Every CVE Search/ Get API key

CVE-2019-11717

A vulnerability exists where the caret ("^") character is improperly escaped constructing some...

5.3 MediumFix available

A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

2.13%Down 0.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.3

A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Record
CVE-2019-11717
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-116
Updated
2026-11-02
CVE List No score

A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Record
CVE-2019-11717
Updated
2026-11-02
EUVDEUVD-2019-3387 No score

A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Record
EUVD-2019-3387
Updated
2026-11-03
GitHub AdvisoriesGHSA-vp8c-39q7-pxqc 5.3

A vulnerability exists where the caret ("^") character is improperly escaped constructing some...

A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Record
GHSA-vp8c-39q7-pxqc
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-116
Updated
2026-11-02
OSVALPINE-CVE-2019-11717 5.3

A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Record
ALPINE-CVE-2019-11717
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-03
OSV 5.3

A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Record
CVE-2019-11717
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 32 moreShow less
OSVDEBIAN-CVE-2019-11717 5.3

A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Record
DEBIAN-CVE-2019-11717
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVRHSA-2019:1763 9.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2019:1763
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:1764 9.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2019:1764
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:1765 9.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2019:1765
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:1775 9.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2019:1775
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:1777 9.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2019:1777
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:1799 9.8

Red Hat Security Advisory: thunderbird security and bug fix update

Record
RHSA-2019:1799
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-11717 5.3

A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Record
UBUNTU-CVE-2019-11717
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVMGASA-2019-0211 No score

Updated firefox packages fix security vulnerability

Sandbox escape via installation of malicious language pack. (CVE-2019-9811)

Script injection within domain through inner window reuse. (CVE-2019-11711)

Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects. (CVE-2019-11712)

Use-after-free with HTTP/2 cached stream. (CVE-2019-11713)

Empty or malformed p256-ECDH public keys may trigger a segmentation fault. (CVE-2019-11729)

HTML parsing error can contribute to content XSS. (CVE-2019-11715)

Caret character improperly escaped in origins. (CVE-2019-11717)

Out-of-bounds read when importing curve25519 private key. (CVE-2019-11719)

Same-origin policy treats all files in a directory as having the same-origin. (CVE-2019-11730)

Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8. (CVE-2019-11709)

Record
MGASA-2019-0211
Updated
2026-11-02
OSVMGASA-2019-0212 No score

Updated thunderbird packages fix security vulnerability

Sandbox escape via installation of malicious language pack. (CVE-2019-9811)

Script injection within domain through inner window reuse. (CVE-2019-11711)

Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects. (CVE-2019-11712)

Use-after-free with HTTP/2 cached stream. (CVE-2019-11713)

Empty or malformed p256-ECDH public keys may trigger a segmentation fault. (CVE-2019-11729)

HTML parsing error can contribute to content XSS. (CVE-2019-11715)

Caret character improperly escaped in origins. (CVE-2019-11717)

Out-of-bounds read when importing curve25519 private key. (CVE-2019-11719)

Same-origin policy treats all files in a directory as having the same-origin. (CVE-2019-11730)

Memory safety bugs fixed in Firefox 68, Firefox ESR 60.8 and Thunderbird 60.8. (CVE-2019-11709)

Enigmail 2.0.12 sets the default keyserver to keys.openpgp.org in order to mitigate the SKS Keyserver Network Attack.

Record
MGASA-2019-0212
Updated
2026-11-02
OSVMGASA-2019-0213 No score

Updated firefox packages fix security vulnerability

Sandbox escape via installation of malicious language pack. (CVE-2019-9811)

Script injection within domain through inner window reuse. (CVE-2019-11711)

Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects. (CVE-2019-11712)

Use-after-free with HTTP/2 cached stream. (CVE-2019-11713)

NeckoChild can trigger crash when accessed off of main thread. (CVE-2019-11714)

Empty or malformed p256-ECDH public keys may trigger a segmentation fault. (CVE-2019-11729)

HTML parsing error can contribute to content XSS. (CVE-2019-11715)

globalThis not enumerable until accessed. (CVE-2019-11716)

Caret character improperly escaped in origins. (CVE-2019-11717)

Activity Stream writes unsanitized content to innerHTML. (CVE-2019-11718)

Out-of-bounds read when importing curve25519 private key. (CVE-2019-11719)

Character encoding XSS vulnerability. (CVE-2019-11720)

Domain spoofing through unicode latin 'kra' character. (CVE-2019-11721)

Same-origin policy treats all files in a directory as having the same-origin. (CVE-2019-11730)

Cookie leakage during add-on fetching across private browsing boundaries. (CVE-2019-11723)

Retired site input.mozilla.org has remote troubleshooting permissions. (CVE-2019-11724)

Websocket resources bypass safebrowsing protections. (CVE-2019-11725)

PKCS#1 v1.5 signatures can be used for TLS 1.3. (CVE-2019-11727)

Port scanning through Alt-Svc header. (CVE-2019-11728)

Memory safety bugs fixed in Firefox 68. (CVE-2019-11710)

Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8. (CVE-2019-11709)

Record
MGASA-2019-0213
Updated
2026-11-02
OSVMGASA-2019-0272 No score

Updated thunderbird packages fix security vulnerabilities

This update provides an update to thunderbird 68.0, updates enigmail to 2.1.2 and fixes the following security issues:

Memory safety bugs fixed in Firefox 68, Firefox ESR 60.8, and Thunderbird 68. (CVE-2019-11709)

Memory safety bugs fixed in Firefox 68 and Thunderbird 68. (CVE-2019-11710)

Script injection within domain through inner window reuse. (CVE-2019-11711)

Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects. (CVE-2019-11712)

Use-after-free with HTTP/2 cached stream. (CVE-2019-11713)

NeckoChild can trigger crash when accessed off of main thread. (CVE-2019-11714)

HTML parsing error can contribute to content XSS. (CVE-2019-11715)

globalThis not enumerable until accessed. (CVE-2019-11716)

Caret character improperly escaped in origins. (CVE-2019-11717)

Out-of-bounds read when importing curve25519 private key. (CVE-2019-11719)

Character encoding XSS vulnerability. (CVE-2019-11720)

Domain spoofing through unicode latin 'kra' character. (CVE-2019-11721)

Cookie leakage during add-on fetching across private browsing boundaries. (CVE-2019-11723)

Retired site input.mozilla.org has remote troubleshooting permissions. (CVE-2019-11724)

Websocket resources bypass safebrowsing protections. (CVE-2019-11725)

PKCS#1 v1.5 signatures can be used for TLS 1.3. (CVE-2019-11727)

Port scanning through Alt-Svc header. (CVE-2019-11728)

Empty or malformed p256-ECDH public keys may trigger a segmentation fault. (CVE-2019-11729)

Same-origin policy treats all files in a directory as having the same-origin. (CVE-2019-11730)

NOTE! If your lightning calendar disappears with this update, see the referenced support.mozilla.org link in the advisories.

Record
MGASA-2019-0272
Updated
2026-11-02
OSVopenSUSE-SU-2019:1782-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox, mozilla-nss fixes the following issues:

MozillaFirefox to version ESR 60.8:

  • CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868).
  • CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868).
  • CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868).
  • CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868).
  • CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868).
  • CVE-2019-11715: HTML parsing error can contribute to content XSS (bsc#1140868).
  • CVE-2019-11717: Caret character improperly escaped in origins (bsc#1140868).
  • CVE-2019-11719: Out-of-bounds read when importing curve25519 private key (bsc#1140868).
  • CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin (bsc#1140868).
  • CVE-2019-11709: Multiple Memory safety bugs fixed (bsc#1140868).

mozilla-nss to version 3.44.1:

  • Added IPSEC IKE support to softoken
  • Many new FIPS test cases

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:1782-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:1811-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox, mozilla-nss fixes the following issues:

MozillaFirefox to version ESR 60.8:

  • CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868).
  • CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868).
  • CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868).
  • CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868).
  • CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868).
  • CVE-2019-11715: HTML parsing error can contribute to content XSS (bsc#1140868).
  • CVE-2019-11717: Caret character improperly escaped in origins (bsc#1140868).
  • CVE-2019-11719: Out-of-bounds read when importing curve25519 private key (bsc#1140868).
  • CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin (bsc#1140868).
  • CVE-2019-11709: Multiple Memory safety bugs fixed (bsc#1140868).

mozilla-nss to version 3.44.1:

  • Added IPSEC IKE support to softoken
  • Many new FIPS test cases

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:1811-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:1813-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird version 60.8 fixes the following issues:

Security issues fixed:

  • CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868).
  • CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868).
  • CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868).
  • CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868).
  • CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868).
  • CVE-2019-11715: HTML parsing error can contribute to content XSS (bsc#1140868).
  • CVE-2019-11717: Caret character improperly escaped in origins (bsc#1140868).
  • CVE-2019-11719: Out-of-bounds read when importing curve25519 private key (bsc#1140868).
  • CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin (bsc#1140868).
  • CVE-2019-11709: Multiple Memory safety bugs fixed (bsc#1140868).

