Every CVE Search/ Get API key

CVE-2019-11733

When a master password is set, it is required to be entered again before stored passwords can be...

9.8 CriticalFix available

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password if the master password had been previously entered in the same session, allowing for potential theft of stored passwords. This vulnerability affects Firefox < 68.0.2 and Firefox ESR < 68.0.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.41%Up 0.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password if the master password had been previously entered in the same session, allowing for potential theft of stored passwords. This vulnerability affects Firefox < 68.0.2 and Firefox ESR < 68.0.2.

Record
CVE-2019-11733
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-287
Updated
2026-11-02
CVE List No score

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password if the master password had been previously entered in the same session, allowing for potential theft of stored passwords. This vulnerability affects Firefox < 68.0.2 and Firefox ESR < 68.0.2.

Record
CVE-2019-11733
Updated
2026-11-02
EUVDEUVD-2019-3403 No score

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password if the master password had been previously entered in the same session, allowing for potential theft of stored passwords. This vulnerability affects Firefox < 68.0.2 and Firefox ESR < 68.0.2.

Record
EUVD-2019-3403
Updated
2026-11-03
GitHub AdvisoriesGHSA-pf22-jf54-7q9c 9.8

When a master password is set, it is required to be entered again before stored passwords can be...

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password if the master password had been previously entered in the same session, allowing for potential theft of stored passwords. This vulnerability affects Firefox < 68.0.2 and Firefox ESR < 68.0.2.

Record
GHSA-pf22-jf54-7q9c
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02
OSVALPINE-CVE-2019-11733 9.8

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password if the master password had been previously entered in the same session, allowing for potential theft of stored passwords. This vulnerability affects Firefox < 68.0.2 and Firefox ESR < 68.0.2.

Record
ALPINE-CVE-2019-11733
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVRHSA-2019:2663 9.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2019:2663
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 12 moreShow less
OSVRHSA-2019:2694 9.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2019:2694
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:2729 9.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2019:2729
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-11733 9.8

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password if the master password had been previously entered in the same session, allowing for potential theft of stored passwords. This vulnerability affects Firefox < 68.0.2 and Firefox ESR < 68.0.2.

Record
UBUNTU-CVE-2019-11733
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2019-0268 No score

Updated firefox packages fix security vulnerabilities

The updated packages fix several bugs and some security issues:

Sandbox escape through Firefox Sync. (CVE-2019-9812)

Stored passwords in 'Saved Logins' can be copied without master password entry. (CVE-2019-11733)

Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1. (CVE-2019-11735)

File manipulation and privilege escalation in Mozilla Maintenance Service. (CVE-2019-11736)

Content security policy bypass through hash-based sources in directives. (CVE-2019-11738)

Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9. (CVE-2019-11740)

Same-origin policy violation with SVG filters and canvas to steal cross-origin images. (CVE-2019-11742)

Cross-origin access to unload event attributes. (CVE-2019-11743)

XSS by breaking out of title and textarea elements using innerHTML. (CVE-2019-11744)

Use-after-free while manipulating video. (CVE-2019-11746)

'Forget about this site' removes sites from pre-loaded HSTS list. (CVE-2019-11747)

Persistence of WebRTC permissions in a third party context. (CVE-2019-11748)

Camera information available without prompting using getUserMedia. (CVE-2019-11749)

Type confusion in Spidermonkey. (CVE-2019-11750)

Malicious code execution through command line parameters. (CVE-2019-11751)

Use-after-free while extracting a key value in IndexedDB. (CVE-2019-11752)

Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (CVE-2019-11753)

Record
MGASA-2019-0268
Updated
2026-11-02
OSVopenSUSE-SU-2019:2251-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox to 68.1 fixes the following issues:

Security issues fixed:

  • CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)
  • CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)
  • CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)
  • CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)
  • CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)
  • CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
  • CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868)
  • CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
  • CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868)
  • CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868)
  • CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322)
  • CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868)
  • CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665)
  • CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293)
  • CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292)
  • CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302)
  • CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
  • CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)
  • CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)
  • CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)
  • CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
  • CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
  • CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)

