# Mozilla Thunderbird (en-US) 115.8.0

Mozilla Thunderbird (en-US) 115.8.0, released February 21, 2024, fixes 120 CVEs in Mozilla Thunderbird (en-US). 2 of them are being exploited (CVE-2023-4863); 2 on CISA KEV. Patch Radar priority: Patch now. The latest Mozilla Thunderbird (en-US) is 159.0, which also fixes every one of these CVEs.

- Web page: https://patchblox.com/security/fix/windows-app/mozilla.thunderbird-115.8.0
- Platform: Windows apps
- Released: Feb 21, 2024
- Priority: Patch now (Closes CVE-2023-4863, exploited (CISA KEV))
- CVEs: 120, exploited: 2, on CISA KEV: 2
- Superseded by: [Mozilla Thunderbird (en-US) 159.0](https://patchblox.com/security/data/product/windows-app/mozilla-thunderbird-en-us.md), the latest version, which also fixes every CVE listed here

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [Mozilla Thunderbird (en-US)](https://patchblox.com/security/data/product/windows-app/mozilla-thunderbird-en-us.md) |  | 115.8.0 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2023-4863](https://patchblox.com/security/data/cve/CVE-2023-4863.md) | Patch now | Chromium: CVE-2023-4863 Heap buffer overflow in WebP | 9.6 | 0.9998 | CISA KEV, Disclosed |
| [CVE-2023-5217](https://patchblox.com/security/data/cve/CVE-2023-5217.md) | Patch now | Chromium: CVE-2023-5217 Heap buffer overflow in vp8 encoding in libvpx | 8.8 | 0.4901 | CISA KEV, Disclosed |
| [CVE-2023-5176](https://patchblox.com/security/data/cve/CVE-2023-5176.md) | Urgent | Mozilla Firefox ESR and 5 others: Out-of-bounds Write | 9.8 | 0.0139 |  |
| [CVE-2023-5174](https://patchblox.com/security/data/cve/CVE-2023-5174.md) | Urgent | Mozilla Firefox ESR and 5 others: Use After Free | 9.8 | 0.0120 |  |
| [CVE-2023-5168](https://patchblox.com/security/data/cve/CVE-2023-5168.md) | Urgent | Mozilla Firefox ESR and 5 others: Out-of-bounds Write | 9.8 | 0.0112 |  |
| [CVE-2023-29542](https://patchblox.com/security/data/cve/CVE-2023-29542.md) | Urgent | Mozilla Firefox and 4 others: A newline in a filename could have been used to bypass the file extension security mechanisms that replace… | 9.8 | 0.0094 |  |
| [CVE-2023-34416](https://patchblox.com/security/data/cve/CVE-2023-34416.md) | Urgent | Mozilla Firefox and 4 others: Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. | 9.8 | 0.0093 |  |
| [CVE-2023-4057](https://patchblox.com/security/data/cve/CVE-2023-4057.md) | Urgent | Mozilla Firefox ESR and 5 others: Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. | 9.8 | 0.0089 |  |
| [CVE-2024-2614](https://patchblox.com/security/data/cve/CVE-2024-2614.md) | Urgent | Mozilla Firefox ESR and 5 others: Out-of-bounds Write | 8.8 | 0.0089 |  |
| [CVE-2023-6856](https://patchblox.com/security/data/cve/CVE-2023-6856.md) | High | Mozilla Firefox ESR and 5 others: The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems… | 8.8 | 0.2063 |  |
| [CVE-2024-0741](https://patchblox.com/security/data/cve/CVE-2024-0741.md) | High | Mozilla Firefox ESR and 5 others: Out-of-bounds Write | 7.5 | 0.0216 |  |
| [CVE-2023-6858](https://patchblox.com/security/data/cve/CVE-2023-6858.md) | High | Mozilla Firefox ESR and 5 others: Out-of-bounds Write | 8.8 | 0.0154 |  |
| [CVE-2023-5730](https://patchblox.com/security/data/cve/CVE-2023-5730.md) | High | Mozilla Firefox ESR and 5 others: Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. | 9.8 | 0.0154 |  |