Non-security issued fixed:

  • Calendar: Problems when editing event times, some related to AM/PM setting in non-English locales

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:1813-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:1990-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

  • Generate langpacks sequentially to avoid file corruption from racy file writes (boo#1137970)

  • Mozilla Thunderbird 60.8.0

    • Calendar: Problems when editing event times, some related to AM/PM setting in non-English locales MFSA 2019-23 (boo#1140868)
    • CVE-2019-9811 (bmo#1538007, bmo#1539598, bmo#1563327) Sandbox escape via installation of malicious languagepack
    • CVE-2019-11711 (bmo#1552541) Script injection within domain through inner window reuse
    • CVE-2019-11712 (bmo#1543804) Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects
    • CVE-2019-11713 (bmo#1528481) Use-after-free with HTTP/2 cached stream
    • CVE-2019-11729 (bmo#1515342) Empty or malformed p256-ECDH public keys may trigger a segmentation fault
    • CVE-2019-11715 (bmo#1555523) HTML parsing error can contribute to content XSS
    • CVE-2019-11717 (bmo#1548306) Caret character improperly escaped in origins
    • CVE-2019-11719 (bmo#1540541) Out-of-bounds read when importing curve25519 private key
    • CVE-2019-11730 (bmo#1558299) Same-origin policy treats all files in a directory as having the same-origin
    • CVE-2019-11709 (bmo#1547266, bmo#1540759, bmo#1548822, bmo#1550498 bmo#1515052, bmo#1539219, bmo#1547757, bmo#1550498, bmo#1533522) Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8 and Thunderbird 60.8
Record
openSUSE-SU-2019:1990-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2248-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird to version 68.1.1 fixes the following issues:

  • CVE-2019-11709: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11711: Fixed a script injection within domain through inner window reuse. (bsc#1140868)
  • CVE-2019-11712: Fixed an insufficient validation of cross-origin POST requests within NPAPI plugins. (bsc#1140868)
  • CVE-2019-11713: Fixed a use-after-free with HTTP/2 cached stream. (bsc#1140868)
  • CVE-2019-11714: Fixed a crash in NeckoChild. (bsc#1140868)
  • CVE-2019-11715: Fixed an HTML parsing error that can contribute to content XSS. (bsc#1140868)
  • CVE-2019-11716: Fixed an enumeration issue in globalThis. (bsc#1140868)
  • CVE-2019-11717: Fixed an improper escaping of the caret character in origins. (bsc#1140868)
  • CVE-2019-11719: Fixed an out-of-bounds read when importing curve25519 private key. (bsc#1140868)
  • CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
  • CVE-2019-11721: Fixed domain spoofing through unicode latin 'kra' character. (bsc#1140868)
  • CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
  • CVE-2019-11724: Fixed a permissions issue with the retired site input.mozilla.org. (bsc#1140868)
  • CVE-2019-11725: Fixed a SafeBrowsing bypass through WebSockets. (bsc#1140868)
  • CVE-2019-11727: Fixed an insufficient validation for PKCS#1 v1.5 signatures being used with TLS 1.3. (bsc#1140868)
  • CVE-2019-11728: Fixed port scanning through Alt-Svc header. (bsc#1140868)
  • CVE-2019-11729: Fixed a segmentation fault due to empty or malformed p256-ECDH public keys. (bsc#1140868)
  • CVE-2019-11730: Fixed an insufficient enforcement of the same-origin policy that treats all files in a directory as having the same-origin. (bsc#1140868)
  • CVE-2019-11739: Fixed a Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message. (bsc#1150939)
  • CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
  • CVE-2019-11742: Fixed a same-origin policy violation with SVG filters and canvas that enabled theft of cross-origin images. (bsc#1149303)
  • CVE-2019-11743: Fixed a cross-origin access issue. (bsc#1149298)
  • CVE-2019-11744: Fixed a XSS involving breaking out of title and textarea elements using innerHTML. (bsc#1149304)
  • CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
  • CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
  • CVE-2019-11755: Fixed an insufficient validation of S/MIME messages that allowed the author to be spoofed. (bsc#1152375)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2248-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2249-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird to version 68.1.1 fixes the following issues:

  • CVE-2019-11709: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11711: Fixed a script injection within domain through inner window reuse. (bsc#1140868)
  • CVE-2019-11712: Fixed an insufficient validation of cross-origin POST requests within NPAPI plugins. (bsc#1140868)
  • CVE-2019-11713: Fixed a use-after-free with HTTP/2 cached stream. (bsc#1140868)
  • CVE-2019-11714: Fixed a crash in NeckoChild. (bsc#1140868)
  • CVE-2019-11715: Fixed an HTML parsing error that can contribute to content XSS. (bsc#1140868)
  • CVE-2019-11716: Fixed an enumeration issue in globalThis. (bsc#1140868)
  • CVE-2019-11717: Fixed an improper escaping of the caret character in origins. (bsc#1140868)
  • CVE-2019-11719: Fixed an out-of-bounds read when importing curve25519 private key. (bsc#1140868)
  • CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
  • CVE-2019-11721: Fixed domain spoofing through unicode latin 'kra' character. (bsc#1140868)
  • CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
  • CVE-2019-11724: Fixed a permissions issue with the retired site input.mozilla.org. (bsc#1140868)
  • CVE-2019-11725: Fixed a SafeBrowsing bypass through WebSockets. (bsc#1140868)
  • CVE-2019-11727: Fixed an insufficient validation for PKCS#1 v1.5 signatures being used with TLS 1.3. (bsc#1140868)
  • CVE-2019-11728: Fixed port scanning through Alt-Svc header. (bsc#1140868)
  • CVE-2019-11729: Fixed a segmentation fault due to empty or malformed p256-ECDH public keys. (bsc#1140868)
  • CVE-2019-11730: Fixed an insufficient enforcement of the same-origin policy that treats all files in a directory as having the same-origin. (bsc#1140868)
  • CVE-2019-11739: Fixed a Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message. (bsc#1150939)
  • CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
  • CVE-2019-11742: Fixed a same-origin policy violation with SVG filters and canvas that enabled theft of cross-origin images. (bsc#1149303)
  • CVE-2019-11743: Fixed a cross-origin access issue. (bsc#1149298)
  • CVE-2019-11744: Fixed a XSS involving breaking out of title and textarea elements using innerHTML. (bsc#1149304)
  • CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
  • CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
  • CVE-2019-11755: Fixed an insufficient validation of S/MIME messages that allowed the author to be spoofed. (bsc#1152375)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2249-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10600-1 No score

MozillaFirefox-92.0-1.2 on GA media

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10600-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10601-1 No score

MozillaThunderbird-91.1.1-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10601-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02
OSVSUSE-SU-2019:14124-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox to version ESR 60.8 fixes the following issues:

Security issues fixed:

  • CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868).
  • CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868).
  • CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868).
  • CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868).
  • CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868).
  • CVE-2019-11715: HTML parsing error can contribute to content XSS (bsc#1140868).
  • CVE-2019-11717: Caret character improperly escaped in origins (bsc#1140868).
  • CVE-2019-11719: Out-of-bounds read when importing curve25519 private key (bsc#1140868).
  • CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin (bsc#1140868).
  • CVE-2019-11709: Multiple Memory safety bugs fixed (bsc#1140868).
  • CVE-2019-11708: Fix sandbox escape using Prompt:Open (bsc#1138872).
  • CVE-2019-11707: Fixed a type confusion vulnerability in Arrary.pop (bsc#1138614)

Non-security issues fixed:

  • Fix broken language plugins (bsc#1137792)
Record
SUSE-SU-2019:14124-1
Updated
2026-11-02
OSVSUSE-SU-2019:14246-1 No score

Security update for Mozilla Firefox

This update contains the Mozilla Firefox ESR 68.2 release.