Non-security issues fixed:

  • Latest update now also released for s390x. (bsc#1109465)
  • Fixed a segmentation fault on s390vsl082. (bsc#1117473)
  • Fixed a crash on SLES15 s390x. (bsc#1124525)
  • Fixed a segmentation fault. (bsc#1133810)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2251-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2260-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox to 68.1 fixes the following issues:

Security issues fixed:

  • CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)
  • CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)
  • CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)
  • CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)
  • CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)
  • CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
  • CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868)
  • CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
  • CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868)
  • CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868)
  • CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322)
  • CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868)
  • CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665)
  • CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293)
  • CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292)
  • CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302)
  • CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
  • CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)
  • CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)
  • CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)
  • CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
  • CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
  • CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)

Non-security issues fixed:

  • Latest update now also released for s390x. (bsc#1109465)
  • Fixed a segmentation fault on s390vsl082. (bsc#1117473)
  • Fixed a crash on SLES15 s390x. (bsc#1124525)
  • Fixed a segmentation fault. (bsc#1133810)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2260-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10600-1 No score

MozillaFirefox-92.0-1.2 on GA media

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10600-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02
OSVSUSE-SU-2019:14246-1 No score

Security update for Mozilla Firefox

This update contains the Mozilla Firefox ESR 68.2 release.

Mozilla Firefox was updated to ESR 68.2 release:

  • Enterprise: New administrative policies were added. More information and templates are available at the Policy Templates page.

  • Various security fixes: MFSA 2019-33 (bsc#1154738)

    • CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber
    • CVE-2019-11757: Use-after-free when creating index updates in IndexedDB
    • CVE-2019-11758: Potentially exploitable crash due to 360 Total Security
    • CVE-2019-11759: Stack buffer overflow in HKDF output
    • CVE-2019-11760: Stack buffer overflow in WebRTC networking
    • CVE-2019-11761: Unintended access to a privileged JSONView object
    • CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation
    • CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique
    • CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2

Other Issues resolved:

  • [bsc#1104841] Newer versions of firefox have a dependency on GLIBCXX_3.4.20
  • [bsc#1074235] MozillaFirefox: background tab crash reports sent inadvertently without user opt-in
  • [bsc#1043008] Firefox hangs randomly when browsing and scrolling
  • [bsc#1025108] Firefox stops loading page until mouse is moved
  • [bsc#905528] Firefox malfunctions due to broken omni.ja archives
Record
SUSE-SU-2019:14246-1
Updated
2026-11-02
OSVSUSE-SU-2019:2545-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox to 68.1 fixes the following issues:

Security issues fixed:

  • CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)
  • CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)
  • CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)
  • CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)
  • CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)
  • CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
  • CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868)
  • CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
  • CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868)
  • CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868)
  • CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322)
  • CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868)
  • CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665)
  • CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293)
  • CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292)
  • CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302)
  • CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
  • CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)
  • CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)
  • CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)
  • CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
  • CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
  • CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)

Non-security issues fixed:

  • Latest update now also released for s390x. (bsc#1109465)
  • Fixed a segmentation fault on s390vsl082. (bsc#1117473)
  • Fixed a crash on SLES15 s390x. (bsc#1124525)
  • Fixed a segmentation fault. (bsc#1133810)
Record
SUSE-SU-2019:2545-1
Updated
2026-11-02
OSVSUSE-SU-2019:2620-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Updated to new ESR version 68.1 (bsc#1149323).

In addition to the already fixed vulnerabilities released in previous ESR updates, the following were also fixed: CVE-2019-11751, CVE-2019-11736, CVE-2019-9812, CVE-2019-11748, CVE-2019-11749, CVE-2019-11750, CVE-2019-11738, CVE-2019-11747, CVE-2019-11735.

Several run-time issues were also resolved (bsc#1117473, bsc#1124525, bsc#1133810).

The version displayed in Help > About is now correct (bsc#1087200).

