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.
CVE-2020-12420 4 Canonical, Mozilla, Opensuse and 1 more 8 Ubuntu Linux, Firefox, Firefox Esr and 5 more 2024-11-21 8.8 High
When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.
CVE-2020-12419 4 Canonical, Mozilla, Opensuse and 1 more 8 Ubuntu Linux, Firefox, Firefox Esr and 5 more 2024-11-21 8.8 High
When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.
CVE-2020-12418 4 Canonical, Mozilla, Opensuse and 1 more 8 Ubuntu Linux, Firefox, Firefox Esr and 5 more 2024-11-21 6.5 Medium
Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.
CVE-2020-12417 4 Canonical, Mozilla, Opensuse and 1 more 8 Ubuntu Linux, Firefox, Firefox Esr and 5 more 2024-11-21 8.8 High
Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash. *Note: this issue only affects Firefox on ARM64 platforms.* This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.
CVE-2020-12413 1 Mozilla 2 Firefox, Firefox Esr 2024-11-21 5.9 Medium
The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites.
CVE-2020-12410 3 Canonical, Mozilla, Redhat 6 Ubuntu Linux, Firefox, Firefox Esr and 3 more 2024-11-21 8.8 High
Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.
CVE-2020-12406 3 Canonical, Mozilla, Redhat 7 Ubuntu Linux, Firefox, Firefox Esr and 4 more 2024-11-21 8.8 High
Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.
CVE-2020-12405 3 Canonical, Mozilla, Redhat 7 Ubuntu Linux, Firefox, Firefox Esr and 4 more 2024-11-21 5.3 Medium
When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.
CVE-2020-12399 3 Debian, Mozilla, Redhat 5 Debian Linux, Firefox, Firefox Esr and 2 more 2024-11-21 4.4 Medium
NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.
CVE-2020-12395 3 Canonical, Mozilla, Redhat 7 Ubuntu Linux, Firefox, Firefox Esr and 4 more 2024-11-21 9.8 Critical
Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.
CVE-2020-12393 2 Microsoft, Mozilla 4 Windows, Firefox, Firefox Esr and 1 more 2024-11-21 7.8 High
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.
CVE-2020-12392 3 Canonical, Mozilla, Redhat 7 Ubuntu Linux, Firefox, Firefox Esr and 4 more 2024-11-21 5.5 Medium
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.
CVE-2020-12389 2 Microsoft, Mozilla 3 Windows, Firefox, Firefox Esr 2024-11-21 10.0 Critical
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.
CVE-2020-12388 2 Microsoft, Mozilla 3 Windows, Firefox, Firefox Esr 2024-11-21 10.0 Critical
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.
CVE-2020-12387 2 Mozilla, Redhat 6 Firefox, Firefox Esr, Thunderbird and 3 more 2024-11-21 8.1 High
A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.