Every CVE Search/ Get API key

CVE-2019-11744

Some HTML elements, such as <title> and <textarea>, can contain literal angle...

6.1 MediumFix available

Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

1.45%Down 1.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.1

Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.

Record
CVE-2019-11744
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.

Record
CVE-2019-11744
Updated
2026-11-02
EUVDEUVD-2019-3414 No score

Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.

Record
EUVD-2019-3414
Updated
2026-11-03
GitHub AdvisoriesGHSA-gf55-vpjv-mh2j 6.1

Some HTML elements, such as &lt;title&gt; and &lt;textarea&gt;, can contain literal angle...

Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.

Record
GHSA-gf55-vpjv-mh2j
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVALPINE-CVE-2019-11744 6.1

Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.

Record
ALPINE-CVE-2019-11744
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-03
OSV 6.1

Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.

Record
CVE-2019-11744
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 27 moreShow less
OSVDEBIAN-CVE-2019-11744 6.1

Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.

Record
DEBIAN-CVE-2019-11744
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2019:2663 9.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2019:2663
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:2694 9.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2019:2694
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:2729 9.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2019:2729
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:2773 9.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2019:2773
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:2774 9.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2019:2774
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:2807 9.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2019:2807
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-11744 6.1

Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.

Record
UBUNTU-CVE-2019-11744
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVMGASA-2019-0267 No score

Updated firefox packages fix security vulnerabilities

The updated packages fix several bugs and some security issues:

Sandbox escape through Firefox Sync. (CVE-2019-9812)

Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9. (CVE-2019-11740)

Same-origin policy violation with SVG filters and canvas to steal cross-origin images. (CVE-2019-11742)

Cross-origin access to unload event attributes. (CVE-2019-11743)

XSS by breaking out of title and textarea elements using innerHTML. (CVE-2019-11744)

Use-after-free while manipulating video. (CVE-2019-11746)

Use-after-free while extracting a key value in IndexedDB. (CVE-2019-11752)

Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (CVE-2019-11753)

Record
MGASA-2019-0267
Updated
2026-11-02
OSVMGASA-2019-0268 No score

Updated firefox packages fix security vulnerabilities

The updated packages fix several bugs and some security issues:

Sandbox escape through Firefox Sync. (CVE-2019-9812)

Stored passwords in 'Saved Logins' can be copied without master password entry. (CVE-2019-11733)

Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1. (CVE-2019-11735)

File manipulation and privilege escalation in Mozilla Maintenance Service. (CVE-2019-11736)

Content security policy bypass through hash-based sources in directives. (CVE-2019-11738)

Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9. (CVE-2019-11740)

Same-origin policy violation with SVG filters and canvas to steal cross-origin images. (CVE-2019-11742)

Cross-origin access to unload event attributes. (CVE-2019-11743)

XSS by breaking out of title and textarea elements using innerHTML. (CVE-2019-11744)

Use-after-free while manipulating video. (CVE-2019-11746)

'Forget about this site' removes sites from pre-loaded HSTS list. (CVE-2019-11747)

Persistence of WebRTC permissions in a third party context. (CVE-2019-11748)

Camera information available without prompting using getUserMedia. (CVE-2019-11749)

Type confusion in Spidermonkey. (CVE-2019-11750)

Malicious code execution through command line parameters. (CVE-2019-11751)

Use-after-free while extracting a key value in IndexedDB. (CVE-2019-11752)

Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (CVE-2019-11753)

Record
MGASA-2019-0268
Updated
2026-11-02
OSVMGASA-2019-0275 No score

Updated thunderbird packages fix security vulnerabilities

Updated thunderbird packages fix security vulnerabilities:

Covert Content Attack on S/MIME encryption using a crafted multipart/ alternative message (CVE-2019-11739).

Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, Firefox ESR 60.9, Thunderbird 68.1, and Thunderbird 60.9 (CVE-2019-11740)

Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742)

Cross-origin access to unload event attributes (CVE-2019-11743)

XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744)

Use-after-free while manipulating video (CVE-2019-11746)

Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752)

Record
MGASA-2019-0275
Updated
2026-11-02
OSVMGASA-2019-0285 No score

Updated thunderbird packages fix security vulnerabilities

The updated thunderbird packages fix security issues:

Covert Content Attack on S/MIME encryption using a crafted multipart/ alternative message. (CVE-2019-11739)

Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, Firefox ESR 60.9, Thunderbird 68.1, and Thunderbird 60.9. (CVE-2019-11740)

Same-origin policy violation with SVG filters and canvas to steal cross-origin images. (CVE-2019-11742)

Cross-origin access to unload event attributes. (CVE-2019-11743)

XSS by breaking out of title and textarea elements using innerHTML. (CVE-2019-11744)

Use-after-free while manipulating video. (CVE-2019-11746)

Use-after-free while extracting a key value in IndexedDB. (CVE-2019-11752)

Record
MGASA-2019-0285
Updated
2026-11-02
OSVopenSUSE-SU-2019:2248-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird to version 68.1.1 fixes the following issues:

  • CVE-2019-11709: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11711: Fixed a script injection within domain through inner window reuse. (bsc#1140868)
  • CVE-2019-11712: Fixed an insufficient validation of cross-origin POST requests within NPAPI plugins. (bsc#1140868)
  • CVE-2019-11713: Fixed a use-after-free with HTTP/2 cached stream. (bsc#1140868)
  • CVE-2019-11714: Fixed a crash in NeckoChild. (bsc#1140868)
  • CVE-2019-11715: Fixed an HTML parsing error that can contribute to content XSS. (bsc#1140868)
  • CVE-2019-11716: Fixed an enumeration issue in globalThis. (bsc#1140868)
  • CVE-2019-11717: Fixed an improper escaping of the caret character in origins. (bsc#1140868)
  • CVE-2019-11719: Fixed an out-of-bounds read when importing curve25519 private key. (bsc#1140868)
  • CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
  • CVE-2019-11721: Fixed domain spoofing through unicode latin 'kra' character. (bsc#1140868)
  • CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
  • CVE-2019-11724: Fixed a permissions issue with the retired site input.mozilla.org. (bsc#1140868)
  • CVE-2019-11725: Fixed a SafeBrowsing bypass through WebSockets. (bsc#1140868)
  • CVE-2019-11727: Fixed an insufficient validation for PKCS#1 v1.5 signatures being used with TLS 1.3. (bsc#1140868)
  • CVE-2019-11728: Fixed port scanning through Alt-Svc header. (bsc#1140868)
  • CVE-2019-11729: Fixed a segmentation fault due to empty or malformed p256-ECDH public keys. (bsc#1140868)
  • CVE-2019-11730: Fixed an insufficient enforcement of the same-origin policy that treats all files in a directory as having the same-origin. (bsc#1140868)
  • CVE-2019-11739: Fixed a Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message. (bsc#1150939)
  • CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
  • CVE-2019-11742: Fixed a same-origin policy violation with SVG filters and canvas that enabled theft of cross-origin images. (bsc#1149303)
  • CVE-2019-11743: Fixed a cross-origin access issue. (bsc#1149298)
  • CVE-2019-11744: Fixed a XSS involving breaking out of title and textarea elements using innerHTML. (bsc#1149304)
  • CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
  • CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
  • CVE-2019-11755: Fixed an insufficient validation of S/MIME messages that allowed the author to be spoofed. (bsc#1152375)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2248-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2249-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird to version 68.1.1 fixes the following issues:

  • CVE-2019-11709: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11711: Fixed a script injection within domain through inner window reuse. (bsc#1140868)
  • CVE-2019-11712: Fixed an insufficient validation of cross-origin POST requests within NPAPI plugins. (bsc#1140868)
  • CVE-2019-11713: Fixed a use-after-free with HTTP/2 cached stream. (bsc#1140868)
  • CVE-2019-11714: Fixed a crash in NeckoChild. (bsc#1140868)
  • CVE-2019-11715: Fixed an HTML parsing error that can contribute to content XSS. (bsc#1140868)
  • CVE-2019-11716: Fixed an enumeration issue in globalThis. (bsc#1140868)
  • CVE-2019-11717: Fixed an improper escaping of the caret character in origins. (bsc#1140868)
  • CVE-2019-11719: Fixed an out-of-bounds read when importing curve25519 private key. (bsc#1140868)
  • CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
  • CVE-2019-11721: Fixed domain spoofing through unicode latin 'kra' character. (bsc#1140868)
  • CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
  • CVE-2019-11724: Fixed a permissions issue with the retired site input.mozilla.org. (bsc#1140868)
  • CVE-2019-11725: Fixed a SafeBrowsing bypass through WebSockets. (bsc#1140868)
  • CVE-2019-11727: Fixed an insufficient validation for PKCS#1 v1.5 signatures being used with TLS 1.3. (bsc#1140868)
  • CVE-2019-11728: Fixed port scanning through Alt-Svc header. (bsc#1140868)
  • CVE-2019-11729: Fixed a segmentation fault due to empty or malformed p256-ECDH public keys. (bsc#1140868)
  • CVE-2019-11730: Fixed an insufficient enforcement of the same-origin policy that treats all files in a directory as having the same-origin. (bsc#1140868)
  • CVE-2019-11739: Fixed a Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message. (bsc#1150939)
  • CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
  • CVE-2019-11742: Fixed a same-origin policy violation with SVG filters and canvas that enabled theft of cross-origin images. (bsc#1149303)
  • CVE-2019-11743: Fixed a cross-origin access issue. (bsc#1149298)
  • CVE-2019-11744: Fixed a XSS involving breaking out of title and textarea elements using innerHTML. (bsc#1149304)
  • CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
  • CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
  • CVE-2019-11755: Fixed an insufficient validation of S/MIME messages that allowed the author to be spoofed. (bsc#1152375)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2249-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2251-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox to 68.1 fixes the following issues:

Security issues fixed:

  • CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)
  • CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)
  • CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)
  • CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)
  • CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)
  • CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
  • CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868)
  • CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
  • CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868)
  • CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868)
  • CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322)
  • CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868)
  • CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665)
  • CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293)
  • CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292)
  • CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302)
  • CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
  • CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)
  • CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)
  • CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)
  • CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
  • CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
  • CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)

Non-security issues fixed:

  • Latest update now also released for s390x. (bsc#1109465)
  • Fixed a segmentation fault on s390vsl082. (bsc#1117473)
  • Fixed a crash on SLES15 s390x. (bsc#1124525)
  • Fixed a segmentation fault. (bsc#1133810)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2251-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2260-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox to 68.1 fixes the following issues:

Security issues fixed:

  • CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)
  • CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)
  • CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)
  • CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)
  • CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)
  • CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
  • CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868)
  • CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
  • CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868)
  • CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868)
  • CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322)
  • CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868)
  • CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665)
  • CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293)
  • CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292)
  • CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302)
  • CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
  • CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)
  • CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)
  • CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)
  • CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
  • CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
  • CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)

Non-security issues fixed:

  • Latest update now also released for s390x. (bsc#1109465)
  • Fixed a segmentation fault on s390vsl082. (bsc#1117473)
  • Fixed a crash on SLES15 s390x. (bsc#1124525)
  • Fixed a segmentation fault. (bsc#1133810)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2260-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10600-1 No score

MozillaFirefox-92.0-1.2 on GA media

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10600-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10601-1 No score

MozillaThunderbird-91.1.1-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10601-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02
OSVSUSE-SU-2019:14173-1 No score

Security update for MozillaFirefox, firefox-glib2, firefox-gtk3

This update for MozillaFirefox, firefox-glib2, firefox-gtk3 fixes the following issues:

Mozilla Firefox was updated to the 60.9.0esr release:

Security Advisory MFSA 2019-27:

  • Use-after-free while manipulating video CVE-2019-11746 (bmo#1564449, bsc#1149297)
  • XSS by breaking out of title and textarea elements using innerHTML CVE-2019-11744 (bmo#1562033, bsc#1149297)
  • Same-origin policy violation with SVG filters and canvas to steal cross-origin images CVE-2019-11742 (bmo#1559715, bsc#1149303)
  • Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location CVE-2019-11753 (bmo#1574980, bsc#1149295)
  • Use-after-free while extracting a key value in IndexedDB CVE-2019-11752 (bmo#1501152, bsc#1149296)
  • Sandbox escape through Firefox Sync CVE-2019-9812 (bmo#1538008, bmo#1538015, bsc#1149294)
  • Cross-origin access to unload event attributes CVE-2019-11743 (bmo#1560495, bsc#1149298) Navigation-Timing Level 2 specification
  • Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 CVE-2019-11740 (bmo#1563133, bmo#1573160, bsc#1149299)
  • Rebuild glib2 schemas on SLE-11 (bsc#1145550)

Changes in firefox-glib2:

  • Fix the rpm macros %glib2_gsettings_schema_* which were replaced with %nil in Factory because they're no longer needed, but we still need them in SLE11 (bsc#1145550)

Changes in firefox-gtk3:

  • Rebuild so %glib2_gsettings_schema_post gets called with fixed rpm macros %glib2_gsettings_schema_* in firefox-glib2 package which were replaced with %nil in Factory because they're no longer needed, but we still need them in SLE11 (bsc#1145550)
Record
SUSE-SU-2019:14173-1
Updated
2026-11-02
OSVSUSE-SU-2019:14246-1 No score

Security update for Mozilla Firefox

This update contains the Mozilla Firefox ESR 68.2 release.

Mozilla Firefox was updated to ESR 68.2 release:

  • Enterprise: New administrative policies were added. More information and templates are available at the Policy Templates page.

  • Various security fixes: MFSA 2019-33 (bsc#1154738)

    • CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber
    • CVE-2019-11757: Use-after-free when creating index updates in IndexedDB
    • CVE-2019-11758: Potentially exploitable crash due to 360 Total Security
    • CVE-2019-11759: Stack buffer overflow in HKDF output
    • CVE-2019-11760: Stack buffer overflow in WebRTC networking
    • CVE-2019-11761: Unintended access to a privileged JSONView object
    • CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation
    • CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique
    • CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2

Other Issues resolved:

  • [bsc#1104841] Newer versions of firefox have a dependency on GLIBCXX_3.4.20
  • [bsc#1074235] MozillaFirefox: background tab crash reports sent inadvertently without user opt-in
  • [bsc#1043008] Firefox hangs randomly when browsing and scrolling
  • [bsc#1025108] Firefox stops loading page until mouse is moved
  • [bsc#905528] Firefox malfunctions due to broken omni.ja archives
Record
SUSE-SU-2019:14246-1
Updated
2026-11-02
OSVSUSE-SU-2019:2436-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox to ESR 60.9 fixes the following issues:

Security issues fixed:

  • CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)
  • CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
  • CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)
  • CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)
  • CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
  • CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)
  • CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
Record
SUSE-SU-2019:2436-1
Updated
2026-11-02
OSVSUSE-SU-2019:2515-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird to version 68.1.1 fixes the following issues:

  • CVE-2019-11709: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11711: Fixed a script injection within domain through inner window reuse. (bsc#1140868)
  • CVE-2019-11712: Fixed an insufficient validation of cross-origin POST requests within NPAPI plugins. (bsc#1140868)
  • CVE-2019-11713: Fixed a use-after-free with HTTP/2 cached stream. (bsc#1140868)
  • CVE-2019-11714: Fixed a crash in NeckoChild. (bsc#1140868)
  • CVE-2019-11715: Fixed an HTML parsing error that can contribute to content XSS. (bsc#1140868)
  • CVE-2019-11716: Fixed an enumeration issue in globalThis. (bsc#1140868)
  • CVE-2019-11717: Fixed an improper escaping of the caret character in origins. (bsc#1140868)
  • CVE-2019-11719: Fixed an out-of-bounds read when importing curve25519 private key. (bsc#1140868)
  • CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
  • CVE-2019-11721: Fixed domain spoofing through unicode latin 'kra' character. (bsc#1140868)
  • CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
  • CVE-2019-11724: Fixed a permissions issue with the retired site input.mozilla.org. (bsc#1140868)
  • CVE-2019-11725: Fixed a SafeBrowsing bypass through WebSockets. (bsc#1140868)
  • CVE-2019-11727: Fixed an insufficient validation for PKCS#1 v1.5 signatures being used with TLS 1.3. (bsc#1140868)
  • CVE-2019-11728: Fixed port scanning through Alt-Svc header. (bsc#1140868)
  • CVE-2019-11729: Fixed a segmentation fault due to empty or malformed p256-ECDH public keys. (bsc#1140868)
  • CVE-2019-11730: Fixed an insufficient enforcement of the same-origin policy that treats all files in a directory as having the same-origin. (bsc#1140868)
  • CVE-2019-11739: Fixed a Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message. (bsc#1150939)
  • CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
  • CVE-2019-11742: Fixed a same-origin policy violation with SVG filters and canvas that enabled theft of cross-origin images. (bsc#1149303)
  • CVE-2019-11743: Fixed a cross-origin access issue. (bsc#1149298)
  • CVE-2019-11744: Fixed a XSS involving breaking out of title and textarea elements using innerHTML. (bsc#1149304)
  • CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
  • CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
  • CVE-2019-11755: Fixed an insufficient validation of S/MIME messages that allowed the author to be spoofed. (bsc#1152375)
Record
SUSE-SU-2019:2515-1
Updated
2026-11-02
OSVSUSE-SU-2019:2545-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox to 68.1 fixes the following issues:

Security issues fixed:

  • CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)
  • CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)
  • CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)
  • CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)
  • CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)
  • CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
  • CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868)
  • CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
  • CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868)
  • CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868)
  • CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322)
  • CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868)
  • CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665)
  • CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293)
  • CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292)
  • CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302)
  • CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
  • CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)
  • CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)
  • CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)
  • CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
  • CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
  • CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)

Non-security issues fixed:

  • Latest update now also released for s390x. (bsc#1109465)
  • Fixed a segmentation fault on s390vsl082. (bsc#1117473)
  • Fixed a crash on SLES15 s390x. (bsc#1124525)
  • Fixed a segmentation fault. (bsc#1133810)
Record
SUSE-SU-2019:2545-1
Updated
2026-11-02
OSVSUSE-SU-2019:2620-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Updated to new ESR version 68.1 (bsc#1149323).