Mozilla Firefox was updated to ESR 68.2 release:

  • Enterprise: New administrative policies were added. More information and templates are available at the Policy Templates page.

  • Various security fixes: MFSA 2019-33 (bsc#1154738)

    • CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber
    • CVE-2019-11757: Use-after-free when creating index updates in IndexedDB
    • CVE-2019-11758: Potentially exploitable crash due to 360 Total Security
    • CVE-2019-11759: Stack buffer overflow in HKDF output
    • CVE-2019-11760: Stack buffer overflow in WebRTC networking
    • CVE-2019-11761: Unintended access to a privileged JSONView object
    • CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation
    • CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique
    • CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2

Other Issues resolved:

  • [bsc#1104841] Newer versions of firefox have a dependency on GLIBCXX_3.4.20
  • [bsc#1074235] MozillaFirefox: background tab crash reports sent inadvertently without user opt-in
  • [bsc#1043008] Firefox hangs randomly when browsing and scrolling
  • [bsc#1025108] Firefox stops loading page until mouse is moved
  • [bsc#905528] Firefox malfunctions due to broken omni.ja archives
Record
SUSE-SU-2019:14246-1
Updated
2026-11-02
OSVSUSE-SU-2019:1861-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox, mozilla-nss fixes the following issues:

MozillaFirefox to version ESR 60.8:

  • CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868).
  • CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868).
  • CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868).
  • CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868).
  • CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868).
  • CVE-2019-11715: HTML parsing error can contribute to content XSS (bsc#1140868).
  • CVE-2019-11717: Caret character improperly escaped in origins (bsc#1140868).
  • CVE-2019-11719: Out-of-bounds read when importing curve25519 private key (bsc#1140868).
  • CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin (bsc#1140868).
  • CVE-2019-11709: Multiple Memory safety bugs fixed (bsc#1140868).

mozilla-nss to version 3.44.1:

  • Added IPSEC IKE support to softoken
  • Many new FIPS test cases
Record
SUSE-SU-2019:1861-1
Updated
2026-11-02
OSVSUSE-SU-2019:1861-2 No score

Security update for MozillaFirefox

This update for MozillaFirefox, mozilla-nss fixes the following issues:

MozillaFirefox to version ESR 60.8:

  • CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868).
  • CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868).
  • CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868).
  • CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868).
  • CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868).
  • CVE-2019-11715: HTML parsing error can contribute to content XSS (bsc#1140868).
  • CVE-2019-11717: Caret character improperly escaped in origins (bsc#1140868).
  • CVE-2019-11719: Out-of-bounds read when importing curve25519 private key (bsc#1140868).
  • CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin (bsc#1140868).
  • CVE-2019-11709: Multiple Memory safety bugs fixed (bsc#1140868).

mozilla-nss to version 3.44.1:

  • Added IPSEC IKE support to softoken
  • Many new FIPS test cases
Record
SUSE-SU-2019:1861-2
Updated
2026-11-02
OSVSUSE-SU-2019:1861-3 No score

Security update for MozillaFirefox

This update for MozillaFirefox, mozilla-nss fixes the following issues:

MozillaFirefox to version ESR 60.8:

  • CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868).
  • CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868).
  • CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868).
  • CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868).
  • CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868).
  • CVE-2019-11715: HTML parsing error can contribute to content XSS (bsc#1140868).
  • CVE-2019-11717: Caret character improperly escaped in origins (bsc#1140868).
  • CVE-2019-11719: Out-of-bounds read when importing curve25519 private key (bsc#1140868).
  • CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin (bsc#1140868).
  • CVE-2019-11709: Multiple Memory safety bugs fixed (bsc#1140868).

mozilla-nss to version 3.44.1:

  • Added IPSEC IKE support to softoken
  • Many new FIPS test cases
Record
SUSE-SU-2019:1861-3
Updated
2026-11-02
OSVSUSE-SU-2019:1869-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox, mozilla-nss fixes the following issues:

MozillaFirefox to version ESR 60.8:

  • CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868).
  • CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868).
  • CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868).
  • CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868).
  • CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868).
  • CVE-2019-11715: HTML parsing error can contribute to content XSS (bsc#1140868).
  • CVE-2019-11717: Caret character improperly escaped in origins (bsc#1140868).
  • CVE-2019-11719: Out-of-bounds read when importing curve25519 private key (bsc#1140868).
  • CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin (bsc#1140868).
  • CVE-2019-11709: Multiple Memory safety bugs fixed (bsc#1140868).

mozilla-nss to version 3.44.1:

  • Added IPSEC IKE support to softoken
  • Many new FIPS test cases
Record
SUSE-SU-2019:1869-1
Updated
2026-11-02
OSVSUSE-SU-2019:1960-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird version 60.8 fixes the following issues:

Security issues fixed:

  • CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868).
  • CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868).
  • CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868).
  • CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868).
  • CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868).
  • CVE-2019-11715: HTML parsing error can contribute to content XSS (bsc#1140868).
  • CVE-2019-11717: Caret character improperly escaped in origins (bsc#1140868).
  • CVE-2019-11719: Out-of-bounds read when importing curve25519 private key (bsc#1140868).
  • CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin (bsc#1140868).
  • CVE-2019-11709: Multiple Memory safety bugs fixed (bsc#1140868).

Non-security issued fixed:

  • Calendar: Problems when editing event times, some related to AM/PM setting in non-English locales
Record
SUSE-SU-2019:1960-1
Updated
2026-11-02
OSVSUSE-SU-2019:2515-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird to version 68.1.1 fixes the following issues:

  • CVE-2019-11709: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11711: Fixed a script injection within domain through inner window reuse. (bsc#1140868)
  • CVE-2019-11712: Fixed an insufficient validation of cross-origin POST requests within NPAPI plugins. (bsc#1140868)
  • CVE-2019-11713: Fixed a use-after-free with HTTP/2 cached stream. (bsc#1140868)
  • CVE-2019-11714: Fixed a crash in NeckoChild. (bsc#1140868)
  • CVE-2019-11715: Fixed an HTML parsing error that can contribute to content XSS. (bsc#1140868)
  • CVE-2019-11716: Fixed an enumeration issue in globalThis. (bsc#1140868)
  • CVE-2019-11717: Fixed an improper escaping of the caret character in origins. (bsc#1140868)
  • CVE-2019-11719: Fixed an out-of-bounds read when importing curve25519 private key. (bsc#1140868)
  • CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
  • CVE-2019-11721: Fixed domain spoofing through unicode latin 'kra' character. (bsc#1140868)
  • CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
  • CVE-2019-11724: Fixed a permissions issue with the retired site input.mozilla.org. (bsc#1140868)
  • CVE-2019-11725: Fixed a SafeBrowsing bypass through WebSockets. (bsc#1140868)
  • CVE-2019-11727: Fixed an insufficient validation for PKCS#1 v1.5 signatures being used with TLS 1.3. (bsc#1140868)
  • CVE-2019-11728: Fixed port scanning through Alt-Svc header. (bsc#1140868)
  • CVE-2019-11729: Fixed a segmentation fault due to empty or malformed p256-ECDH public keys. (bsc#1140868)
  • CVE-2019-11730: Fixed an insufficient enforcement of the same-origin policy that treats all files in a directory as having the same-origin. (bsc#1140868)
  • CVE-2019-11739: Fixed a Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message. (bsc#1150939)
  • CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
  • CVE-2019-11742: Fixed a same-origin policy violation with SVG filters and canvas that enabled theft of cross-origin images. (bsc#1149303)
  • CVE-2019-11743: Fixed a cross-origin access issue. (bsc#1149298)
  • CVE-2019-11744: Fixed a XSS involving breaking out of title and textarea elements using innerHTML. (bsc#1149304)
  • CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
  • CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
  • CVE-2019-11755: Fixed an insufficient validation of S/MIME messages that allowed the author to be spoofed. (bsc#1152375)
Record
SUSE-SU-2019:2515-1
Updated
2026-11-02
OSVSUSE-SU-2019:2620-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Updated to new ESR version 68.1 (bsc#1149323).