| [CVE-2023-5724](https://patchblox.com/security/data/cve/CVE-2023-5724.md) | High | Mozilla Firefox ESR and 5 others: Uncontrolled Resource Consumption | 7.5 | 0.0152 |  |
| [CVE-2023-6861](https://patchblox.com/security/data/cve/CVE-2023-6861.md) | High | Mozilla Firefox ESR and 5 others: The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless… | 8.8 | 0.0141 |  |
| [CVE-2023-5728](https://patchblox.com/security/data/cve/CVE-2023-5728.md) | High | Mozilla Firefox ESR and 5 others: Use After Free | 7.5 | 0.0132 |  |
| [CVE-2023-6864](https://patchblox.com/security/data/cve/CVE-2023-6864.md) | High | Mozilla Firefox ESR and 5 others: Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. | 8.8 | 0.0119 |  |
| [CVE-2023-6859](https://patchblox.com/security/data/cve/CVE-2023-6859.md) | High | Mozilla Firefox ESR and 5 others: A use-after-free condition affected TLS socket creation when under memory pressure. | 8.8 | 0.0109 |  |
| [CVE-2023-6863](https://patchblox.com/security/data/cve/CVE-2023-6863.md) | High | Mozilla Firefox ESR and 5 others: The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic… | 8.8 | 0.0104 |  |
| [CVE-2023-6862](https://patchblox.com/security/data/cve/CVE-2023-6862.md) | High | Mozilla Thunderbird and 1 other: A use-after-free was identified in the `nsDNSService::Init`. | 8.8 | 0.0095 |  |
| [CVE-2023-6212](https://patchblox.com/security/data/cve/CVE-2023-6212.md) | High | Mozilla Firefox ESR and 5 others: Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. | 8.8 | 0.0095 |  |
| [CVE-2023-32214](https://patchblox.com/security/data/cve/CVE-2023-32214.md) | High | Mozilla Firefox and 4 others: Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service. | 7.5 | 0.0092 |  |
| [CVE-2023-6207](https://patchblox.com/security/data/cve/CVE-2023-6207.md) | High | Mozilla Firefox ESR and 5 others: Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox… | 8.8 | 0.0091 |  |
| [CVE-2023-34414](https://patchblox.com/security/data/cve/CVE-2023-34414.md) | High | Mozilla Firefox and 4 others: The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses… | 9.8 | 0.0090 |  |
| [CVE-2023-6208](https://patchblox.com/security/data/cve/CVE-2023-6208.md) | High | Mozilla Firefox ESR and 5 others: When using X11, text selected by the page using the Selection API was erroneously copied into the primary… | 8.8 | 0.0089 |  |
| [CVE-2023-6205](https://patchblox.com/security/data/cve/CVE-2023-6205.md) | High | Mozilla Firefox ESR and 5 others: It was possible to cause the use of a MessagePort after it had already been freed, which could potentially… | 7.5 | 0.0087 |  |
| [CVE-2024-1553](https://patchblox.com/security/data/cve/CVE-2024-1553.md) | High | Mozilla Firefox ESR and 5 others: Improper Restriction of Operations within the Bounds of a Memory Buffer | 8.1 | 0.0087 |  |
| [CVE-2023-6204](https://patchblox.com/security/data/cve/CVE-2023-6204.md) | High | Mozilla Firefox ESR and 5 others: On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds… | 7.5 | 0.0084 |  |
| [CVE-2024-0750](https://patchblox.com/security/data/cve/CVE-2024-0750.md) | High | Mozilla Firefox ESR and 5 others: User Interface (UI) Misrepresentation of Critical Information | 8.8 | 0.0084 |  |
| [CVE-2023-4576](https://patchblox.com/security/data/cve/CVE-2023-4576.md) | High | Integer Overflow in RecordedSourceSurfaceCreation | 8.6 | 0.0082 |  |
