The Firefox ESR branch receives security updates, so exposed vulnerabilities get fixed via minor updates.

• https://www.mozilla.org/en-US/firefox/128.1.0/releasenotes/
• https://www.mozilla.org/en-US/firefox/128.2.0/releasenotes/

See:

• https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox.html
• https://www.mozilla.org/en-US/security/known-vulnerabilities/firefoxESR.html

Security Vulnerabilities fixed in Firefox ESR 128.1 — Mozilla

• https://www.mozilla.org/en-US/security/advisories/mfsa2024-35/

Security Vulnerabilities fixed in Firefox ESR 128.2 — Mozilla

• https://www.mozilla.org/en-US/security/advisories/mfsa2024-40/

Tenable is reporting 128.1 and 128.2 as affected by vulnerabilities covered in CVEs' in their plugin 205009 ( https://www.tenable.com/plugins/nessus/205009 ). The rule they are applying is: Mozilla Firefox < 129 That implies that 128.1 and 128.2 are also < then 129 -> therefor vulnerable. Can you please answer 2 questions:

• are Firefox 128.1 and 128.2 part of the same branch of product as 129? Or are they necessarily ESR?

There is no mention of Firefox 128.1.0 esr and 128.2.0 esr on that page though.

Fx 129.0 and Fx 128.1.0esr was released August 6, 2024 while the current Fx 128.2.0esr was released September 3, 2024 so it has security fixes that the older 129.0 and 128.1.0esr does not have. The Fx 128.2.0esr and Fx 130.0.1 are the current Releases. https://www.mozilla.org/firefox/releases/

ESR is short for Extended Support Releases as it only gets security and stability fixes and no new features so as to have longer term stability that Enterprise users need. Firefox 128 ESR is based on the Firefox 128.0 Release but gets longer term security/stability updates, say up to 128.15.0esr.