In addition to the already fixed vulnerabilities released in previous ESR updates, the following were also fixed: CVE-2019-11751, CVE-2019-11736, CVE-2019-9812, CVE-2019-11748, CVE-2019-11749, CVE-2019-11750, CVE-2019-11738, CVE-2019-11747, CVE-2019-11735.

Several run-time issues were also resolved (bsc#1117473, bsc#1124525, bsc#1133810).

The version displayed in Help > About is now correct (bsc#1087200).

Record
SUSE-SU-2019:2620-1
Updated
2026-11-02
OSVUSN-4054-1 No score

firefox vulnerabilities

A sandbox escape was discovered in Firefox. If a user were tricked in to installing a malicious language pack, an attacker could exploit this to gain additional privileges. (CVE-2019-9811)

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass same origin restrictions, conduct cross-site scripting (XSS) attacks, conduct cross-site request forgery (CSRF) attacks, spoof origin attributes, spoof the addressbar contents, bypass safebrowsing protections, or execute arbitrary code. (CVE-2019-11709, CVE-2019-11710, CVE-2019-11711, CVE-2019-11712, CVE-2019-11713, CVE-2019-11714, CVE-2019-11715, CVE-2019-11716, CVE-2019-11717, CVE-2019-11718, CVE-2019-11719, CVE-2019-11720, CVE-2019-11721, CVE-2019-11723, CVE-2019-11724, CVE-2019-11725, CVE-2019-11727, CVE-2019-11728, CVE-2019-11729)

It was discovered that Firefox treats all files in a directory as same origin. If a user were tricked in to downloading a specially crafted HTML file, an attacker could potentially exploit this to obtain sensitive information from local files. (CVE-2019-11730)

Record
USN-4054-1
Updated
2026-11-02
OSVUSN-4064-1 No score

thunderbird vulnerabilities

A sandbox escape was discovered in Thunderbird. If a user were tricked in to installing a malicious language pack, an attacker could exploit this to gain additional privileges. (CVE-2019-9811)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass same origin restrictions, conduct cross-site scripting (XSS) attacks, spoof origin attributes, or execute arbitrary code. (CVE-2019-11709, CVE-2019-11711, CVE-2019-11712, CVE-2019-11713, CVE-2019-11715, CVE-2019-11717)

It was discovered that NSS incorrectly handled importing certain curve25519 private keys. An attacker could exploit this issue to cause Thunderbird to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2019-11719)

It was discovered that NSS incorrectly handled certain p256-ECDH public keys. An attacker could possibly exploit this issue to cause Thunderbird to crash, resulting in a denial of service. (CVE-2019-11729)

It was discovered that Thunderbird treats all files in a directory as same origin. If a user were tricked in to downloading a specially crafted HTML file, an attacker could potentially exploit this to obtain sensitive information from local files. (CVE-2019-11730)

