Product:

Firefox_esr

(Mozilla)
Repositories https://github.com/libevent/libevent
#Vulnerabilities 1094
Date Id Summary Products Score Patch Annotated
2020-08-10 CVE-2020-15653 An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1. Ubuntu_linux, Firefox, Firefox_esr, Thunderbird 6.5
2020-08-10 CVE-2020-15656 JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the code, resulting in this bug rated at only moderate severity. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1. Ubuntu_linux, Firefox, Firefox_esr, Thunderbird, Leap 8.8
2020-08-10 CVE-2020-15658 The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1. Ubuntu_linux, Firefox, Firefox_esr, Thunderbird 6.5
2020-01-08 CVE-2019-11757 When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. This resulted in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Ubuntu_linux, Firefox, Firefox_esr, Thunderbird 8.8
2020-01-08 CVE-2019-11759 An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an attacker to execute arbitrary code or more likely lead to a crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Ubuntu_linux, Firefox, Firefox_esr, Thunderbird 8.8
2020-01-08 CVE-2019-11760 A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Ubuntu_linux, Firefox, Firefox_esr, Thunderbird 8.8
2020-01-08 CVE-2019-11761 By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Ubuntu_linux, Firefox, Firefox_esr, Thunderbird 5.4
2020-01-08 CVE-2019-11762 If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin window. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Ubuntu_linux, Firefox, Firefox_esr, Thunderbird 6.1
2019-07-23 CVE-2019-11707 A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2. Firefox, Firefox_esr, Thunderbird 8.8
2019-07-23 CVE-2019-11730 A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and they may uploaded to a server. It was demonstrated that in combination with a popular Android messaging app, if a malicious HTML attachment is sent to a user and they opened that attachment in... Debian_linux, Firefox, Firefox_esr, Thunderbird, Leap, Package_hub 6.5