In addition to the already fixed vulnerabilities released in previous ESR updates, the following were also fixed: CVE-2019-11751, CVE-2019-11736, CVE-2019-9812, CVE-2019-11748, CVE-2019-11749, CVE-2019-11750, CVE-2019-11738, CVE-2019-11747, CVE-2019-11735.

Several run-time issues were also resolved (bsc#1117473, bsc#1124525, bsc#1133810).

The version displayed in Help > About is now correct (bsc#1087200).

Record
SUSE-SU-2019:2620-1
Updated
2026-11-02
OSVUSN-4122-1 No score

firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to obtain sensitive information, bypass Content Security Policy (CSP) protections, bypass same-origin restrictions, conduct cross-site scripting (XSS) attacks, cause a denial of service, or execute arbitrary code. (CVE-2019-5849, CVE-2019-11734, CVE-2019-11735, CVE-2019-11737, CVE-2019-11738, CVE-2019-11740, CVE-2019-11742, CVE-2019-11743, CVE-2019-11744, CVE-2019-11746, CVE-2019-11748, CVE-2019-11749, CVE-2019-11750, CVE-2019-11752)

It was discovered that a compromised content process could log in to a malicious Firefox Sync account. An attacker could potentially exploit this, in combination with another vulnerability, to disable the sandbox. (CVE-2019-9812)

It was discovered that addons.mozilla.org and accounts.firefox.com could be loaded in to the same content process. An attacker could potentially exploit this, in combination with another vulnerability that allowed a cross-site scripting (XSS) attack, to modify browser settings. (CVE-2019-11741)

It was discovered that the "Forget about this site" feature in the history pane removes HTTP Strict Transport Security (HSTS) settings for sites on the pre-load list. An attacker could potentially exploit this to bypass the protections offered by HSTS. (CVE-2019-11747)

Record
USN-4122-1
Updated
2026-11-02
OSVUSN-4150-1 No score

thunderbird vulnerabilities

It was discovered that encrypted S/MIME parts in a multipart message can leak plaintext contents when included in a HTML reply or forward in some circumstances. If a user were tricked in to replying to or forwarding a specially crafted message, an attacker could potentially exploit this to obtain sensitive information. (CVE-2019-11739)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to obtain sensitive information, conduct cross-site scripting (XSS) attack, scause a denial of service, or execute arbitrary code. (CVE-2019-11740, CVE-2019-11742, CVE-2019-11743, CVE-2019-11744, CVE-2019-11746, CVE-2019-11752)