| [CVE-2023-0767](https://patchblox.com/security/data/cve/CVE-2023-0767.md) | High | Mozilla Firefox and 4 others: An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory… | 8.8 | 0.0082 |  |
| [CVE-2023-5721](https://patchblox.com/security/data/cve/CVE-2023-5721.md) | High | Mozilla Firefox ESR and 5 others: It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally… | 7.5 | 0.0081 |  |
| [CVE-2023-4584](https://patchblox.com/security/data/cve/CVE-2023-4584.md) | High | Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 | 8.8 | 0.0080 |  |
| [CVE-2023-25734](https://patchblox.com/security/data/cve/CVE-2023-25734.md) | High | Mozilla Firefox and 4 others: URL Redirection to Untrusted Site ('Open Redirect') | 8.1 | 0.0078 |  |
| [CVE-2023-4585](https://patchblox.com/security/data/cve/CVE-2023-4585.md) | High | Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2 | 8.8 | 0.0077 |  |
| [CVE-2023-4053](https://patchblox.com/security/data/cve/CVE-2023-4053.md) | High | Full screen notification obscured by external program | 8.8 | 0.0077 |  |
| [CVE-2023-37201](https://patchblox.com/security/data/cve/CVE-2023-37201.md) | High | Mozilla Firefox and 4 others: An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. | 8.8 | 0.0076 |  |
| [CVE-2023-37202](https://patchblox.com/security/data/cve/CVE-2023-37202.md) | High | Mozilla Firefox and 4 others: Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments… | 8.8 | 0.0076 |  |
| [CVE-2023-32213](https://patchblox.com/security/data/cve/CVE-2023-32213.md) | High | Mozilla Firefox and 4 others: When reading a file, an uninitialized value could have been used as read limit. | 8.8 | 0.0075 |  |
| [CVE-2023-32215](https://patchblox.com/security/data/cve/CVE-2023-32215.md) | High | Mozilla Firefox and 4 others: Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst,… | 8.8 | 0.0075 |  |
| [CVE-2023-37211](https://patchblox.com/security/data/cve/CVE-2023-37211.md) | High | Mozilla Firefox and 4 others: Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. | 8.8 | 0.0075 |  |
| [CVE-2024-0755](https://patchblox.com/security/data/cve/CVE-2024-0755.md) | High | Mozilla Firefox ESR and 5 others: Improper Control of Generation of Code ('Code Injection') | 8.8 | 0.0075 |  |
| [CVE-2023-29535](https://patchblox.com/security/data/cve/CVE-2023-29535.md) | High | Mozilla Firefox and 4 others: Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly… | 7.5 | 0.0075 |  |
| [CVE-2023-29541](https://patchblox.com/security/data/cve/CVE-2023-29541.md) | High | Mozilla Firefox and 4 others: Improper Encoding or Escaping of Output | 8.8 | 0.0074 |  |
| [CVE-2023-37207](https://patchblox.com/security/data/cve/CVE-2023-37207.md) | High | Mozilla Firefox and 4 others: A website could have obscured the fullscreen notification by using a URL with a scheme handled by an… | 8.8 | 0.0074 |  |
| [CVE-2023-25732](https://patchblox.com/security/data/cve/CVE-2023-25732.md) | High | Mozilla Firefox and 4 others: Out-of-bounds Write | 8.8 | 0.0074 |  |
| [CVE-2023-29539](https://patchblox.com/security/data/cve/CVE-2023-29539.md) | High | Mozilla Firefox and 4 others: When handling the filename directive in the Content-Disposition header, the filename would be truncated… | 8.8 | 0.0074 |  |
