Vulnerabilities > Mozilla > Firefox ESR
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-07-09 | CVE-2020-12405 | Use After Free vulnerability in multiple products When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. | 5.3 |
| 2020-07-09 | CVE-2020-12399 | Information Exposure Through Discrepancy vulnerability in multiple products NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. | 4.4 |
| 2020-07-09 | CVE-2018-12371 | Integer Overflow or Wraparound vulnerability in Mozilla Firefox An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. | 8.8 |
| 2020-05-26 | CVE-2020-6831 | Out-of-bounds Write vulnerability in multiple products A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. | 9.8 |
| 2020-05-26 | CVE-2020-12392 | Path Traversal vulnerability in multiple products The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. | 5.5 |
| 2020-05-26 | CVE-2020-12389 | Improper Input Validation vulnerability in Mozilla Firefox The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. | 10.0 |
| 2020-05-26 | CVE-2020-12388 | Improper Input Validation vulnerability in Mozilla Firefox The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. | 10.0 |
| 2020-05-26 | CVE-2020-12387 | Use After Free vulnerability in Mozilla Thunderbird A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. | 8.1 |
| 2020-05-26 | CVE-2020-12395 | Out-of-bounds Write vulnerability in multiple products Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. | 9.8 |
| 2020-05-26 | CVE-2020-12393 | OS Command Injection vulnerability in Mozilla Firefox The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. | 7.8 |