firefox_esr Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/firefox_esr/ Sun, 26 Feb 2023 06:42:51 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png firefox_esr Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/firefox_esr/ 32 32 CVE-2020-6807 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-6807/ Sun, 26 Feb 2023 06:42:51 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-6807/ When a device was changed while a stream was about to be destroyed, the stream-reinit task may have been executed after the stream was destroyed, causing a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.

The post CVE-2020-6807 appeared first on CVE Vulnerability.

]]> When a device was changed while a stream was about to be destroyed, the stream-reinit task may have been executed after the stream was destroyed, causing a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.

The post CVE-2020-6807 appeared first on CVE Vulnerability.

]]> CVE-2020-6806 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-6806/ Sun, 26 Feb 2023 06:42:51 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-6806/ By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.

The post CVE-2020-6806 appeared first on CVE Vulnerability.

]]> By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.

The post CVE-2020-6806 appeared first on CVE Vulnerability.

]]> CVE-2020-6805 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-6805/ Sun, 26 Feb 2023 06:42:51 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-6805/ When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.

The post CVE-2020-6805 appeared first on CVE Vulnerability.

]]> When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.

The post CVE-2020-6805 appeared first on CVE Vulnerability.

]]> CVE-2020-15658 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-15658/ Sun, 26 Feb 2023 06:37:55 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-15658/ The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird […]

The post CVE-2020-15658 appeared first on CVE Vulnerability.

]]> The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

The post CVE-2020-15658 appeared first on CVE Vulnerability.

]]> CVE-2020-15656 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-15656/ Sun, 26 Feb 2023 06:37:55 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-15656/ JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the code, resulting in this bug rated at only moderate severity. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

The post CVE-2020-15656 appeared first on CVE Vulnerability.

]]> JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the code, resulting in this bug rated at only moderate severity. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

The post CVE-2020-15656 appeared first on CVE Vulnerability.

]]> CVE-2020-15654 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-15654/ Sun, 26 Feb 2023 06:37:55 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-15654/ When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. This vulnerability affects Firefox ESR […]

The post CVE-2020-15654 appeared first on CVE Vulnerability.

]]> When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

The post CVE-2020-15654 appeared first on CVE Vulnerability.

]]> CVE-2020-15653 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-15653/ Sun, 26 Feb 2023 06:37:55 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-15653/ An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

The post CVE-2020-15653 appeared first on CVE Vulnerability.

]]> An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

The post CVE-2020-15653 appeared first on CVE Vulnerability.

]]> CVE-2020-12421 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-12421/ Sun, 26 Feb 2023 06:36:35 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-12421/ When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have caused add-ons to become out-of-date silently without notification to the user. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.

The post CVE-2020-12421 appeared first on CVE Vulnerability.

]]> When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have caused add-ons to become out-of-date silently without notification to the user. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.

The post CVE-2020-12421 appeared first on CVE Vulnerability.

]]> CVE-2020-12419 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-12419/ Sun, 26 Feb 2023 06:36:35 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-12419/ When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.

The post CVE-2020-12419 appeared first on CVE Vulnerability.

]]> When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.

The post CVE-2020-12419 appeared first on CVE Vulnerability.

]]> CVE-2020-12418 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-12418/ Sun, 26 Feb 2023 06:36:35 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-12418/ Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.

The post CVE-2020-12418 appeared first on CVE Vulnerability.

]]> Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.

The post CVE-2020-12418 appeared first on CVE Vulnerability.

]]>