Record
USN-4064-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firefox-esr
Alpine:v3.10
 before 60.8.0-r0
60.8.0-r0
firefox-esr
Alpine:v3.11
 before 68.0-r0
68.0-r0
firefox-esr
Alpine:v3.12
 before 68.0-r0
68.0-r0
firefox-esr
Alpine:v3.13
 before 68.0-r0
68.0-r0
firefox-esr
Alpine:v3.14
 before 68.0-r0
68.0-r0
firefox-esr
Alpine:v3.15
 before 68.0-r0
68.0-r0
firefox-esr
Alpine:v3.16
 before 68.0-r0
68.0-r0
firefox-esr
Alpine:v3.17
 before 68.0-r0
68.0-r0
firefox-esr
Alpine:v3.18
 before 68.0-r0
68.0-r0
firefox-esr
Alpine:v3.19
 before 68.0-r0
68.0-r0
Show 186 moreShow less
Affected packages
PackageAffectedFixed
firefox-esr
Alpine:v3.20
 before 68.0-r0
68.0-r0
firefox-esr
Alpine:v3.21
 before 68.0-r0
68.0-r0
firefox-esr
Alpine:v3.22
 before 68.0-r0
68.0-r0
firefox-esr
Alpine:v3.23
 before 68.0-r0
68.0-r0
firefox-esr
Alpine:v3.9
 before 60.8.0-r0
60.8.0-r0
firefox-esr
Debian:12
 before 60.8.0esr-1
60.8.0esr-1
firefox-esr
Debian:13
 before 60.8.0esr-1
60.8.0esr-1
firefox-esr
Debian:14
 before 60.8.0esr-1
60.8.0esr-1
thunderbird
Debian:12
 before 1:60.8.0-1
1:60.8.0-1
thunderbird
Debian:13
 before 1:60.8.0-1
1:60.8.0-1
thunderbird
Debian:14
 before 1:60.8.0-1
1:60.8.0-1
firefox-esr
Debian:8
From an advisory covering 8 CVEs
 before 60.8.0esr-1~deb8u1, plus listed versions
45.0.1esr-145.0.2esr-145.0esr-145.0esr-245.1.0esr-1
Show 45 moreShow less
45.1.1esr-145.2.0esr-145.2.0esr-1~deb7u145.2.0esr-1~deb8u145.3.0esr-145.3.0esr-1~deb7u145.3.0esr-1~deb8u145.3.0esr-245.4.0esr-145.4.0esr-1~deb7u145.4.0esr-1~deb7u245.4.0esr-1~deb8u145.4.0esr-1~deb8u245.4.0esr-245.5.0esr-145.5.0esr-1~deb8u145.5.1esr-145.5.1esr-1~deb7u145.5.1esr-1~deb8u145.6.0esr-145.6.0esr-1~deb7u145.6.0esr-1~deb8u145.7.0esr-145.7.0esr-1~deb7u145.7.0esr-1~deb8u145.7.0esr-245.7.0esr-345.7.0esr-445.8.0esr-145.8.0esr-1~deb7u145.8.0esr-1~deb8u145.9.0esr-145.9.0esr-1~deb7u145.9.0esr-1~deb8u152.0.1esr-152.0.2esr-152.0esr-152.1.0esr-152.2.0esr-152.2.0esr-1~deb7u152.2.0esr-1~deb8u152.2.0esr-1~deb9u152.2.0esr-252.3.0esr-152.3.0esr-1~deb7u1
60.8.0esr-1~deb8u1
thunderbird
Debian:8
From an advisory covering 8 CVEs
 before 1:60.8.0-1~deb8u1, plus listed versions
1.5-41.5.0.2-11.5.0.2-21.5.0.2-31.5.0.4-1
Show 45 moreShow less
1.5.0.4-21.5.0.4-31.5.0.5-11.5.0.7-11.5.0.7-21:52.4.0-11:52.4.0-1~deb7u11:52.4.0-1~deb8u11:52.4.0-1~deb9u11:52.4.0-2~exp11:52.5.0-11:52.5.0-1~deb7u11:52.5.0-1~deb8u11:52.5.0-1~deb9u11:52.5.2-11:52.5.2-1~deb7u11:52.5.2-21:52.5.2-2~deb8u11:52.5.2-2~deb9u11:52.6.0-11:52.6.0-1+alpha.11:52.6.0-1+alpha.21:52.6.0-1~deb7u11:52.6.0-1~deb8u11:52.6.0-1~deb9u11:52.7.0-11:52.7.0-1~deb7u11:52.7.0-1~deb8u11:52.7.0-1~deb9u11:52.8.0-11:52.8.0-1~deb7u11:52.8.0-1~deb8u11:52.8.0-1~deb9u11:52.9.0-11:52.9.1-11:52.9.1-1~deb8u11:52.9.1-1~deb9u11:58.0~b3-11:60.0-11:60.0-21:60.0-2~deb9u11:60.0-31:60.0-3~deb9u11:60.0~b10-11:60.0~b2-1
1:60.8.0-1~deb8u1
firefox-esr
Debian:9
From an advisory covering 8 CVEs
 before 60.8.0esr-1~deb9u1, plus listed versions
45.9.0esr-152.0.1esr-152.0.2esr-152.0esr-152.1.0esr-1
Show 45 moreShow less
52.2.0esr-152.2.0esr-1~deb7u152.2.0esr-1~deb8u152.2.0esr-1~deb9u152.2.0esr-252.3.0esr-152.3.0esr-1~deb7u152.3.0esr-1~deb8u152.3.0esr-1~deb8u252.3.0esr-1~deb9u152.3.0esr-252.4.0esr-1~deb8u152.4.0esr-1~deb9u152.4.0esr-252.4.0esr-2~deb7u152.5.0esr-152.5.0esr-1~deb7u152.5.0esr-1~deb8u152.5.0esr-1~deb9u152.5.2esr-152.5.2esr-1~deb7u152.5.2esr-1~deb8u152.5.2esr-1~deb9u152.5.3esr-152.6.0esr-152.6.0esr-1~deb7u152.6.0esr-1~deb8u152.6.0esr-1~deb9u152.6.0esr-252.6.0esr-2+alpha.152.6.0esr-2+alpha.252.7.0esr-152.7.0esr-1~deb8u152.7.0esr-1~deb9u152.7.1esr-152.7.1esr-1~deb7u152.7.1esr-1~deb8u152.7.1esr-1~deb9u152.7.2esr-152.7.2esr-1~deb7u152.7.2esr-1~deb8u152.7.2esr-1~deb9u152.7.3esr-152.7.3esr-1~deb7u152.7.3esr-1~deb8u1
60.8.0esr-1~deb9u1
firefox-esr
Debian:10
From an advisory covering 8 CVEs
 before 60.8.0esr-1~deb10u1, plus listed versions
60.7.2esr-160.8.0esr-1~deb8u160.8.0esr-1~deb9u1
60.8.0esr-1~deb10u1
thunderbird
Debian:9
From an advisory covering 8 CVEs
 before 1:60.8.0-1~deb9u1, plus listed versions
1.5-41.5.0.2-11.5.0.2-21.5.0.2-31.5.0.4-1
Show 45 moreShow less
1.5.0.4-21.5.0.4-31.5.0.5-11.5.0.7-11.5.0.7-21:52.4.0-11:52.4.0-1~deb7u11:52.4.0-1~deb8u11:52.4.0-1~deb9u11:52.4.0-2~exp11:52.5.0-11:52.5.0-1~deb7u11:52.5.0-1~deb8u11:52.5.0-1~deb9u11:52.5.2-11:52.5.2-1~deb7u11:52.5.2-21:52.5.2-2~deb8u11:52.5.2-2~deb9u11:52.6.0-11:52.6.0-1+alpha.11:52.6.0-1+alpha.21:52.6.0-1~deb7u11:52.6.0-1~deb8u11:52.6.0-1~deb9u11:52.7.0-11:52.7.0-1~deb7u11:52.7.0-1~deb8u11:52.7.0-1~deb9u11:52.8.0-11:52.8.0-1~deb7u11:52.8.0-1~deb8u11:52.8.0-1~deb9u11:52.9.0-11:52.9.1-11:52.9.1-1~deb8u11:52.9.1-1~deb9u11:58.0~b3-11:60.0-11:60.0-21:60.0-2~deb9u11:60.0-31:60.0-3~deb9u11:60.0~b10-11:60.0~b2-1
1:60.8.0-1~deb9u1
thunderbird
Debian:10
From an advisory covering 8 CVEs
 before 1:60.8.0-1~deb10u1, plus listed versions
1:60.7.2-11:60.8.0-1~deb8u11:60.8.0-1~deb9u1
1:60.8.0-1~deb10u1
firefox
Mageia:6
From an advisory covering 10 CVEs
 before 60.8.0-1.mga6
60.8.0-1.mga6
firefox-l10n
Mageia:6
From an advisory covering 10 CVEs
 before 60.8.0-1.mga6
60.8.0-1.mga6
nss
Mageia:6
From an advisory covering 10 CVEs
 before 3.36.8-1.1.mga6
3.36.8-1.1.mga6
rootcerts
Mageia:6
From an advisory covering 10 CVEs
 before 20190604.00-1.mga6
20190604.00-1.mga6
thunderbird
Mageia:6
From an advisory covering 10 CVEs
 before 60.8.0-1.1.mga6
60.8.0-1.1.mga6
thunderbird-l10n
Mageia:6
From an advisory covering 10 CVEs
 before 60.8.0-1.mga6
60.8.0-1.mga6
thunderbird
Mageia:7
From an advisory covering 10 CVEs
 before 60.8.0-1.1.mga7
60.8.0-1.1.mga7
thunderbird-l10n
Mageia:7
From an advisory covering 10 CVEs
 before 60.8.0-1.mga7
60.8.0-1.mga7
firefox
Mageia:7
From an advisory covering 21 CVEs
 before 68.0-1.1.mga7
68.0-1.1.mga7
firefox-l10n
Mageia:7
From an advisory covering 21 CVEs
 before 68.0-1.mga7
68.0-1.mga7
nss
Mageia:7
From an advisory covering 21 CVEs
 before 3.45.0-1.mga7
3.45.0-1.mga7
rootcerts
Mageia:7
From an advisory covering 21 CVEs
 before 20190604.00-1.mga7
20190604.00-1.mga7
thunderbird
Mageia:7
From an advisory covering 19 CVEs
 before 68.0-1.3.mga7
68.0-1.3.mga7
thunderbird-l10n
Mageia:7
From an advisory covering 19 CVEs
 before 68.0-1.mga7
68.0-1.mga7
firefox
Red Hat:enterprise_linux:7::client
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el7_6
0:60.8.0-1.el7_6
firefox-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el7_6
0:60.8.0-1.el7_6
firefox
Red Hat:enterprise_linux:7::server
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el7_6
0:60.8.0-1.el7_6
firefox-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el7_6
0:60.8.0-1.el7_6
firefox
Red Hat:enterprise_linux:7::workstation
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el7_6
0:60.8.0-1.el7_6
firefox-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el7_6
0:60.8.0-1.el7_6
firefox
