Was this bug introduced in a recent version or is it old? I tried clicking through to see the bug, but I'm "not authorized".
Edit2: never mind the old edit, lmkg has a good point about the age of the CVE.
Edit2: never mind the old edit, lmkg has a good point about the age of the CVE.
Mozilla could have reserved CVE numbers in blocks, and still be allocating from that batch.
However, a CNA like Firefox does not allocate CVE as they need them. They first ask Mitre for a block of X CVE to use as they need. They probably got a new block in September.