Record
SUSE-SU-2019:2620-1
Updated
2026-11-02
OSVUSN-4101-1 No score

firefox vulnerability

It was discovered that passwords could be copied to the clipboard from the "Saved Logins" dialog without entering the master password, even when a master password has been set. A local attacker could potentially exploit this to obtain saved passwords.

Record
USN-4101-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firefox
Alpine:v3.12
 before 68.0.2-r0
68.0.2-r0
firefox
Alpine:v3.13
 before 68.0.2-r0
68.0.2-r0
firefox
Alpine:v3.14
 before 68.0.2-r0
68.0.2-r0
firefox
Alpine:v3.15
 before 68.0.2-r0
68.0.2-r0
firefox
Alpine:v3.16
 before 68.0.2-r0
68.0.2-r0
firefox
Alpine:v3.17
 before 68.0.2-r0
68.0.2-r0
firefox
Alpine:v3.18
 before 68.0.2-r0
68.0.2-r0
firefox
Alpine:v3.19
 before 68.0.2-r0
68.0.2-r0
firefox
Alpine:v3.20
 before 68.0.2-r0
68.0.2-r0
firefox
Alpine:v3.21
 before 68.0.2-r0
68.0.2-r0
Show 104 moreShow less
Affected packages
PackageAffectedFixed
firefox
Alpine:v3.22
 before 68.0.2-r0
68.0.2-r0
firefox
Alpine:v3.23
 before 68.0.2-r0
68.0.2-r0
firefox-esr
Alpine:v3.11
 before 68.0.2-r0
68.0.2-r0
firefox-esr
Alpine:v3.12
 before 68.0.2-r0
68.0.2-r0
firefox-esr
Alpine:v3.13
 before 68.0.2-r0
68.0.2-r0
firefox-esr
Alpine:v3.14
 before 68.0.2-r0
68.0.2-r0
firefox-esr
Alpine:v3.15
 before 68.0.2-r0
68.0.2-r0
firefox-esr
Alpine:v3.16
 before 68.0.2-r0
68.0.2-r0
firefox-esr
Alpine:v3.17
 before 68.0.2-r0
68.0.2-r0
firefox-esr
Alpine:v3.18
 before 68.0.2-r0
68.0.2-r0
firefox-esr
Alpine:v3.19
 before 68.0.2-r0
68.0.2-r0
firefox-esr
Alpine:v3.20
 before 68.0.2-r0
68.0.2-r0
firefox-esr
Alpine:v3.21
 before 68.0.2-r0
68.0.2-r0
firefox-esr
Alpine:v3.22
 before 68.0.2-r0
68.0.2-r0
firefox-esr
Alpine:v3.23
 before 68.0.2-r0
68.0.2-r0
librewolf
Alpine:v3.21
 before 68.0.2-r0
68.0.2-r0
librewolf
Alpine:v3.22
 before 68.0.2-r0
68.0.2-r0
librewolf
Alpine:v3.23
 before 68.0.2-r0
68.0.2-r0
librewolf
Alpine:v3.24
 before 68.0.2-r0
68.0.2-r0
firefox
Mageia:7
From an advisory covering 17 CVEs
 before 68.1.0-1.mga7
68.1.0-1.mga7
firefox-l10n
Mageia:7
From an advisory covering 17 CVEs
 before 68.1.0-1.mga7
68.1.0-1.mga7
rootcerts
Mageia:7
From an advisory covering 17 CVEs
 before 20190820.00-1.mga7
20190820.00-1.mga7
nspr
Mageia:7
From an advisory covering 17 CVEs
 before 4.22-1.mga7
4.22-1.mga7
nss
Mageia:7
From an advisory covering 17 CVEs
 before 3.46.0-1.mga7
3.46.0-1.mga7
firefox
Red Hat:enterprise_linux:8::appstream
From an advisory covering 14 CVEs
 before 0:68.1.0-1.el8_0
0:68.1.0-1.el8_0
firefox-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 14 CVEs
 before 0:68.1.0-1.el8_0
0:68.1.0-1.el8_0
firefox-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 14 CVEs
 before 0:68.1.0-1.el8_0
0:68.1.0-1.el8_0
firefox
Red Hat:enterprise_linux:6::client
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
firefox-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
firefox
Red Hat:enterprise_linux:6::computenode
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
firefox-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
firefox
Red Hat:enterprise_linux:6::server
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
firefox-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
firefox
Red Hat:enterprise_linux:6::workstation
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
firefox-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
