CVE-2019-11736
The Mozilla Maintenance Service does not guard against files being hardlinked to another file in...
The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged access. Additionally, there was a race condition during checks for junctions and symbolic links by the Maintenance Service, allowing for potential local file and directory manipulation to be undetected in some circumstances. This allows for potential privilege escalation by a user with unprivileged local access. <br>Note: These attacks requires local system access and only affects Windows. Other operating systems are not affected.. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged access. Additionally, there was a race condition during checks for junctions and symbolic links by the Maintenance Service, allowing for potential local file and directory manipulation to be undetected in some circumstances. This allows for potential privilege escalation by a user with unprivileged local access. <br>Note: These attacks requires local system access and only affects Windows. Other operating systems are not affected.. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.
- Record
CVE-2019-11736- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged access. Additionally, there was a race condition during checks for junctions and symbolic links by the Maintenance Service, allowing for potential local file and directory manipulation to be undetected in some circumstances. This allows for potential privilege escalation by a user with unprivileged local access. <br>Note: These attacks requires local system access and only affects Windows. Other operating systems are not affected.. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.
- Record
CVE-2019-11736- Updated
- 2026-11-02
EUVDEUVD-2019-3406 No score
The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged access. Additionally, there was a race condition during checks for junctions and symbolic links by the Maintenance Service, allowing for potential local file and directory manipulation to be undetected in some circumstances. This allows for potential privilege escalation by a user with unprivileged local access. <br>Note: These attacks requires local system access and only affects Windows. Other operating systems are not affected.. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.
- Record
EUVD-2019-3406- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g4fc-6wpg-63m2
The Mozilla Maintenance Service does not guard against files being hardlinked to another file in...
The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged access. Additionally, there was a race condition during checks for junctions and symbolic links by the Maintenance Service, allowing for potential local file and directory manipulation to be undetected in some circumstances. This allows for potential privilege escalation by a user with unprivileged local access. <br>Note: These attacks requires local system access and only affects Windows. Other operating systems are not affected.. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.
- Record
GHSA-g4fc-6wpg-63m2- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-11736
The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged access. Additionally, there was a race condition during checks for junctions and symbolic links by the Maintenance Service, allowing for potential local file and directory manipulation to be undetected in some circumstances. This allows for potential privilege escalation by a user with unprivileged local access. <br>Note: These attacks requires local system access and only affects Windows. Other operating systems are not affected.. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.
- Record
UBUNTU-CVE-2019-11736- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0268 No score
Updated firefox packages fix security vulnerabilities
The updated packages fix several bugs and some security issues:
Sandbox escape through Firefox Sync. (CVE-2019-9812)
Stored passwords in 'Saved Logins' can be copied without master password entry. (CVE-2019-11733)
Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1. (CVE-2019-11735)
File manipulation and privilege escalation in Mozilla Maintenance Service. (CVE-2019-11736)
Content security policy bypass through hash-based sources in directives. (CVE-2019-11738)
Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9. (CVE-2019-11740)
Same-origin policy violation with SVG filters and canvas to steal cross-origin images. (CVE-2019-11742)
Cross-origin access to unload event attributes. (CVE-2019-11743)
XSS by breaking out of title and textarea elements using innerHTML. (CVE-2019-11744)
Use-after-free while manipulating video. (CVE-2019-11746)
'Forget about this site' removes sites from pre-loaded HSTS list. (CVE-2019-11747)
Persistence of WebRTC permissions in a third party context. (CVE-2019-11748)
Camera information available without prompting using getUserMedia. (CVE-2019-11749)
Type confusion in Spidermonkey. (CVE-2019-11750)
Malicious code execution through command line parameters. (CVE-2019-11751)
Use-after-free while extracting a key value in IndexedDB. (CVE-2019-11752)
Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (CVE-2019-11753)
- Record
MGASA-2019-0268- Updated
- 2026-11-02
Show 7 moreShow less
OSVopenSUSE-SU-2019:2251-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox to 68.1 fixes the following issues:
Security issues fixed:
- CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)
- CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)
- CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
- CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)
- CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)
- CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)
- CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
- CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868)
- CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
- CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868)
- CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868)
- CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322)
- CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868)
- CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665)
- CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293)
- CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292)
- CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302)
- CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
- CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)
- CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)
- CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)
- CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
- CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
- CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)
Non-security issues fixed:
- Latest update now also released for s390x. (bsc#1109465)
- Fixed a segmentation fault on s390vsl082. (bsc#1117473)
- Fixed a crash on SLES15 s390x. (bsc#1124525)
- Fixed a segmentation fault. (bsc#1133810)
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:2251-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2260-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox to 68.1 fixes the following issues:
Security issues fixed:
- CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)
- CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)
- CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
- CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)
- CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)
- CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)
- CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
- CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868)
- CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
- CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868)
- CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868)
- CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322)
- CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868)
- CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665)
- CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293)
- CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292)
- CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302)
- CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
- CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)
- CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)
- CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)
- CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
- CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
- CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)
Non-security issues fixed:
- Latest update now also released for s390x. (bsc#1109465)
- Fixed a segmentation fault on s390vsl082. (bsc#1117473)
- Fixed a crash on SLES15 s390x. (bsc#1124525)
- Fixed a segmentation fault. (bsc#1133810)
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:2260-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10600-1 No score
MozillaFirefox-92.0-1.2 on GA media
These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10600-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:14246-1 No score
Security update for Mozilla Firefox
This update contains the Mozilla Firefox ESR 68.2 release.