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el8_0
0:60.8.0-1.el8_0
firefox-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el8_0
0:60.8.0-1.el8_0
firefox-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el8_0
0:60.8.0-1.el8_0
firefox
Red Hat:enterprise_linux:6::client
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el6_10
0:60.8.0-1.el6_10
firefox-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el6_10
0:60.8.0-1.el6_10
firefox
Red Hat:enterprise_linux:6::computenode
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el6_10
0:60.8.0-1.el6_10
firefox-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el6_10
0:60.8.0-1.el6_10
firefox
Red Hat:enterprise_linux:6::server
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el6_10
0:60.8.0-1.el6_10
firefox-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el6_10
0:60.8.0-1.el6_10
firefox
Red Hat:enterprise_linux:6::workstation
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el6_10
0:60.8.0-1.el6_10
firefox-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el6_10
0:60.8.0-1.el6_10
thunderbird
Red Hat:enterprise_linux:7::client
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el7_6
0:60.8.0-1.el7_6
thunderbird-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el7_6
0:60.8.0-1.el7_6
thunderbird
Red Hat:enterprise_linux:7::server
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el7_6
0:60.8.0-1.el7_6
thunderbird-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el7_6
0:60.8.0-1.el7_6
thunderbird
Red Hat:enterprise_linux:7::workstation
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el7_6
0:60.8.0-1.el7_6
thunderbird-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el7_6
0:60.8.0-1.el7_6
thunderbird
Red Hat:enterprise_linux:6::client
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el6_10
0:60.8.0-1.el6_10
thunderbird-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el6_10
0:60.8.0-1.el6_10
thunderbird
Red Hat:enterprise_linux:6::server
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el6_10
0:60.8.0-1.el6_10
thunderbird-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el6_10
0:60.8.0-1.el6_10
thunderbird
Red Hat:enterprise_linux:6::workstation
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el6_10
0:60.8.0-1.el6_10
thunderbird-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el6_10
0:60.8.0-1.el6_10
thunderbird
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el8_0
0:60.8.0-1.el8_0
thunderbird-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el8_0
0:60.8.0-1.el8_0
thunderbird-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 8 CVEs
 before 0:60.8.0-1.el8_0
0:60.8.0-1.el8_0
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 12 CVEs
 before 60.8.0esr-78.43.2
60.8.0esr-78.43.2
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 68.2.0-78.51.4
68.2.0-78.51.4
MozillaFirefox-branding-SLED
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 68-21.9.8
68-21.9.8
firefox-atk
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 2.26.1-2.8.4
2.26.1-2.8.4
firefox-cairo
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 1.15.10-2.13.4
1.15.10-2.13.4
firefox-gdk-pixbuf
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 2.36.11-2.8.4
2.36.11-2.8.4
firefox-glib2
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 2.54.3-2.14.7
2.54.3-2.14.7
firefox-gtk3
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 3.10.9-2.15.3
3.10.9-2.15.3
firefox-harfbuzz
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 1.7.5-2.7.4
1.7.5-2.7.4
firefox-libffi
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 3.2.1.git259-2.3.3
3.2.1.git259-2.3.3
firefox-libffi-gcc5
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 5.3.1+r233831-14.1
5.3.1+r233831-14.1
firefox-pango
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 1.40.14-2.7.4
1.40.14-2.7.4
mozilla-nspr
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 4.21-29.6.1
4.21-29.6.1
mozilla-nss
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 3.45-38.9.3
3.45-38.9.3
MozillaFirefox
SUSE:OpenStack Cloud 7
From an advisory covering 10 CVEs
 before 60.8.0-109.83.3
60.8.0-109.83.3
mozilla-nss
SUSE:OpenStack Cloud 7
From an advisory covering 10 CVEs
 before 3.44.1-58.28.1
3.44.1-58.28.1
MozillaFirefox
SUSE:OpenStack Cloud 8
From an advisory covering 10 CVEs
 before 60.8.0-109.83.3
60.8.0-109.83.3
mozilla-nss
SUSE:OpenStack Cloud 8
From an advisory covering 10 CVEs
 before 3.44.1-58.28.1
3.44.1-58.28.1
MozillaFirefox
SUSE:Linux Enterprise Desktop 12 SP4
From an advisory covering 10 CVEs
 before 60.8.0-109.83.3
60.8.0-109.83.3
mozilla-nss
SUSE:Linux Enterprise Desktop 12 SP4
From an advisory covering 10 CVEs
 before 3.44.1-58.28.1
3.44.1-58.28.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 10 CVEs
 before 60.8.0-109.83.3
60.8.0-109.83.3
mozilla-nss
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 10 CVEs
 before 3.44.1-58.28.1
3.44.1-58.28.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 10 CVEs
 before 60.8.0-109.83.3
60.8.0-109.83.3
mozilla-nss
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 10 CVEs
 before 3.44.1-58.28.1
3.44.1-58.28.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 10 CVEs
 before 60.8.0-109.83.3
60.8.0-109.83.3
mozilla-nss
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 10 CVEs
 before 3.44.1-58.28.1
3.44.1-58.28.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP4
From an advisory covering 10 CVEs
 before 60.8.0-109.83.3
60.8.0-109.83.3
mozilla-nss
SUSE:Linux Enterprise Software Development Kit 12 SP4
From an advisory covering 10 CVEs
 before 3.44.1-58.28.1
3.44.1-58.28.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP1-LTSS
From an advisory covering 10 CVEs
 before 60.8.0-109.83.3
60.8.0-109.83.3
mozilla-nss
SUSE:Linux Enterprise Server 12 SP1-LTSS
From an advisory covering 10 CVEs
 before 3.44.1-58.28.1
3.44.1-58.28.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 10 CVEs
 before 60.8.0-109.83.3
60.8.0-109.83.3
mozilla-nss
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 10 CVEs
 before 3.44.1-58.28.1
3.44.1-58.28.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 10 CVEs
 before 60.8.0-109.83.3
60.8.0-109.83.3
mozilla-nss
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 10 CVEs
 before 3.44.1-58.28.1
3.44.1-58.28.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 10 CVEs
 before 60.8.0-109.83.3
60.8.0-109.83.3
mozilla-nss
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 10 CVEs
 before 3.44.1-58.28.1
3.44.1-58.28.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 10 CVEs
 before 60.8.0-109.83.3
60.8.0-109.83.3
mozilla-nss
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 10 CVEs
 before 3.44.1-58.28.1
3.44.1-58.28.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 10 CVEs
 before 60.8.0-109.83.3
