Mozilla Firefox (en-US) 120.0
Mozilla Firefox (en-US) 120.0, released November 21, 2023, fixes 10 CVEs in Mozilla Firefox (en-US). None of them is reported as exploited. Patch Radar priority: High. The latest Mozilla Firefox (en-US) is 159.0, which also fixes every one of these CVEs.
Superseded. The latest Mozilla Firefox (en-US) is 159.0, which also fixes every CVE on this page. Install that instead.
Priority of the 10 CVEs
Applies to
| Product | Version |
|---|---|
| Mozilla Firefox (en-US) | 120.0 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| High | CVE-2023-6212 | Mozilla Firefox ESR and 5 others: Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. | 8.8 | 0.0095 | None reported |
| High | CVE-2023-6207 | Mozilla Firefox ESR and 5 others: Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox… | 8.8 | 0.0091 | None reported |
| High | CVE-2023-6208 | Mozilla Firefox ESR and 5 others: When using X11, text selected by the page using the Selection API was erroneously copied into the primary… | 8.8 | 0.0089 | None reported |
| High | CVE-2023-6205 | Mozilla Firefox ESR and 5 others: It was possible to cause the use of a MessagePort after it had already been freed, which could potentially… | 7.5 | 0.0087 | None reported |
| High | CVE-2023-6204 | Mozilla Firefox ESR and 5 others: On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds… | 7.5 | 0.0084 | None reported |
| High | CVE-2023-6213 | Mozilla Firefox ESR and 3 others: Memory safety bugs present in Firefox 119. | 8.8 | 0.0067 | None reported |
| High | CVE-2023-6206 | Mozilla Firefox ESR and 5 others: The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay… | 7.5 | 0.0064 | None reported |
| Routine | CVE-2023-6209 | Mozilla Firefox ESR and 5 others: Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in… | 6.5 | 0.0142 | None reported |
| Routine | CVE-2023-6210 | Mozilla Firefox ESR and 3 others: When an https: web page created a pop-up from a "javascript:" URL, that pop-up was incorrectly allowed… | 6.5 | 0.0061 | None reported |
| Routine | CVE-2023-6211 | Mozilla Firefox ESR and 3 others: If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only… | 6.5 | 0.0049 | None reported |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.