| [CVE-2023-32207](https://patchblox.com/security/data/cve/CVE-2023-32207.md) | High | Mozilla Firefox and 4 others: Authentication Bypass by Spoofing | 8.8 | 0.0073 |  |
| [CVE-2023-28176](https://patchblox.com/security/data/cve/CVE-2023-28176.md) | High | Mozilla Firefox and 4 others: Out-of-bounds Write | 8.8 | 0.0072 |  |
| [CVE-2024-1546](https://patchblox.com/security/data/cve/CVE-2024-1546.md) | High | Mozilla Firefox ESR and 5 others: Out-of-bounds Read | 7.5 | 0.0072 |  |
| [CVE-2023-25735](https://patchblox.com/security/data/cve/CVE-2023-25735.md) | High | Mozilla Firefox and 4 others: Use After Free | 8.8 | 0.0072 |  |
| [CVE-2023-29550](https://patchblox.com/security/data/cve/CVE-2023-29550.md) | High | Mozilla Firefox and 4 others: Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. | 8.8 | 0.0071 |  |
| [CVE-2023-32206](https://patchblox.com/security/data/cve/CVE-2023-32206.md) | High | Mozilla Firefox and 4 others: An out-of-bound read could have led to a crash in the RLBox Expat driver. | 7.5 | 0.0070 |  |
| [CVE-2023-23605](https://patchblox.com/security/data/cve/CVE-2023-23605.md) | High | Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7 | 8.8 | 0.0070 |  |
| [CVE-2023-25737](https://patchblox.com/security/data/cve/CVE-2023-25737.md) | High | Mozilla Firefox and 4 others: Incorrect Type Conversion or Cast | 8.8 | 0.0070 |  |
| [CVE-2023-28162](https://patchblox.com/security/data/cve/CVE-2023-28162.md) | High | Mozilla Firefox and 4 others: Access of Resource Using Incompatible Type ('Type Confusion') | 8.8 | 0.0070 |  |
| [CVE-2023-29536](https://patchblox.com/security/data/cve/CVE-2023-29536.md) | High | Mozilla Firefox and 4 others: An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled… | 8.8 | 0.0070 |  |
| [CVE-2023-25751](https://patchblox.com/security/data/cve/CVE-2023-25751.md) | High | Mozilla Firefox and 4 others: Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be… | 7.5 | 0.0069 |  |
| [CVE-2023-4583](https://patchblox.com/security/data/cve/CVE-2023-4583.md) | High | Browsing Context potentially not cleared when closing Private Window | 8.8 | 0.0069 |  |
| [CVE-2023-25739](https://patchblox.com/security/data/cve/CVE-2023-25739.md) | High | Mozilla Firefox and 4 others: Use After Free | 8.8 | 0.0068 |  |
| [CVE-2023-25729](https://patchblox.com/security/data/cve/CVE-2023-25729.md) | High | Mozilla Firefox and 4 others: Incorrect Authorization | 8.8 | 0.0068 |  |
| [CVE-2024-1547](https://patchblox.com/security/data/cve/CVE-2024-1547.md) | High | Mozilla Firefox ESR and 5 others: Authentication Bypass by Spoofing | 7.5 | 0.0068 |  |
| [CVE-2023-25728](https://patchblox.com/security/data/cve/CVE-2023-25728.md) | High | Mozilla Firefox and 4 others: Observable Discrepancy | 7.5 | 0.0067 |  |
| [CVE-2023-3417](https://patchblox.com/security/data/cve/CVE-2023-3417.md) | High | File Extension Spoofing using the Text Direction Override Character | 7.5 | 0.0067 |  |
| [CVE-2023-25746](https://patchblox.com/security/data/cve/CVE-2023-25746.md) | High | Mozilla Thunderbird and 1 other: Out-of-bounds Write | 8.8 | 0.0067 |  |
| [CVE-2023-4574](https://patchblox.com/security/data/cve/CVE-2023-4574.md) | High | Memory corruption in IPC ColorPickerShownCallback | 8.8 | 0.0066 |  |
| [CVE-2023-4051](https://patchblox.com/security/data/cve/CVE-2023-4051.md) | High | Full screen notification obscured by file open dialog | 8.8 | 0.0066 |  |