60.8.0-109.83.3
mozilla-nss
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 10 CVEs
 before 3.44.1-58.28.1
3.44.1-58.28.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 10 CVEs
 before 60.8.0-109.83.3
60.8.0-109.83.3
mozilla-nss
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 10 CVEs
 before 3.44.1-58.28.1
3.44.1-58.28.1
MozillaFirefox
SUSE:Enterprise Storage 4
From an advisory covering 10 CVEs
 before 60.8.0-109.83.3
60.8.0-109.83.3
mozilla-nss
SUSE:Enterprise Storage 4
From an advisory covering 10 CVEs
 before 3.44.1-58.28.1
3.44.1-58.28.1
MozillaFirefox
SUSE:Enterprise Storage 5
From an advisory covering 10 CVEs
 before 60.8.0-109.83.3
60.8.0-109.83.3
mozilla-nss
SUSE:Enterprise Storage 5
From an advisory covering 10 CVEs
 before 3.44.1-58.28.1
3.44.1-58.28.1
MozillaFirefox
SUSE:HPE Helion OpenStack 8
From an advisory covering 10 CVEs
 before 60.8.0-109.83.3
60.8.0-109.83.3
mozilla-nss
SUSE:HPE Helion OpenStack 8
From an advisory covering 10 CVEs
 before 3.44.1-58.28.1
3.44.1-58.28.1
MozillaFirefox
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 10 CVEs
 before 60.8.0-109.83.3
60.8.0-109.83.3
mozilla-nss
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 10 CVEs
 before 3.44.1-58.28.1
3.44.1-58.28.1
mozilla-nss
SUSE:Linux Enterprise Module for Basesystem 15
From an advisory covering 10 CVEs
 before 3.44.1-3.16.2
3.44.1-3.16.2
mozilla-nss
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 10 CVEs
 before 3.44.1-3.16.2
3.44.1-3.16.2
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15
From an advisory covering 10 CVEs
 before 60.8.0-3.51.4
60.8.0-3.51.4
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
From an advisory covering 10 CVEs
 before 60.8.0-3.51.4
60.8.0-3.51.4
mozilla-nss
SUSE:Linux Enterprise Module for Server Applications 15 SP1
From an advisory covering 10 CVEs
 before 3.44.1-3.16.2
3.44.1-3.16.2
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15
From an advisory covering 10 CVEs
 before 60.8.0-3.46.2
60.8.0-3.46.2
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP1
From an advisory covering 10 CVEs
 before 60.8.0-3.46.2
60.8.0-3.46.2
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15
From an advisory covering 27 CVEs
 before 68.1.1-3.51.1
68.1.1-3.51.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP1
From an advisory covering 27 CVEs
 before 68.1.1-3.51.1
68.1.1-3.51.1
MozillaFirefox
SUSE:HPE Helion OpenStack 8
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:HPE Helion OpenStack 8
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:OpenStack Cloud 7
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:OpenStack Cloud 7
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:OpenStack Cloud 8
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:OpenStack Cloud 8
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Desktop 12 SP4
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Desktop 12 SP4
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP4
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP1-LTSS
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP1-LTSS
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Enterprise Storage 4
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Enterprise Storage 4
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Enterprise Storage 5
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Enterprise Storage 5
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
firefox
Ubuntu:16.04:LTS
 before 68.0+build3-0ubuntu0.16.04.1, plus listed versions
41.0.2+build2-0ubuntu142.0+build2-0ubuntu144.0+build3-0ubuntu244.0.1+build1-0ubuntu144.0.2+build1-0ubuntu1
Show 45 moreShow less
45.0+build2-0ubuntu145.0.1+build1-0ubuntu145.0.2+build1-0ubuntu146.0+build5-0ubuntu0.16.04.246.0.1+build1-0ubuntu0.16.04.247.0+build3-0ubuntu0.16.04.148.0+build2-0ubuntu0.16.04.149.0+build4-0ubuntu0.16.04.149.0.2+build2-0ubuntu0.16.04.250.0+build2-0ubuntu0.16.04.250.0.2+build1-0ubuntu0.16.04.150.1.0+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.252.0+build2-0ubuntu0.16.04.152.0.1+build2-0ubuntu0.16.04.152.0.2+build1-0ubuntu0.16.04.153.0+build6-0ubuntu0.16.04.153.0.2+build1-0ubuntu0.16.04.253.0.3+build1-0ubuntu0.16.04.254.0+build3-0ubuntu0.16.04.155.0.1+build2-0ubuntu0.16.04.255.0.2+build1-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.257.0+build4-0ubuntu0.16.04.557.0+build4-0ubuntu0.16.04.657.0.1+build2-0ubuntu0.16.04.157.0.3+build1-0ubuntu0.16.04.157.0.4+build1-0ubuntu0.16.04.158.0+build6-0ubuntu0.16.04.158.0.1+build1-0ubuntu0.16.04.158.0.2+build1-0ubuntu0.16.04.159.0+build5-0ubuntu0.16.04.159.0.1+build1-0ubuntu0.16.04.159.0.2+build1-0ubuntu0.16.04.159.0.2+build1-0ubuntu0.16.04.360.0+build2-0ubuntu0.16.04.160.0.1+build2-0ubuntu0.16.04.160.0.2+build1-0ubuntu0.16.04.161.0+build3-0ubuntu0.16.04.261.0.1+build1-0ubuntu0.16.04.162.0+build2-0ubuntu0.16.04.362.0+build2-0ubuntu0.16.04.462.0+build2-0ubuntu0.16.04.5
68.0+build3-0ubuntu0.16.04.1
thunderbird
Ubuntu:16.04:LTS
 before 1:60.8.0+build1-0ubuntu0.16.04.2, plus listed versions
1:38.3.0+build1-0ubuntu21:38.5.1+build2-0ubuntu11:38.6.0+build1-0ubuntu11:38.7.2+build1-0ubuntu0.16.04.11:38.8.0+build1-0ubuntu0.16.04.1
Show 22 moreShow less
1:45.2.0+build1-0ubuntu0.16.04.11:45.3.0+build1-0ubuntu0.16.04.21:45.4.0+build1-0ubuntu0.16.04.11:45.5.1+build1-0ubuntu0.16.04.11:45.7.0+build1-0ubuntu0.16.04.11:45.8.0+build1-0ubuntu0.16.04.11:52.1.1+build1-0ubuntu0.16.04.11:52.2.1+build1-0ubuntu0.16.04.11:52.3.0+build1-0ubuntu0.16.04.11:52.4.0+build1-0ubuntu0.16.04.21:52.5.0+build1-0ubuntu0.16.04.11:52.6.0+build1-0ubuntu0.16.04.11:52.7.0+build1-0ubuntu0.16.04.11:52.8.0+build1-0ubuntu0.16.04.11:52.9.1+build3-0ubuntu0.16.04.11:60.2.1+build1-0ubuntu0.16.04.41:60.4.0+build2-0ubuntu0.16.04.11:60.5.1+build2-0ubuntu0.16.04.11:60.6.1+build2-0ubuntu0.16.04.11:60.7.0+build1-0ubuntu0.16.04.11:60.7.1+build1-0ubuntu0.16.04.11:60.7.2+build2-0ubuntu0.16.04.1
1:60.8.0+build1-0ubuntu0.16.04.2
firefox
Ubuntu:18.04:LTS
 before 68.0+build3-0ubuntu0.18.04.1, plus listed versions
56.0+build6-0ubuntu157.0.1+build2-0ubuntu159.0.1+build1-0ubuntu159.0.2+build1-0ubuntu160.0+build2-0ubuntu1
Show 24 moreShow less
60.0.1+build2-0ubuntu0.18.04.160.0.2+build1-0ubuntu0.18.04.161.0+build3-0ubuntu0.18.04.161.0.1+build1-0ubuntu0.18.04.162.0+build2-0ubuntu0.18.04.362.0+build2-0ubuntu0.18.04.462.0+build2-0ubuntu0.18.04.562.0.3+build1-0ubuntu0.18.04.163.0+build2-0ubuntu0.18.04.263.0.3+build1-0ubuntu0.18.04.164.0+build3-0ubuntu0.18.04.165.0+build2-0ubuntu0.18.04.165.0.1+build2-0ubuntu0.18.04.166.0+build3-0ubuntu0.18.04.166.0.1+build1-0ubuntu0.18.04.166.0.2+build1-0ubuntu0.18.04.166.0.3+build1-0ubuntu0.18.04.166.0.4+build3-0ubuntu0.18.04.166.0.5+build1-0ubuntu0.18.04.167.0+build2-0ubuntu0.18.04.167.0.1+build1-0ubuntu0.18.04.167.0.2+build2-0ubuntu0.18.04.167.0.3+build1-0ubuntu0.18.04.167.0.4+build1-0ubuntu0.18.04.1
