Windows apps · Application version · August 4, 2021
Mozilla Firefox ESR (en-US) 91.0
Mozilla Firefox ESR (en-US) 91.0, released August 4, 2021, fixes 129 CVEs in Mozilla Firefox ESR (en-US). None of them is reported as exploited. Patch Radar priority: Urgent. The latest Mozilla Firefox ESR (en-US) is 153.7.0, which also fixes every one of these CVEs.
Urgent
Superseded. The latest Mozilla Firefox ESR (en-US) is 153.7.0, which also fixes every CVE on this page. Install that instead.
CVEs closed
129
6 rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.4233
98th percentile
Priority of the 129 CVEs
Patch now 0
Urgent 6
High 58
Routine 65
Applies to
| Product | Version |
|---|---|
| Mozilla Firefox ESR (en-US) | 91.0 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2020-26950 | Firefox ESR and 2 others: In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting… | 8.8 | 0.4233 | None reported |
| Urgent | CVE-2021-23978 | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. | 8.8 | 0.0153 | None reported |
| Urgent | CVE-2021-29967 | Firefox ESR and 3 others: Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. | 8.8 | 0.0137 | None reported |
| Urgent | CVE-2021-23973 | Firefox ESR and 2 others: When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted,… | 6.5 | 0.0137 | None reported |
| Urgent | CVE-2021-23968 | Firefox ESR and 2 others: If Content Security Policy blocked frame navigation, the full destination of a redirect served in the… | 4.3 | 0.0131 | None reported |
| Urgent | CVE-2021-23969 | Firefox ESR and 2 others: As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents… | 4.3 | 0.0121 | None reported |
| High | CVE-2020-15663 | Firefox ESR and 2 others: If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe… | 8.8 | 0.0272 | None reported |
| High | CVE-2020-15683 | Firefox ESR and 2 others: Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox… | 9.8 | 0.0267 | None reported |
| High | CVE-2020-15659 | Firefox ESR and 2 others: Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox… | 8.8 | 0.0239 | None reported |
| High | CVE-2020-15673 | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. | 8.8 | 0.0196 | None reported |
| High | CVE-2020-26971 | Firefox ESR and 2 others: Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow… | 8.8 | 0.0190 | None reported |
| High | CVE-2020-15678 | Firefox ESR and 2 others: When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting… | 8.8 | 0.0188 | None reported |
| High | CVE-2021-23994 | Firefox ESR and 2 others: A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound… | 8.8 | 0.0176 | None reported |
| High | CVE-2020-15667 | Firefox ESR and 1 other: When processing a MAR update file, after the signature has been validated, an invalid name length could… | 8.8 | 0.0165 | None reported |
| High | CVE-2020-26973 | Firefox ESR and 2 others: Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. | 8.8 | 0.0162 | None reported |
| High | CVE-2020-35113 | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. | 8.8 | 0.0157 | None reported |
| High | CVE-2020-26960 | Firefox ESR and 2 others: If the Compact() method was called on an nsTArray, the array could have been reallocated without updating… | 8.8 | 0.0156 | None reported |
| High | CVE-2020-26974 | Firefox ESR and 2 others: When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly… | 8.8 | 0.0153 | None reported |
| High | CVE-2020-15656 | Firefox ESR and 2 others: JIT optimizations involving the Javascript arguments object could confuse later optimizations. | 8.8 | 0.0152 | None reported |
| High | CVE-2020-26968 | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. | 8.8 | 0.0151 | None reported |
| High | CVE-2021-23961 | Firefox ESR and 1 other: Further techniques that built on the slipstream research combined with a malicious webpage could have… | 7.4 | 0.0148 | None reported |
| High | CVE-2021-29985 | Firefox ESR and 3 others: A use-after-free vulnerability in media channels could have led to memory corruption and a potentially… | 8.8 | 0.0145 | None reported |
| High | CVE-2021-29970 | Firefox ESR and 3 others: A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable… | 8.8 | 0.0143 | None reported |
| High | CVE-2021-23987 | Firefox ESR and 2 others: Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox… | 8.8 | 0.0142 | None reported |
| High | CVE-2021-29980 | Firefox ESR and 3 others: Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption… | 8.8 | 0.0140 | None reported |
Showing 1 to 25 of 129
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.