Mozilla Firefox and Thunderbird known exploited vulnerabilities, ranked
CISA lists 6 Mozilla Firefox and Thunderbird CVEs as exploited in the wild. 0 were added in the last 12 months and 0 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2013-1690: EPSS 69.0%, added 2022-03-28
- CVE-2019-11708: EPSS 55.9%, added 2022-05-23
- CVE-2019-17026: EPSS 46.3%, added 2021-11-03
- CVE-2019-11707: EPSS 37.7%, added 2022-05-23
- CVE-2020-6820: EPSS 7.1%, added 2021-11-03
All 6 Mozilla Firefox and Thunderbird CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2013-1690 | Firefox and Thunderbird Denial-of-Service | 69.0% | – | 2022-03-28 | 2022-04-18 |
| 2 | CVE-2019-11708 | Firefox and Thunderbird Sandbox Escape | 55.9% | – | 2022-05-23 | 2022-06-13 |
| 3 | CVE-2019-17026 | Firefox And Thunderbird Type Confusion | 46.3% | – | 2021-11-03 | 2022-05-03 |
| 4 | CVE-2019-11707 | Firefox and Thunderbird Type Confusion | 37.7% | – | 2022-05-23 | 2022-06-13 |
| 5 | CVE-2020-6820 | Firefox And Thunderbird Use-After-Free | 7.1% | – | 2021-11-03 | 2022-05-03 |
| 6 | CVE-2020-6819 | Firefox And Thunderbird Use-After-Free | 3.0% | – | 2021-11-03 | 2022-05-03 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Mozilla KEV CVEs · other Mozilla products: Firefox · free KEV badge for Mozilla · all vendors