Record
USN-4150-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firefox-esr
Alpine:v3.10
 before 69.9.0-r0
69.9.0-r0
firefox-esr
Alpine:v3.11
 before 68.1.0-r0
68.1.0-r0
firefox-esr
Alpine:v3.12
 before 68.1.0-r0
68.1.0-r0
firefox-esr
Alpine:v3.13
 before 68.1.0-r0
68.1.0-r0
firefox-esr
Alpine:v3.14
 before 68.1.0-r0
68.1.0-r0
firefox-esr
Alpine:v3.15
 before 68.1.0-r0
68.1.0-r0
firefox-esr
Alpine:v3.16
 before 68.1.0-r0
68.1.0-r0
firefox-esr
Alpine:v3.17
 before 68.1.0-r0
68.1.0-r0
firefox-esr
Alpine:v3.18
 before 68.1.0-r0
68.1.0-r0
firefox-esr
Alpine:v3.19
 before 68.1.0-r0
68.1.0-r0
Show 166 moreShow less
Affected packages
PackageAffectedFixed
firefox-esr
Alpine:v3.20
 before 68.1.0-r0
68.1.0-r0
firefox-esr
Alpine:v3.21
 before 68.1.0-r0
68.1.0-r0
firefox-esr
Alpine:v3.22
 before 68.1.0-r0
68.1.0-r0
firefox-esr
Alpine:v3.23
 before 68.1.0-r0
68.1.0-r0
firefox-esr
Alpine:v3.9
 before 69.9.0-r0
69.9.0-r0
firefox-esr
Debian:12
 before 68.1.0esr-1
68.1.0esr-1
firefox-esr
Debian:13
 before 68.1.0esr-1
68.1.0esr-1
firefox-esr
Debian:14
 before 68.1.0esr-1
68.1.0esr-1
thunderbird
Debian:12
 before 1:60.9.0-1
1:60.9.0-1
thunderbird
Debian:13
 before 1:60.9.0-1
1:60.9.0-1
thunderbird
Debian:14
 before 1:60.9.0-1
1:60.9.0-1
firefox-esr
Debian:8
From an advisory covering 7 CVEs
 before 60.9.0esr-1~deb8u1, plus listed versions
45.0.1esr-145.0.2esr-145.0esr-145.0esr-245.1.0esr-1
Show 45 moreShow less
45.1.1esr-145.2.0esr-145.2.0esr-1~deb7u145.2.0esr-1~deb8u145.3.0esr-145.3.0esr-1~deb7u145.3.0esr-1~deb8u145.3.0esr-245.4.0esr-145.4.0esr-1~deb7u145.4.0esr-1~deb7u245.4.0esr-1~deb8u145.4.0esr-1~deb8u245.4.0esr-245.5.0esr-145.5.0esr-1~deb8u145.5.1esr-145.5.1esr-1~deb7u145.5.1esr-1~deb8u145.6.0esr-145.6.0esr-1~deb7u145.6.0esr-1~deb8u145.7.0esr-145.7.0esr-1~deb7u145.7.0esr-1~deb8u145.7.0esr-245.7.0esr-345.7.0esr-445.8.0esr-145.8.0esr-1~deb7u145.8.0esr-1~deb8u145.9.0esr-145.9.0esr-1~deb7u145.9.0esr-1~deb8u152.0.1esr-152.0.2esr-152.0esr-152.1.0esr-152.2.0esr-152.2.0esr-1~deb7u152.2.0esr-1~deb8u152.2.0esr-1~deb9u152.2.0esr-252.3.0esr-152.3.0esr-1~deb7u1
60.9.0esr-1~deb8u1
thunderbird
Debian:8
From an advisory covering 7 CVEs
 before 1:60.9.0-1~deb8u1, plus listed versions
1.5-41.5.0.2-11.5.0.2-21.5.0.2-31.5.0.4-1
Show 45 moreShow less
1.5.0.4-21.5.0.4-31.5.0.5-11.5.0.7-11.5.0.7-21:52.4.0-11:52.4.0-1~deb7u11:52.4.0-1~deb8u11:52.4.0-1~deb9u11:52.4.0-2~exp11:52.5.0-11:52.5.0-1~deb7u11:52.5.0-1~deb8u11:52.5.0-1~deb9u11:52.5.2-11:52.5.2-1~deb7u11:52.5.2-21:52.5.2-2~deb8u11:52.5.2-2~deb9u11:52.6.0-11:52.6.0-1+alpha.11:52.6.0-1+alpha.21:52.6.0-1~deb7u11:52.6.0-1~deb8u11:52.6.0-1~deb9u11:52.7.0-11:52.7.0-1~deb7u11:52.7.0-1~deb8u11:52.7.0-1~deb9u11:52.8.0-11:52.8.0-1~deb7u11:52.8.0-1~deb8u11:52.8.0-1~deb9u11:52.9.0-11:52.9.1-11:52.9.1-1~deb8u11:52.9.1-1~deb9u11:58.0~b3-11:60.0-11:60.0-21:60.0-2~deb9u11:60.0-31:60.0-3~deb9u11:60.0~b10-11:60.0~b2-1
1:60.9.0-1~deb8u1
firefox-esr
Debian:9
From an advisory covering 7 CVEs
 before 60.9.0esr-1~deb9u1, plus listed versions
45.9.0esr-152.0.1esr-152.0.2esr-152.0esr-152.1.0esr-1
Show 45 moreShow less
52.2.0esr-152.2.0esr-1~deb7u152.2.0esr-1~deb8u152.2.0esr-1~deb9u152.2.0esr-252.3.0esr-152.3.0esr-1~deb7u152.3.0esr-1~deb8u152.3.0esr-1~deb8u252.3.0esr-1~deb9u152.3.0esr-252.4.0esr-1~deb8u152.4.0esr-1~deb9u152.4.0esr-252.4.0esr-2~deb7u152.5.0esr-152.5.0esr-1~deb7u152.5.0esr-1~deb8u152.5.0esr-1~deb9u152.5.2esr-152.5.2esr-1~deb7u152.5.2esr-1~deb8u152.5.2esr-1~deb9u152.5.3esr-152.6.0esr-152.6.0esr-1~deb7u152.6.0esr-1~deb8u152.6.0esr-1~deb9u152.6.0esr-252.6.0esr-2+alpha.152.6.0esr-2+alpha.252.7.0esr-152.7.0esr-1~deb8u152.7.0esr-1~deb9u152.7.1esr-152.7.1esr-1~deb7u152.7.1esr-1~deb8u152.7.1esr-1~deb9u152.7.2esr-152.7.2esr-1~deb7u152.7.2esr-1~deb8u152.7.2esr-1~deb9u152.7.3esr-152.7.3esr-1~deb7u152.7.3esr-1~deb8u1
60.9.0esr-1~deb9u1
firefox-esr
Debian:10
From an advisory covering 7 CVEs
 before 60.9.0esr-1~deb10u1, plus listed versions
60.7.2esr-160.8.0esr-160.8.0esr-1~deb10u160.8.0esr-1~deb8u160.8.0esr-1~deb9u160.9.0esr-1~deb8u160.9.0esr-1~deb8u260.9.0esr-1~deb9u1
60.9.0esr-1~deb10u1
thunderbird
Debian:9
From an advisory covering 7 CVEs
 before 1:60.9.0-1~deb9u1, plus listed versions
1.5-41.5.0.2-11.5.0.2-21.5.0.2-31.5.0.4-1
Show 45 moreShow less
1.5.0.4-21.5.0.4-31.5.0.5-11.5.0.7-11.5.0.7-21:52.4.0-11:52.4.0-1~deb7u11:52.4.0-1~deb8u11:52.4.0-1~deb9u11:52.4.0-2~exp11:52.5.0-11:52.5.0-1~deb7u11:52.5.0-1~deb8u11:52.5.0-1~deb9u11:52.5.2-11:52.5.2-1~deb7u11:52.5.2-21:52.5.2-2~deb8u11:52.5.2-2~deb9u11:52.6.0-11:52.6.0-1+alpha.11:52.6.0-1+alpha.21:52.6.0-1~deb7u11:52.6.0-1~deb8u11:52.6.0-1~deb9u11:52.7.0-11:52.7.0-1~deb7u11:52.7.0-1~deb8u11:52.7.0-1~deb9u11:52.8.0-11:52.8.0-1~deb7u11:52.8.0-1~deb8u11:52.8.0-1~deb9u11:52.9.0-11:52.9.1-11:52.9.1-1~deb8u11:52.9.1-1~deb9u11:58.0~b3-11:60.0-11:60.0-21:60.0-2~deb9u11:60.0-31:60.0-3~deb9u11:60.0~b10-11:60.0~b2-1
1:60.9.0-1~deb9u1
thunderbird
Debian:10
From an advisory covering 7 CVEs
 before 1:60.9.0-1~deb10u1, plus listed versions
1:60.7.2-11:60.8.0-11:60.8.0-1~deb10u11:60.8.0-1~deb8u11:60.8.0-1~deb9u11:60.8.0-21:60.9.0-1~deb8u11:60.9.0-1~deb9u1