| [CVE-2023-4575](https://patchblox.com/security/data/cve/CVE-2023-4575.md) | High | Memory corruption in IPC FilePickerShownCallback | 8.8 | 0.0066 |  |
| [CVE-2023-4577](https://patchblox.com/security/data/cve/CVE-2023-4577.md) | High | Memory corruption in JIT UpdateRegExpStatics | 8.8 | 0.0065 |  |
| [CVE-2023-25742](https://patchblox.com/security/data/cve/CVE-2023-25742.md) | High | Mozilla Firefox and 4 others: When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the… | 7.5 | 0.0065 |  |
| [CVE-2023-6206](https://patchblox.com/security/data/cve/CVE-2023-6206.md) | High | Mozilla Firefox ESR and 5 others: The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay… | 7.5 | 0.0064 |  |
| [CVE-2023-23598](https://patchblox.com/security/data/cve/CVE-2023-23598.md) | High | Arbitrary file read from GTK drag and drop on Linux | 8.8 | 0.0064 |  |
| [CVE-2023-23603](https://patchblox.com/security/data/cve/CVE-2023-23603.md) | High | Calls to console.log allowed bypassing Content Security Policy via format directive | 8.8 | 0.0064 |  |
| [CVE-2023-3600](https://patchblox.com/security/data/cve/CVE-2023-3600.md) | High | Use-after-free in workers | 8.8 | 0.0063 |  |
| [CVE-2024-0751](https://patchblox.com/security/data/cve/CVE-2024-0751.md) | High | Mozilla Firefox ESR and 5 others: Improper Privilege Management | 8.8 | 0.0063 |  |
| [CVE-2023-50761](https://patchblox.com/security/data/cve/CVE-2023-50761.md) | High | Mozilla Thunderbird and 1 other: The signature of a digitally signed S/MIME email message may optionally specify the signature creation… | 7.5 | 0.0063 |  |
| [CVE-2023-50762](https://patchblox.com/security/data/cve/CVE-2023-50762.md) | High | Mozilla Thunderbird and 1 other: When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text… | 7.5 | 0.0063 |  |
| [CVE-2023-4573](https://patchblox.com/security/data/cve/CVE-2023-4573.md) | High | Memory corruption in IPC CanvasTranslator | 8.8 | 0.0063 |  |
| [CVE-2023-32205](https://patchblox.com/security/data/cve/CVE-2023-32205.md) | High | Mozilla Firefox and 4 others: In multiple cases browser prompts could have been obscured by popups controlled by content. | 7.5 | 0.0063 |  |
| [CVE-2023-4578](https://patchblox.com/security/data/cve/CVE-2023-4578.md) | High | Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception | 8.8 | 0.0062 |  |
| [CVE-2023-25752](https://patchblox.com/security/data/cve/CVE-2023-25752.md) | High | Mozilla Firefox and 4 others: When accessing throttled streams, the count of available bytes needed to be checked in the calling function… | 7.5 | 0.0061 |  |
| [CVE-2023-23599](https://patchblox.com/security/data/cve/CVE-2023-23599.md) | High | Malicious command could be hidden in devtools output on Windows | 8.8 | 0.0060 |  |
| [CVE-2023-23602](https://patchblox.com/security/data/cve/CVE-2023-23602.md) | High | Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers | 8.8 | 0.0060 |  |
| [CVE-2024-0742](https://patchblox.com/security/data/cve/CVE-2024-0742.md) | High | Mozilla Firefox ESR and 5 others: It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally… | 7.5 | 0.0060 |  |
| [CVE-2023-4581](https://patchblox.com/security/data/cve/CVE-2023-4581.md) | High | XLL file extensions were downloadable without warnings | 8.8 | 0.0057 |  |
| [CVE-2023-29533](https://patchblox.com/security/data/cve/CVE-2023-29533.md) | High | Mozilla Firefox and 4 others: A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>,… | 7.5 | 0.0057 |  |