firefox
Red Hat:enterprise_linux:7::client
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el7_7
0:60.9.0-1.el7_7
firefox-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el7_7
0:60.9.0-1.el7_7
firefox
Red Hat:enterprise_linux:7::server
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el7_7
0:60.9.0-1.el7_7
firefox-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el7_7
0:60.9.0-1.el7_7
firefox
Red Hat:enterprise_linux:7::workstation
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el7_7
0:60.9.0-1.el7_7
firefox-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el7_7
0:60.9.0-1.el7_7
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 68.2.0-78.51.4
68.2.0-78.51.4
MozillaFirefox-branding-SLED
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 68-21.9.8
68-21.9.8
firefox-atk
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 2.26.1-2.8.4
2.26.1-2.8.4
firefox-cairo
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 1.15.10-2.13.4
1.15.10-2.13.4
firefox-gdk-pixbuf
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 2.36.11-2.8.4
2.36.11-2.8.4
firefox-glib2
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 2.54.3-2.14.7
2.54.3-2.14.7
firefox-gtk3
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 3.10.9-2.15.3
3.10.9-2.15.3
firefox-harfbuzz
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 1.7.5-2.7.4
1.7.5-2.7.4
firefox-libffi
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 3.2.1.git259-2.3.3
3.2.1.git259-2.3.3
firefox-libffi-gcc5
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 5.3.1+r233831-14.1
5.3.1+r233831-14.1
firefox-pango
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 1.40.14-2.7.4
1.40.14-2.7.4
mozilla-nspr
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 4.21-29.6.1
4.21-29.6.1
mozilla-nss
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 3.45-38.9.3
3.45-38.9.3
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15
From an advisory covering 29 CVEs
 before 68.1.0-3.54.2
68.1.0-3.54.2
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Module for Desktop Applications 15
From an advisory covering 29 CVEs
 before 68-4.8.5
68-4.8.5
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
From an advisory covering 29 CVEs
 before 68.1.0-3.54.2
68.1.0-3.54.2
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
From an advisory covering 29 CVEs
 before 68-4.8.5
68-4.8.5
MozillaFirefox
SUSE:HPE Helion OpenStack 8
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:HPE Helion OpenStack 8
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:OpenStack Cloud 7
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:OpenStack Cloud 7
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:OpenStack Cloud 8
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:OpenStack Cloud 8
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Desktop 12 SP4
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Desktop 12 SP4
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP4
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP1-LTSS
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP1-LTSS
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Enterprise Storage 4
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Enterprise Storage 4
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Enterprise Storage 5
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Enterprise Storage 5
