Vulnerabilities > Mozilla > Firefox ESR > 91.6
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-06-02 | CVE-2023-32213 | Use of Uninitialized Resource vulnerability in Mozilla Firefox When reading a file, an uninitialized value could have been used as read limit. | 8.8 |
| 2023-06-02 | CVE-2023-32215 | Out-of-bounds Write vulnerability in Mozilla Firefox Memory safety bugs present in Firefox 112 and Firefox ESR 102.10. | 8.8 |
| 2022-12-22 | CVE-2022-1097 | Use After Free vulnerability in Mozilla Firefox ESR <code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. | 6.5 |
| 2022-12-22 | CVE-2022-1196 | Use After Free vulnerability in Mozilla Firefox ESR After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash. | 6.5 |
| 2022-12-22 | CVE-2022-1529 | Unspecified vulnerability in Mozilla Thunderbird An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the privileged parent process. | 8.8 |
| 2022-12-22 | CVE-2022-1802 | Unspecified vulnerability in Mozilla Thunderbird If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. | 8.8 |
| 2022-12-22 | CVE-2022-26381 | Use After Free vulnerability in Mozilla Firefox An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploitable crash. | 8.8 |
| 2022-12-22 | CVE-2022-26383 | Unspecified vulnerability in Mozilla Firefox When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. | 4.3 |
| 2022-12-22 | CVE-2022-26384 | Unspecified vulnerability in Mozilla Firefox If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a link that, when clicked, would lead to JavaScript execution in violation of the sandbox. | 9.6 |
| 2022-12-22 | CVE-2022-26386 | Unspecified vulnerability in Mozilla Firefox ESR Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>, but this behavior was changed to download them to <code>/tmp</code> where they could be affected by other local users. | 6.5 |