| [CVE-2023-25730](https://patchblox.com/security/data/cve/CVE-2023-25730.md) | High | Mozilla Firefox and 4 others: Improper Restriction of Rendered UI Layers or Frames | 7.5 | 0.0055 |  |
| [CVE-2023-0616](https://patchblox.com/security/data/cve/CVE-2023-0616.md) | High | Mozilla Thunderbird and 1 other: Allocation of Resources Without Limits or Throttling | 7.5 | 0.0049 |  |
| [CVE-2023-4580](https://patchblox.com/security/data/cve/CVE-2023-4580.md) | High | Push notifications saved to disk unencrypted | 8.8 | 0.0042 |  |
| [CVE-2023-0430](https://patchblox.com/security/data/cve/CVE-2023-0430.md) | High | Mozilla Thunderbird and 1 other: Improper Certificate Validation | 7.5 | 0.0037 |  |
| [CVE-2023-0547](https://patchblox.com/security/data/cve/CVE-2023-0547.md) | High | Mozilla Thunderbird and 1 other: Improper Certificate Validation | 7.5 | 0.0037 |  |
| [CVE-2023-23601](https://patchblox.com/security/data/cve/CVE-2023-23601.md) | High | URL being dragged from cross-origin iframe into same tab triggers navigation | 8.8 | 0.0035 |  |
| [CVE-2023-28164](https://patchblox.com/security/data/cve/CVE-2023-28164.md) | High | Mozilla Firefox and 4 others: Origin Validation Error | 7.5 | 0.0035 |  |
| [CVE-2023-37208](https://patchblox.com/security/data/cve/CVE-2023-37208.md) | High | Mozilla Firefox and 4 others: Unrestricted Upload of File with Dangerous Type | 8.8 | 0.0023 |  |
| [CVE-2023-6209](https://patchblox.com/security/data/cve/CVE-2023-6209.md) | Routine | Mozilla Firefox ESR and 5 others: Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in… | 6.5 | 0.0142 |  |
| [CVE-2023-5171](https://patchblox.com/security/data/cve/CVE-2023-5171.md) | Routine | Mozilla Firefox ESR and 5 others: During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing… | 6.5 | 0.0112 |  |
| [CVE-2023-5169](https://patchblox.com/security/data/cve/CVE-2023-5169.md) | Routine | Mozilla Firefox ESR and 5 others: A compromised content process could have provided malicious data in a `PathRecording` resulting in an… | 6.5 | 0.0110 |  |
| [CVE-2023-5732](https://patchblox.com/security/data/cve/CVE-2023-5732.md) | Routine | Address bar spoofing via bidirectional characters | 6.5 | 0.0105 |  |
| [CVE-2023-6860](https://patchblox.com/security/data/cve/CVE-2023-6860.md) | Routine | Mozilla Firefox ESR and 5 others: The `VideoBridge` allowed any content process to use textures produced by remote decoders. | 6.5 | 0.0096 |  |
| [CVE-2024-1548](https://patchblox.com/security/data/cve/CVE-2024-1548.md) | Routine | Mozilla Firefox ESR and 5 others: A website could have obscured the fullscreen notification by using a dropdown select input element. | 6.1 | 0.0095 |  |
| [CVE-2023-5725](https://patchblox.com/security/data/cve/CVE-2023-5725.md) | Routine | Mozilla Firefox ESR and 5 others: A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could… | 6.1 | 0.0094 |  |
| [CVE-2023-5727](https://patchblox.com/security/data/cve/CVE-2023-5727.md) | Routine | Mozilla Firefox ESR and 5 others: The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle… | 6.5 | 0.0083 |  |
| [CVE-2023-28163](https://patchblox.com/security/data/cve/CVE-2023-28163.md) | Routine | Mozilla Firefox and 4 others: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 6.5 | 0.0080 |  |
