Critical DSA-5129-1 6 CVEs

firefox-esr - security update

Published May 4, 2022 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

Release	Package	Fixed in
Debian · 10	firefox-esr	91.9.0esr-1~deb10u1
Debian · 11	firefox-esr	91.9.0esr-1~deb11u1

Vulnerabilities 6

Critical 9.8

CVE-2022-29917

Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bu…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Dec 22, 2022
High 8.8

CVE-2022-29909

Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level orig…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Dec 22, 2022
Medium 6.5

CVE-2022-29914

When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have …

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Dec 22, 2022
Medium 6.5

CVE-2022-29916

Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. Th…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Dec 22, 2022
Medium 6.1

CVE-2022-29911

An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Dec 22, 2022
Medium 6.1

CVE-2022-29912

Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affe…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Dec 22, 2022