1:60.9.0-1~deb10u1
firefox
Mageia:6
From an advisory covering 8 CVEs
 before 60.9.0-1.mga6
60.9.0-1.mga6
firefox-l10n
Mageia:6
From an advisory covering 8 CVEs
 before 60.9.0-1.mga6
60.9.0-1.mga6
rootcerts
Mageia:6
From an advisory covering 8 CVEs
 before 20190820.00-1.mga6
20190820.00-1.mga6
nspr
Mageia:6
From an advisory covering 8 CVEs
 before 4.22-1.mga6
4.22-1.mga6
nss
Mageia:6
From an advisory covering 8 CVEs
 before 3.36.8-1.2.mga6
3.36.8-1.2.mga6
firefox
Mageia:7
From an advisory covering 17 CVEs
 before 68.1.0-1.mga7
68.1.0-1.mga7
firefox-l10n
Mageia:7
From an advisory covering 17 CVEs
 before 68.1.0-1.mga7
68.1.0-1.mga7
rootcerts
Mageia:7
From an advisory covering 17 CVEs
 before 20190820.00-1.mga7
20190820.00-1.mga7
nspr
Mageia:7
From an advisory covering 17 CVEs
 before 4.22-1.mga7
4.22-1.mga7
nss
Mageia:7
From an advisory covering 17 CVEs
 before 3.46.0-1.mga7
3.46.0-1.mga7
thunderbird
Mageia:6
From an advisory covering 6 CVEs
 before 60.9.0-1.mga6
60.9.0-1.mga6
thunderbird-l10n
Mageia:6
From an advisory covering 6 CVEs
 before 60.9.0-1.mga6
60.9.0-1.mga6
thunderbird
Mageia:7
From an advisory covering 7 CVEs
 before 68.1.0-1.1.mga7
68.1.0-1.1.mga7
thunderbird-l10n
Mageia:7
From an advisory covering 7 CVEs
 before 68.1.0-1.mga7
68.1.0-1.mga7
firefox
Red Hat:enterprise_linux:8::appstream
From an advisory covering 14 CVEs
 before 0:68.1.0-1.el8_0
0:68.1.0-1.el8_0
firefox-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 14 CVEs
 before 0:68.1.0-1.el8_0
0:68.1.0-1.el8_0
firefox-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 14 CVEs
 before 0:68.1.0-1.el8_0
0:68.1.0-1.el8_0
firefox
Red Hat:enterprise_linux:6::client
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
firefox-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
firefox
Red Hat:enterprise_linux:6::computenode
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
firefox-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
firefox
Red Hat:enterprise_linux:6::server
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
firefox-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
firefox
Red Hat:enterprise_linux:6::workstation
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
firefox-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
firefox
Red Hat:enterprise_linux:7::client
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el7_7
0:60.9.0-1.el7_7
firefox-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el7_7
0:60.9.0-1.el7_7
firefox
Red Hat:enterprise_linux:7::server
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el7_7
0:60.9.0-1.el7_7
firefox-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el7_7
0:60.9.0-1.el7_7
firefox
Red Hat:enterprise_linux:7::workstation
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el7_7
0:60.9.0-1.el7_7
firefox-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 8 CVEs
 before 0:60.9.0-1.el7_7
0:60.9.0-1.el7_7
thunderbird
Red Hat:enterprise_linux:7::client
From an advisory covering 7 CVEs
 before 0:60.9.0-1.el7_7
0:60.9.0-1.el7_7
thunderbird-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 7 CVEs
 before 0:60.9.0-1.el7_7
0:60.9.0-1.el7_7
thunderbird
Red Hat:enterprise_linux:7::server
From an advisory covering 7 CVEs
 before 0:60.9.0-1.el7_7
0:60.9.0-1.el7_7
thunderbird-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 7 CVEs
 before 0:60.9.0-1.el7_7
0:60.9.0-1.el7_7
thunderbird
Red Hat:enterprise_linux:7::workstation
From an advisory covering 7 CVEs
 before 0:60.9.0-1.el7_7
0:60.9.0-1.el7_7
thunderbird-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 7 CVEs
 before 0:60.9.0-1.el7_7
0:60.9.0-1.el7_7
thunderbird
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:60.9.0-2.el8_0
0:60.9.0-2.el8_0
thunderbird-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:60.9.0-2.el8_0
0:60.9.0-2.el8_0
thunderbird-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:60.9.0-2.el8_0
0:60.9.0-2.el8_0
thunderbird
Red Hat:enterprise_linux:6::client
From an advisory covering 7 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
thunderbird-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 7 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
thunderbird
Red Hat:enterprise_linux:6::server
From an advisory covering 7 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
thunderbird-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 7 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
thunderbird
Red Hat:enterprise_linux:6::workstation
From an advisory covering 7 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
thunderbird-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 7 CVEs
 before 0:60.9.0-1.el6_10
0:60.9.0-1.el6_10
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 8 CVEs
 before 60.9.0esr-78.46.2
60.9.0esr-78.46.2
firefox-glib2
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 8 CVEs
 before 2.54.3-2.11.1
2.54.3-2.11.1
firefox-gtk3
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 8 CVEs
 before 3.10.9-2.12.2
3.10.9-2.12.2
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 68.2.0-78.51.4
