Was this bug introduced in a recent version or is it old? I tried clicking throu...

hannibalhorn · on Jan 8, 2020

Given it affects the ESR release, I suspect it's been around a while. More details would be indeed be nice!

lmkg · on Jan 8, 2020

> The CVE was created last September, so it was known about at least that long

Mozilla could have reserved CVE numbers in blocks, and still be allocating from that batch.

gruez · on Jan 8, 2020

Is there a reason why an organization would continue to use CVE numbers from last year?

callmejonas · on Jan 8, 2020

CVE are assigned from the year the vulnerability was found. Not when it was announced.

However, a CNA like Firefox does not allocate CVE as they need them. They first ask Mitre for a block of X CVE to use as they need. They probably got a new block in September.