| [CVE-2024-1551](https://patchblox.com/security/data/cve/CVE-2024-1551.md) | Routine | Mozilla Firefox ESR and 5 others: Reliance on Cookies without Validation and Integrity Checking | 6.1 | 0.0074 |  |
| [CVE-2023-32211](https://patchblox.com/security/data/cve/CVE-2023-32211.md) | Routine | Mozilla Firefox and 4 others: A type checking bug would have led to invalid code being compiled. | 6.5 | 0.0074 |  |
| [CVE-2024-0746](https://patchblox.com/security/data/cve/CVE-2024-0746.md) | Routine | Mozilla Firefox ESR and 5 others: Use After Free | 6.5 | 0.0074 |  |
| [CVE-2024-0753](https://patchblox.com/security/data/cve/CVE-2024-0753.md) | Routine | Mozilla Firefox ESR and 5 others: In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. | 6.5 | 0.0072 |  |
| [CVE-2023-4052](https://patchblox.com/security/data/cve/CVE-2023-4052.md) | Routine | Mozilla Firefox ESR and 5 others: The Firefox updater created a directory writable by non-privileged users. | 6.5 | 0.0071 |  |
| [CVE-2023-29548](https://patchblox.com/security/data/cve/CVE-2023-29548.md) | Routine | Mozilla Firefox and 4 others: A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. | 6.5 | 0.0070 |  |
| [CVE-2023-32212](https://patchblox.com/security/data/cve/CVE-2023-32212.md) | Routine | Mozilla Firefox and 4 others: An attacker could have positioned a `datalist` element to obscure the address bar. | 6.1 | 0.0065 |  |
| [CVE-2023-1945](https://patchblox.com/security/data/cve/CVE-2023-1945.md) | Routine | Mozilla Thunderbird and 1 other: Out-of-bounds Write | 6.5 | 0.0064 |  |
| [CVE-2023-25738](https://patchblox.com/security/data/cve/CVE-2023-25738.md) | Routine | Mozilla Firefox and 4 others: Out-of-bounds Read | 6.5 | 0.0064 |  |
| [CVE-2024-0747](https://patchblox.com/security/data/cve/CVE-2024-0747.md) | Routine | Mozilla Firefox ESR and 5 others: Protection Mechanism Failure | 6.5 | 0.0060 |  |
| [CVE-2023-29545](https://patchblox.com/security/data/cve/CVE-2023-29545.md) | Routine | Mozilla Firefox and 4 others: Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment… | 6.5 | 0.0058 |  |
| [CVE-2024-1550](https://patchblox.com/security/data/cve/CVE-2024-1550.md) | Routine | Mozilla Firefox ESR and 5 others: Improper Restriction of Rendered UI Layers or Frames | 6.1 | 0.0058 |  |
| [CVE-2024-1549](https://patchblox.com/security/data/cve/CVE-2024-1549.md) | Routine | Mozilla Firefox ESR and 5 others: If a website set a large custom cursor, portions of the cursor could have overlapped with the permission… | 6.1 | 0.0053 |  |
| [CVE-2024-0749](https://patchblox.com/security/data/cve/CVE-2024-0749.md) | Routine | Mozilla Firefox ESR and 5 others: Origin Validation Error | 6.1 | 0.0034 |  |
| [CVE-2024-3861](https://patchblox.com/security/data/cve/CVE-2024-3861.md) | Routine | Mozilla Firefox ESR and 5 others: If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference… | 6.1 | 0.0023 |  |
| [CVE-2023-4054](https://patchblox.com/security/data/cve/CVE-2023-4054.md) | Routine | Mozilla Firefox ESR and 4 others: When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. | 5.5 | 0.0021 |  |
| [CVE-2023-29532](https://patchblox.com/security/data/cve/CVE-2023-29532.md) | Routine | Mozilla Firefox and 4 others: A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing… | 5.5 | 0.0019 |  |

---

Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.