68.2.0-78.51.4
MozillaFirefox-branding-SLED
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 68-21.9.8
68-21.9.8
firefox-atk
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 2.26.1-2.8.4
2.26.1-2.8.4
firefox-cairo
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 1.15.10-2.13.4
1.15.10-2.13.4
firefox-gdk-pixbuf
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 2.36.11-2.8.4
2.36.11-2.8.4
firefox-glib2
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 2.54.3-2.14.7
2.54.3-2.14.7
firefox-gtk3
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 3.10.9-2.15.3
3.10.9-2.15.3
firefox-harfbuzz
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 1.7.5-2.7.4
1.7.5-2.7.4
firefox-libffi
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 3.2.1.git259-2.3.3
3.2.1.git259-2.3.3
firefox-libffi-gcc5
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 5.3.1+r233831-14.1
5.3.1+r233831-14.1
firefox-pango
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 1.40.14-2.7.4
1.40.14-2.7.4
mozilla-nspr
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 4.21-29.6.1
4.21-29.6.1
mozilla-nss
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 118 CVEs
 before 3.45-38.9.3
3.45-38.9.3
MozillaFirefox
SUSE:HPE Helion OpenStack 8
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaFirefox
SUSE:OpenStack Cloud 7
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaFirefox
SUSE:OpenStack Cloud 8
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaFirefox
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaFirefox
SUSE:Linux Enterprise Desktop 12 SP4
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP4
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP1-LTSS
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaFirefox
SUSE:Enterprise Storage 4
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaFirefox
SUSE:Enterprise Storage 5
From an advisory covering 8 CVEs
 before 60.9.0-109.86.1
60.9.0-109.86.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15
From an advisory covering 27 CVEs
 before 68.1.1-3.51.1
68.1.1-3.51.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP1
From an advisory covering 27 CVEs
 before 68.1.1-3.51.1
68.1.1-3.51.1
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15
From an advisory covering 29 CVEs
 before 68.1.0-3.54.2
68.1.0-3.54.2
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Module for Desktop Applications 15
From an advisory covering 29 CVEs
 before 68-4.8.5
68-4.8.5
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
From an advisory covering 29 CVEs
 before 68.1.0-3.54.2
68.1.0-3.54.2
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
From an advisory covering 29 CVEs
 before 68-4.8.5
68-4.8.5
MozillaFirefox
SUSE:HPE Helion OpenStack 8
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:HPE Helion OpenStack 8
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:OpenStack Cloud 7
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:OpenStack Cloud 7
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:OpenStack Cloud 8
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:OpenStack Cloud 8
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Desktop 12 SP4
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Desktop 12 SP4
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP4
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP1-LTSS
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP1-LTSS
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Enterprise Storage 4
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Enterprise Storage 4
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Enterprise Storage 5
From an advisory covering 38 CVEs
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Enterprise Storage 5
From an advisory covering 38 CVEs
 before 68-32.8.1
68-32.8.1
firefox
Ubuntu:16.04:LTS
 before 69.0+build2-0ubuntu0.16.04.4, plus listed versions
41.0.2+build2-0ubuntu142.0+build2-0ubuntu144.0+build3-0ubuntu244.0.1+build1-0ubuntu144.0.2+build1-0ubuntu1
Show 45 moreShow less
45.0+build2-0ubuntu145.0.1+build1-0ubuntu145.0.2+build1-0ubuntu146.0+build5-0ubuntu0.16.04.246.0.1+build1-0ubuntu0.16.04.247.0+build3-0ubuntu0.16.04.148.0+build2-0ubuntu0.16.04.149.0+build4-0ubuntu0.16.04.149.0.2+build2-0ubuntu0.16.04.250.0+build2-0ubuntu0.16.04.250.0.2+build1-0ubuntu0.16.04.150.1.0+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.252.0+build2-0ubuntu0.16.04.152.0.1+build2-0ubuntu0.16.04.152.0.2+build1-0ubuntu0.16.04.153.0+build6-0ubuntu0.16.04.153.0.2+build1-0ubuntu0.16.04.253.0.3+build1-0ubuntu0.16.04.254.0+build3-0ubuntu0.16.04.155.0.1+build2-0ubuntu0.16.04.255.0.2+build1-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.257.0+build4-0ubuntu0.16.04.557.0+build4-0ubuntu0.16.04.657.0.1+build2-0ubuntu0.16.04.157.0.3+build1-0ubuntu0.16.04.157.0.4+build1-0ubuntu0.16.04.158.0+build6-0ubuntu0.16.04.158.0.1+build1-0ubuntu0.16.04.158.0.2+build1-0ubuntu0.16.04.159.0+build5-0ubuntu0.16.04.159.0.1+build1-0ubuntu0.16.04.159.0.2+build1-0ubuntu0.16.04.159.0.2+build1-0ubuntu0.16.04.360.0+build2-0ubuntu0.16.04.160.0.1+build2-0ubuntu0.16.04.160.0.2+build1-0ubuntu0.16.04.161.0+build3-0ubuntu0.16.04.261.0.1+build1-0ubuntu0.16.04.162.0+build2-0ubuntu0.16.04.362.0+build2-0ubuntu0.16.04.462.0+build2-0ubuntu0.16.04.5