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
firefox
Ubuntu:16.04:LTS
 before 68.0.2+build1-0ubuntu0.16.04.1, plus listed versions
41.0.2+build2-0ubuntu142.0+build2-0ubuntu144.0+build3-0ubuntu244.0.1+build1-0ubuntu144.0.2+build1-0ubuntu1
Show 45 moreShow less
45.0+build2-0ubuntu145.0.1+build1-0ubuntu145.0.2+build1-0ubuntu146.0+build5-0ubuntu0.16.04.246.0.1+build1-0ubuntu0.16.04.247.0+build3-0ubuntu0.16.04.148.0+build2-0ubuntu0.16.04.149.0+build4-0ubuntu0.16.04.149.0.2+build2-0ubuntu0.16.04.250.0+build2-0ubuntu0.16.04.250.0.2+build1-0ubuntu0.16.04.150.1.0+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.252.0+build2-0ubuntu0.16.04.152.0.1+build2-0ubuntu0.16.04.152.0.2+build1-0ubuntu0.16.04.153.0+build6-0ubuntu0.16.04.153.0.2+build1-0ubuntu0.16.04.253.0.3+build1-0ubuntu0.16.04.254.0+build3-0ubuntu0.16.04.155.0.1+build2-0ubuntu0.16.04.255.0.2+build1-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.257.0+build4-0ubuntu0.16.04.557.0+build4-0ubuntu0.16.04.657.0.1+build2-0ubuntu0.16.04.157.0.3+build1-0ubuntu0.16.04.157.0.4+build1-0ubuntu0.16.04.158.0+build6-0ubuntu0.16.04.158.0.1+build1-0ubuntu0.16.04.158.0.2+build1-0ubuntu0.16.04.159.0+build5-0ubuntu0.16.04.159.0.1+build1-0ubuntu0.16.04.159.0.2+build1-0ubuntu0.16.04.159.0.2+build1-0ubuntu0.16.04.360.0+build2-0ubuntu0.16.04.160.0.1+build2-0ubuntu0.16.04.160.0.2+build1-0ubuntu0.16.04.161.0+build3-0ubuntu0.16.04.261.0.1+build1-0ubuntu0.16.04.162.0+build2-0ubuntu0.16.04.362.0+build2-0ubuntu0.16.04.462.0+build2-0ubuntu0.16.04.5
68.0.2+build1-0ubuntu0.16.04.1
firefox
Ubuntu:18.04:LTS
 before 68.0.2+build1-0ubuntu0.18.04.1, plus listed versions
56.0+build6-0ubuntu157.0.1+build2-0ubuntu159.0.1+build1-0ubuntu159.0.2+build1-0ubuntu160.0+build2-0ubuntu1
Show 26 moreShow less
60.0.1+build2-0ubuntu0.18.04.160.0.2+build1-0ubuntu0.18.04.161.0+build3-0ubuntu0.18.04.161.0.1+build1-0ubuntu0.18.04.162.0+build2-0ubuntu0.18.04.362.0+build2-0ubuntu0.18.04.462.0+build2-0ubuntu0.18.04.562.0.3+build1-0ubuntu0.18.04.163.0+build2-0ubuntu0.18.04.263.0.3+build1-0ubuntu0.18.04.164.0+build3-0ubuntu0.18.04.165.0+build2-0ubuntu0.18.04.165.0.1+build2-0ubuntu0.18.04.166.0+build3-0ubuntu0.18.04.166.0.1+build1-0ubuntu0.18.04.166.0.2+build1-0ubuntu0.18.04.166.0.3+build1-0ubuntu0.18.04.166.0.4+build3-0ubuntu0.18.04.166.0.5+build1-0ubuntu0.18.04.167.0+build2-0ubuntu0.18.04.167.0.1+build1-0ubuntu0.18.04.167.0.2+build2-0ubuntu0.18.04.167.0.3+build1-0ubuntu0.18.04.167.0.4+build1-0ubuntu0.18.04.168.0+build3-0ubuntu0.18.04.168.0.1+build1-0ubuntu0.18.04.1
68.0.2+build1-0ubuntu0.18.04.1
MozillaFirefox
openSUSE:Leap 15.1
From an advisory covering 29 CVEs
 before 68.1.0-lp151.2.14.1
68.1.0-lp151.2.14.1
MozillaFirefox
openSUSE:Leap 15.0
From an advisory covering 29 CVEs
 before 68.1.0-lp150.3.66.1
68.1.0-lp150.3.66.1
MozillaFirefox
openSUSE:Tumbleweed
From an advisory covering 661 CVEs
 before 92.0-1.2
92.0-1.2
firefox-esr
openSUSE:Tumbleweed
From an advisory covering 1860 CVEs
 before 128.5.1-1.1
128.5.1-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-11733 is a critical vulnerability (CVSS 9.8) in Mozilla Firefox, published August 16, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.41%, the 72nd percentile. Fixed in firefox 68.0.2-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 19 versions and 1,945 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open