GCVE - cpe:2.3:a:mozilla:firefox_esr:128.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mozilla:firefox_esr:128.0:*:*:*:*:*:*:*

part: a version: 128.0 update: *

Vendor	Mozilla (`be1b0d4e-21a7-5a25-9982-bbda6ef43ec1`)
Product	Firefox Esr (`bdc94ed7-a614-58b9-b7d5-0e4682d3ba68`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/firefox-esr`	purl2cpe	2026-06-01 10:17:53.490804
`pkg:github/plasmazilla/firefox-esr`	purl2cpe	2026-06-01 10:17:53.490806
`pkg:npm/firefox-binary`	purl2cpe	2026-06-01 10:17:53.490807
`pkg:rpm/opensuse/firefox-esr`	purl2cpe	2026-06-01 10:17:53.490809

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-7531`	vulnerable	2026-06-03 14:58:06.113225	Details available Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcome is connection failure, but if the connection persists despite the high packet loss it could be possible for a network observer to identify packets as coming from the same source despite a network path change. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1. Published: 2024-08-06T12:38:15.496Z Updated: 2025-03-19T15:51:59.396Z Open on db.gcve.eu Reference links https://bugzilla.mozilla.org/show_bug.cgi?id=1905691 https://www.mozilla.org/security/advisories/mfsa2024-33/ https://www.mozilla.org/security/advisories/mfsa2024-34/ https://www.mozilla.org/security/advisories/mfsa2024-35/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-7529`	vulnerable	2026-06-03 14:58:06.112127	Details available The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14. Published: 2024-08-06T12:38:15.245Z Updated: 2024-08-07T20:55:22.507Z Open on db.gcve.eu Reference links https://bugzilla.mozilla.org/show_bug.cgi?id=1903187 https://www.mozilla.org/security/advisories/mfsa2024-33/ https://www.mozilla.org/security/advisories/mfsa2024-34/ https://www.mozilla.org/security/advisories/mfsa2024-35/ https://www.mozilla.org/security/advisories/mfsa2024-37/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-7527`	vulnerable	2026-06-03 14:58:06.111007	Details available Unexpected marking work at the start of sweeping could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14. Published: 2024-08-06T12:38:14.698Z Updated: 2025-03-18T19:05:01.797Z Open on db.gcve.eu Reference links https://bugzilla.mozilla.org/show_bug.cgi?id=1871303 https://www.mozilla.org/security/advisories/mfsa2024-33/ https://www.mozilla.org/security/advisories/mfsa2024-34/ https://www.mozilla.org/security/advisories/mfsa2024-35/ https://www.mozilla.org/security/advisories/mfsa2024-37/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-7526`	vulnerable	2026-06-03 14:58:06.109976	Details available ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14. Published: 2024-08-06T12:38:14.456Z Updated: 2024-09-17T18:14:47.411Z Open on db.gcve.eu Reference links https://bugzilla.mozilla.org/show_bug.cgi?id=1910306 https://www.mozilla.org/security/advisories/mfsa2024-33/ https://www.mozilla.org/security/advisories/mfsa2024-34/ https://www.mozilla.org/security/advisories/mfsa2024-35/ https://www.mozilla.org/security/advisories/mfsa2024-37/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-7525`	vulnerable	2026-06-03 14:58:06.109309	Details available It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on any site. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14. Published: 2024-08-06T12:38:14.195Z Updated: 2024-08-06T22:21:43.959Z Open on db.gcve.eu Reference links https://bugzilla.mozilla.org/show_bug.cgi?id=1909298 https://www.mozilla.org/security/advisories/mfsa2024-33/ https://www.mozilla.org/security/advisories/mfsa2024-34/ https://www.mozilla.org/security/advisories/mfsa2024-35/ https://www.mozilla.org/security/advisories/mfsa2024-37/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-7522`	vulnerable	2026-06-03 14:58:06.107748	Details available Editor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14. Published: 2024-08-06T12:38:13.630Z Updated: 2024-08-08T16:02:54.096Z Open on db.gcve.eu Reference links https://bugzilla.mozilla.org/show_bug.cgi?id=1906727 https://www.mozilla.org/security/advisories/mfsa2024-33/ https://www.mozilla.org/security/advisories/mfsa2024-34/ https://www.mozilla.org/security/advisories/mfsa2024-35/ https://www.mozilla.org/security/advisories/mfsa2024-37/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-7521`	vulnerable	2026-06-03 14:58:06.107070	Details available Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14. Published: 2024-08-06T12:38:13.406Z Updated: 2024-08-07T20:58:56.811Z Open on db.gcve.eu Reference links https://bugzilla.mozilla.org/show_bug.cgi?id=1904644 https://www.mozilla.org/security/advisories/mfsa2024-33/ https://www.mozilla.org/security/advisories/mfsa2024-34/ https://www.mozilla.org/security/advisories/mfsa2024-35/ https://www.mozilla.org/security/advisories/mfsa2024-37/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-7519`	vulnerable	2026-06-03 14:58:06.102808	Details available Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14. Published: 2024-08-06T12:38:12.854Z Updated: 2024-08-07T20:49:22.889Z Open on db.gcve.eu Reference links https://bugzilla.mozilla.org/show_bug.cgi?id=1902307 https://www.mozilla.org/security/advisories/mfsa2024-33/ https://www.mozilla.org/security/advisories/mfsa2024-34/ https://www.mozilla.org/security/advisories/mfsa2024-35/ https://www.mozilla.org/security/advisories/mfsa2024-37/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.