Mozilla Firefox was updated to ESR 68.2 release:
-
Enterprise: New administrative policies were added. More information and templates are available at the Policy Templates page.
-
Various security fixes: MFSA 2019-33 (bsc#1154738)
- CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber
- CVE-2019-11757: Use-after-free when creating index updates in IndexedDB
- CVE-2019-11758: Potentially exploitable crash due to 360 Total Security
- CVE-2019-11759: Stack buffer overflow in HKDF output
- CVE-2019-11760: Stack buffer overflow in WebRTC networking
- CVE-2019-11761: Unintended access to a privileged JSONView object
- CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation
- CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique
- CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2
Other Issues resolved:
- [bsc#1104841] Newer versions of firefox have a dependency on GLIBCXX_3.4.20
- [bsc#1074235] MozillaFirefox: background tab crash reports sent inadvertently without user opt-in
- [bsc#1043008] Firefox hangs randomly when browsing and scrolling
- [bsc#1025108] Firefox stops loading page until mouse is moved
- [bsc#905528] Firefox malfunctions due to broken omni.ja archives
- Record
SUSE-SU-2019:14246-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2545-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox to 68.1 fixes the following issues:
Security issues fixed:
- CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)
- CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)
- CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
- CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)
- CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)
- CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)
- CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
- CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868)
- CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
- CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868)
- CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868)
- CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322)
- CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868)
- CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665)
- CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293)
- CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292)
- CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302)
- CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
- CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)
- CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)
- CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)
- CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
- CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
- CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)
Non-security issues fixed:
- Latest update now also released for s390x. (bsc#1109465)
- Fixed a segmentation fault on s390vsl082. (bsc#1117473)
- Fixed a crash on SLES15 s390x. (bsc#1124525)
- Fixed a segmentation fault. (bsc#1133810)
- Record
SUSE-SU-2019:2545-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2620-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Updated to new ESR version 68.1 (bsc#1149323).
In addition to the already fixed vulnerabilities released in previous ESR updates, the following were also fixed: CVE-2019-11751, CVE-2019-11736, CVE-2019-9812, CVE-2019-11748, CVE-2019-11749, CVE-2019-11750, CVE-2019-11738, CVE-2019-11747, CVE-2019-11735.
Several run-time issues were also resolved (bsc#1117473, bsc#1124525, bsc#1133810).
The version displayed in Help > About is now correct (bsc#1087200).