68.0+build3-0ubuntu0.18.04.1
thunderbird
Ubuntu:18.04:LTS
 before 1:60.8.0+build1-0ubuntu0.18.04.1, plus listed versions
1:52.4.0+build1-0ubuntu21:52.6.0+build1-0ubuntu11:52.7.0+build1-0ubuntu11:52.8.0+build1-0ubuntu0.18.04.11:52.9.1+build3-0ubuntu0.18.04.1
Show 7 moreShow less
1:60.2.1+build1-0ubuntu0.18.04.21:60.4.0+build2-0ubuntu0.18.04.11:60.5.1+build2-0ubuntu0.18.04.11:60.6.1+build2-0ubuntu0.18.04.11:60.7.0+build1-0ubuntu0.18.04.11:60.7.1+build1-0ubuntu0.18.04.11:60.7.2+build2-0ubuntu0.18.04.1
1:60.8.0+build1-0ubuntu0.18.04.1
mozjs52
Ubuntu:18.04:LTS
 All versions, plus listed versions
52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1
 None known
mozjs38
Ubuntu:18.04:LTS
 All versions, plus listed versions
38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4
 None known
mozjs52
Ubuntu:20.04:LTS
 All versions, plus listed versions
52.9.1-1build152.9.1-1ubuntu3
 None known
firefox
Ubuntu:16.04:LTS
From an advisory covering 21 CVEs
 before 68.0+build3-0ubuntu0.16.04.1, plus listed versions
41.0.2+build2-0ubuntu142.0+build2-0ubuntu144.0+build3-0ubuntu244.0.1+build1-0ubuntu144.0.2+build1-0ubuntu1
Show 45 moreShow less
45.0+build2-0ubuntu145.0.1+build1-0ubuntu145.0.2+build1-0ubuntu146.0+build5-0ubuntu0.16.04.246.0.1+build1-0ubuntu0.16.04.247.0+build3-0ubuntu0.16.04.148.0+build2-0ubuntu0.16.04.149.0+build4-0ubuntu0.16.04.149.0.2+build2-0ubuntu0.16.04.250.0+build2-0ubuntu0.16.04.250.0.2+build1-0ubuntu0.16.04.150.1.0+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.252.0+build2-0ubuntu0.16.04.152.0.1+build2-0ubuntu0.16.04.152.0.2+build1-0ubuntu0.16.04.153.0+build6-0ubuntu0.16.04.153.0.2+build1-0ubuntu0.16.04.253.0.3+build1-0ubuntu0.16.04.254.0+build3-0ubuntu0.16.04.155.0.1+build2-0ubuntu0.16.04.255.0.2+build1-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.257.0+build4-0ubuntu0.16.04.557.0+build4-0ubuntu0.16.04.657.0.1+build2-0ubuntu0.16.04.157.0.3+build1-0ubuntu0.16.04.157.0.4+build1-0ubuntu0.16.04.158.0+build6-0ubuntu0.16.04.158.0.1+build1-0ubuntu0.16.04.158.0.2+build1-0ubuntu0.16.04.159.0+build5-0ubuntu0.16.04.159.0.1+build1-0ubuntu0.16.04.159.0.2+build1-0ubuntu0.16.04.159.0.2+build1-0ubuntu0.16.04.360.0+build2-0ubuntu0.16.04.160.0.1+build2-0ubuntu0.16.04.160.0.2+build1-0ubuntu0.16.04.161.0+build3-0ubuntu0.16.04.261.0.1+build1-0ubuntu0.16.04.162.0+build2-0ubuntu0.16.04.362.0+build2-0ubuntu0.16.04.462.0+build2-0ubuntu0.16.04.5
68.0+build3-0ubuntu0.16.04.1
firefox
Ubuntu:18.04:LTS
From an advisory covering 21 CVEs
 before 68.0+build3-0ubuntu0.18.04.1, plus listed versions
56.0+build6-0ubuntu157.0.1+build2-0ubuntu159.0.1+build1-0ubuntu159.0.2+build1-0ubuntu160.0+build2-0ubuntu1
Show 24 moreShow less
60.0.1+build2-0ubuntu0.18.04.160.0.2+build1-0ubuntu0.18.04.161.0+build3-0ubuntu0.18.04.161.0.1+build1-0ubuntu0.18.04.162.0+build2-0ubuntu0.18.04.362.0+build2-0ubuntu0.18.04.462.0+build2-0ubuntu0.18.04.562.0.3+build1-0ubuntu0.18.04.163.0+build2-0ubuntu0.18.04.263.0.3+build1-0ubuntu0.18.04.164.0+build3-0ubuntu0.18.04.165.0+build2-0ubuntu0.18.04.165.0.1+build2-0ubuntu0.18.04.166.0+build3-0ubuntu0.18.04.166.0.1+build1-0ubuntu0.18.04.166.0.2+build1-0ubuntu0.18.04.166.0.3+build1-0ubuntu0.18.04.166.0.4+build3-0ubuntu0.18.04.166.0.5+build1-0ubuntu0.18.04.167.0+build2-0ubuntu0.18.04.167.0.1+build1-0ubuntu0.18.04.167.0.2+build2-0ubuntu0.18.04.167.0.3+build1-0ubuntu0.18.04.167.0.4+build1-0ubuntu0.18.04.1
68.0+build3-0ubuntu0.18.04.1
thunderbird
Ubuntu:16.04:LTS
From an advisory covering 10 CVEs
 before 1:60.8.0+build1-0ubuntu0.16.04.2, plus listed versions
1:38.3.0+build1-0ubuntu21:38.5.1+build2-0ubuntu11:38.6.0+build1-0ubuntu11:38.7.2+build1-0ubuntu0.16.04.11:38.8.0+build1-0ubuntu0.16.04.1
Show 22 moreShow less
1:45.2.0+build1-0ubuntu0.16.04.11:45.3.0+build1-0ubuntu0.16.04.21:45.4.0+build1-0ubuntu0.16.04.11:45.5.1+build1-0ubuntu0.16.04.11:45.7.0+build1-0ubuntu0.16.04.11:45.8.0+build1-0ubuntu0.16.04.11:52.1.1+build1-0ubuntu0.16.04.11:52.2.1+build1-0ubuntu0.16.04.11:52.3.0+build1-0ubuntu0.16.04.11:52.4.0+build1-0ubuntu0.16.04.21:52.5.0+build1-0ubuntu0.16.04.11:52.6.0+build1-0ubuntu0.16.04.11:52.7.0+build1-0ubuntu0.16.04.11:52.8.0+build1-0ubuntu0.16.04.11:52.9.1+build3-0ubuntu0.16.04.11:60.2.1+build1-0ubuntu0.16.04.41:60.4.0+build2-0ubuntu0.16.04.11:60.5.1+build2-0ubuntu0.16.04.11:60.6.1+build2-0ubuntu0.16.04.11:60.7.0+build1-0ubuntu0.16.04.11:60.7.1+build1-0ubuntu0.16.04.11:60.7.2+build2-0ubuntu0.16.04.1
1:60.8.0+build1-0ubuntu0.16.04.2
thunderbird
Ubuntu:18.04:LTS
From an advisory covering 10 CVEs
 before 1:60.8.0+build1-0ubuntu0.18.04.1, plus listed versions
1:52.4.0+build1-0ubuntu21:52.6.0+build1-0ubuntu11:52.7.0+build1-0ubuntu11:52.8.0+build1-0ubuntu0.18.04.11:52.9.1+build3-0ubuntu0.18.04.1
Show 7 moreShow less
1:60.2.1+build1-0ubuntu0.18.04.21:60.4.0+build2-0ubuntu0.18.04.11:60.5.1+build2-0ubuntu0.18.04.11:60.6.1+build2-0ubuntu0.18.04.11:60.7.0+build1-0ubuntu0.18.04.11:60.7.1+build1-0ubuntu0.18.04.11:60.7.2+build2-0ubuntu0.18.04.1
1:60.8.0+build1-0ubuntu0.18.04.1
MozillaFirefox
openSUSE:Leap 15.1
From an advisory covering 10 CVEs
 before 60.8.0-lp151.2.10.1
60.8.0-lp151.2.10.1
mozilla-nss
openSUSE:Leap 15.1
From an advisory covering 10 CVEs
 before 3.44.1-lp151.2.3.1
3.44.1-lp151.2.3.1
mozilla-nss
openSUSE:Leap 15.0
From an advisory covering 10 CVEs
 before 3.44.1-lp150.2.24.1
3.44.1-lp150.2.24.1
MozillaThunderbird
openSUSE:Leap 15.0
From an advisory covering 10 CVEs
 before 60.8.0-lp151.2.10.1
60.8.0-lp151.2.10.1
MozillaThunderbird
openSUSE:Leap 15.1
From an advisory covering 10 CVEs
 before 60.8.0-lp151.2.10.1
60.8.0-lp151.2.10.1
MozillaThunderbird
SUSE:Package Hub 12
From an advisory covering 10 CVEs
 before 60.8.0-88.1
60.8.0-88.1
MozillaThunderbird
openSUSE:Leap 15.0
From an advisory covering 27 CVEs
 before 68.1.1-lp150.3.51.1
68.1.1-lp150.3.51.1
enigmail
openSUSE:Leap 15.0
From an advisory covering 27 CVEs
 before 2.1.2-lp150.34.1
2.1.2-lp150.34.1
MozillaThunderbird
openSUSE:Leap 15.1
From an advisory covering 27 CVEs
 before 68.1.1-lp151.2.13.1
68.1.1-lp151.2.13.1
enigmail
openSUSE:Leap 15.1
From an advisory covering 27 CVEs
 before 2.1.2-lp151.2.6.1
2.1.2-lp151.2.6.1
MozillaFirefox
openSUSE:Tumbleweed
From an advisory covering 661 CVEs
 before 92.0-1.2
92.0-1.2
MozillaThunderbird
openSUSE:Tumbleweed
From an advisory covering 394 CVEs
 before 91.1.1-1.1
91.1.1-1.1
firefox-esr
openSUSE:Tumbleweed
From an advisory covering 1860 CVEs
 before 128.5.1-1.1
128.5.1-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-11717 is a medium vulnerability (CVSS 5.3) in Mozilla Firefox, published July 11, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.13%, the 82nd percentile. Fixed in firefox-esr 60.8.0-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 258 versions and 2,066 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open