- Record
SUSE-SU-2019:2620-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firefoxMageia:7 From an advisory covering 17 CVEs |
before 68.1.0-1.mga7 | 68.1.0-1.mga7 |
firefox-l10nMageia:7 From an advisory covering 17 CVEs |
before 68.1.0-1.mga7 | 68.1.0-1.mga7 |
rootcertsMageia:7 From an advisory covering 17 CVEs |
before 20190820.00-1.mga7 | 20190820.00-1.mga7 |
nsprMageia:7 From an advisory covering 17 CVEs |
before 4.22-1.mga7 | 4.22-1.mga7 |
nssMageia:7 From an advisory covering 17 CVEs |
before 3.46.0-1.mga7 | 3.46.0-1.mga7 |
MozillaFirefoxSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 68.2.0-78.51.4 | 68.2.0-78.51.4 |
MozillaFirefox-branding-SLEDSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 68-21.9.8 | 68-21.9.8 |
firefox-atkSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 2.26.1-2.8.4 | 2.26.1-2.8.4 |
firefox-cairoSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 1.15.10-2.13.4 | 1.15.10-2.13.4 |
firefox-gdk-pixbufSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 2.36.11-2.8.4 | 2.36.11-2.8.4 |
Show 59 moreShow less
| Package | Affected | Fixed |
|---|---|---|
firefox-glib2SUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 2.54.3-2.14.7 | 2.54.3-2.14.7 |
firefox-gtk3SUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 3.10.9-2.15.3 | 3.10.9-2.15.3 |
firefox-harfbuzzSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 1.7.5-2.7.4 | 1.7.5-2.7.4 |
firefox-libffiSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 3.2.1.git259-2.3.3 | 3.2.1.git259-2.3.3 |
firefox-libffi-gcc5SUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 5.3.1+r233831-14.1 | 5.3.1+r233831-14.1 |
firefox-pangoSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 1.40.14-2.7.4 | 1.40.14-2.7.4 |
mozilla-nsprSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 4.21-29.6.1 | 4.21-29.6.1 |
mozilla-nssSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 3.45-38.9.3 | 3.45-38.9.3 |
MozillaFirefoxSUSE:Linux Enterprise Module for Desktop Applications 15 From an advisory covering 29 CVEs |
before 68.1.0-3.54.2 | 68.1.0-3.54.2 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Module for Desktop Applications 15 From an advisory covering 29 CVEs |
before 68-4.8.5 | 68-4.8.5 |
MozillaFirefoxSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 From an advisory covering 29 CVEs |
before 68.1.0-3.54.2 | 68.1.0-3.54.2 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Module for Desktop Applications 15 SP1 From an advisory covering 29 CVEs |
before 68-4.8.5 | 68-4.8.5 |
MozillaFirefoxSUSE:HPE Helion OpenStack 8 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:HPE Helion OpenStack 8 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:OpenStack Cloud 7 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:OpenStack Cloud 7 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:OpenStack Cloud 8 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:OpenStack Cloud 8 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:OpenStack Cloud Crowbar 8 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Software Development Kit 12 SP4 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefoxSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP1-LTSS From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server 12 SP1-LTSS From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server 12 SP4 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server 12 SP5 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Enterprise Storage 4 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Enterprise Storage 4 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Enterprise Storage 5 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Enterprise Storage 5 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
mozjs52Ubuntu:18.04:LTS |
All versions, plus listed versions 52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1 |
None known |
mozjs38Ubuntu:18.04:LTS |
All versions, plus listed versions 38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4 |
None known |
mozjs52Ubuntu:20.04:LTS |
All versions, plus listed versions 52.9.1-1build152.9.1-1ubuntu3 |
None known |
MozillaFirefoxopenSUSE:Leap 15.1 From an advisory covering 29 CVEs |
before 68.1.0-lp151.2.14.1 | 68.1.0-lp151.2.14.1 |
MozillaFirefoxopenSUSE:Leap 15.0 From an advisory covering 29 CVEs |
before 68.1.0-lp150.3.66.1 | 68.1.0-lp150.3.66.1 |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 661 CVEs |
before 92.0-1.2 | 92.0-1.2 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 1860 CVEs |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-11736 is a high vulnerability (CVSS 7.0) in Mozilla Firefox, published September 12, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. No source names a fixed version.
References
bugzilla.mozilla.org/show_bug.cgi?id=1551913
mozilla.org/security/advisories/mfsa2019-25
lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2019-11736
github.com/advisories/GHSA-g4fc-6wpg-63m2
advisories.mageia.org/MGASA-2019-0268.html
bugs.mageia.org/show_bug.cgi?id=25359
hg.mozilla.org/projects/nss/log/default/lib/ckfw/builtins/certdata.txt
developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes
groups.google.com/forum
access.redhat.com/errata/RHSA-2019:2663
suse.com/support/update/announcement/2019/suse-su-201914246-1
bugzilla.suse.com/1000036
ubuntu.com/security/CVE-2019-11736
cve.org/CVERecord?id=CVE-2019-11736
Left out here: 1,885 references. The JSON record has them.