69.0+build2-0ubuntu0.16.04.4
thunderbird
Ubuntu:16.04:LTS
 before 1:60.9.0+build1-0ubuntu0.16.04.2, plus listed versions
1:38.3.0+build1-0ubuntu21:38.5.1+build2-0ubuntu11:38.6.0+build1-0ubuntu11:38.7.2+build1-0ubuntu0.16.04.11:38.8.0+build1-0ubuntu0.16.04.1
Show 23 moreShow less
1:45.2.0+build1-0ubuntu0.16.04.11:45.3.0+build1-0ubuntu0.16.04.21:45.4.0+build1-0ubuntu0.16.04.11:45.5.1+build1-0ubuntu0.16.04.11:45.7.0+build1-0ubuntu0.16.04.11:45.8.0+build1-0ubuntu0.16.04.11:52.1.1+build1-0ubuntu0.16.04.11:52.2.1+build1-0ubuntu0.16.04.11:52.3.0+build1-0ubuntu0.16.04.11:52.4.0+build1-0ubuntu0.16.04.21:52.5.0+build1-0ubuntu0.16.04.11:52.6.0+build1-0ubuntu0.16.04.11:52.7.0+build1-0ubuntu0.16.04.11:52.8.0+build1-0ubuntu0.16.04.11:52.9.1+build3-0ubuntu0.16.04.11:60.2.1+build1-0ubuntu0.16.04.41:60.4.0+build2-0ubuntu0.16.04.11:60.5.1+build2-0ubuntu0.16.04.11:60.6.1+build2-0ubuntu0.16.04.11:60.7.0+build1-0ubuntu0.16.04.11:60.7.1+build1-0ubuntu0.16.04.11:60.7.2+build2-0ubuntu0.16.04.11:60.8.0+build1-0ubuntu0.16.04.2
1:60.9.0+build1-0ubuntu0.16.04.2
firefox
Ubuntu:18.04:LTS
 before 69.0+build2-0ubuntu0.18.04.1, plus listed versions
56.0+build6-0ubuntu157.0.1+build2-0ubuntu159.0.1+build1-0ubuntu159.0.2+build1-0ubuntu160.0+build2-0ubuntu1
Show 27 moreShow less
60.0.1+build2-0ubuntu0.18.04.160.0.2+build1-0ubuntu0.18.04.161.0+build3-0ubuntu0.18.04.161.0.1+build1-0ubuntu0.18.04.162.0+build2-0ubuntu0.18.04.362.0+build2-0ubuntu0.18.04.462.0+build2-0ubuntu0.18.04.562.0.3+build1-0ubuntu0.18.04.163.0+build2-0ubuntu0.18.04.263.0.3+build1-0ubuntu0.18.04.164.0+build3-0ubuntu0.18.04.165.0+build2-0ubuntu0.18.04.165.0.1+build2-0ubuntu0.18.04.166.0+build3-0ubuntu0.18.04.166.0.1+build1-0ubuntu0.18.04.166.0.2+build1-0ubuntu0.18.04.166.0.3+build1-0ubuntu0.18.04.166.0.4+build3-0ubuntu0.18.04.166.0.5+build1-0ubuntu0.18.04.167.0+build2-0ubuntu0.18.04.167.0.1+build1-0ubuntu0.18.04.167.0.2+build2-0ubuntu0.18.04.167.0.3+build1-0ubuntu0.18.04.167.0.4+build1-0ubuntu0.18.04.168.0+build3-0ubuntu0.18.04.168.0.1+build1-0ubuntu0.18.04.168.0.2+build1-0ubuntu0.18.04.1
69.0+build2-0ubuntu0.18.04.1
thunderbird
Ubuntu:18.04:LTS
 before 1:60.9.0+build1-0ubuntu0.18.04.1, plus listed versions
1:52.4.0+build1-0ubuntu21:52.6.0+build1-0ubuntu11:52.7.0+build1-0ubuntu11:52.8.0+build1-0ubuntu0.18.04.11:52.9.1+build3-0ubuntu0.18.04.1
Show 8 moreShow less
1:60.2.1+build1-0ubuntu0.18.04.21:60.4.0+build2-0ubuntu0.18.04.11:60.5.1+build2-0ubuntu0.18.04.11:60.6.1+build2-0ubuntu0.18.04.11:60.7.0+build1-0ubuntu0.18.04.11:60.7.1+build1-0ubuntu0.18.04.11:60.7.2+build2-0ubuntu0.18.04.11:60.8.0+build1-0ubuntu0.18.04.1
1:60.9.0+build1-0ubuntu0.18.04.1
mozjs52
Ubuntu:18.04:LTS
 All versions, plus listed versions
52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1
 None known
mozjs38
Ubuntu:18.04:LTS
 All versions, plus listed versions
38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4
 None known
mozjs52
Ubuntu:20.04:LTS
 All versions, plus listed versions
52.9.1-1build152.9.1-1ubuntu3
 None known
firefox
Ubuntu:16.04:LTS
From an advisory covering 17 CVEs
 before 69.0+build2-0ubuntu0.16.04.4, plus listed versions
41.0.2+build2-0ubuntu142.0+build2-0ubuntu144.0+build3-0ubuntu244.0.1+build1-0ubuntu144.0.2+build1-0ubuntu1
Show 45 moreShow less
45.0+build2-0ubuntu145.0.1+build1-0ubuntu145.0.2+build1-0ubuntu146.0+build5-0ubuntu0.16.04.246.0.1+build1-0ubuntu0.16.04.247.0+build3-0ubuntu0.16.04.148.0+build2-0ubuntu0.16.04.149.0+build4-0ubuntu0.16.04.149.0.2+build2-0ubuntu0.16.04.250.0+build2-0ubuntu0.16.04.250.0.2+build1-0ubuntu0.16.04.150.1.0+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.252.0+build2-0ubuntu0.16.04.152.0.1+build2-0ubuntu0.16.04.152.0.2+build1-0ubuntu0.16.04.153.0+build6-0ubuntu0.16.04.153.0.2+build1-0ubuntu0.16.04.253.0.3+build1-0ubuntu0.16.04.254.0+build3-0ubuntu0.16.04.155.0.1+build2-0ubuntu0.16.04.255.0.2+build1-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.257.0+build4-0ubuntu0.16.04.557.0+build4-0ubuntu0.16.04.657.0.1+build2-0ubuntu0.16.04.157.0.3+build1-0ubuntu0.16.04.157.0.4+build1-0ubuntu0.16.04.158.0+build6-0ubuntu0.16.04.158.0.1+build1-0ubuntu0.16.04.158.0.2+build1-0ubuntu0.16.04.159.0+build5-0ubuntu0.16.04.159.0.1+build1-0ubuntu0.16.04.159.0.2+build1-0ubuntu0.16.04.159.0.2+build1-0ubuntu0.16.04.360.0+build2-0ubuntu0.16.04.160.0.1+build2-0ubuntu0.16.04.160.0.2+build1-0ubuntu0.16.04.161.0+build3-0ubuntu0.16.04.261.0.1+build1-0ubuntu0.16.04.162.0+build2-0ubuntu0.16.04.362.0+build2-0ubuntu0.16.04.462.0+build2-0ubuntu0.16.04.5
69.0+build2-0ubuntu0.16.04.4
firefox
Ubuntu:18.04:LTS
From an advisory covering 17 CVEs
 before 69.0+build2-0ubuntu0.18.04.1, plus listed versions
56.0+build6-0ubuntu157.0.1+build2-0ubuntu159.0.1+build1-0ubuntu159.0.2+build1-0ubuntu160.0+build2-0ubuntu1
Show 27 moreShow less
60.0.1+build2-0ubuntu0.18.04.160.0.2+build1-0ubuntu0.18.04.161.0+build3-0ubuntu0.18.04.161.0.1+build1-0ubuntu0.18.04.162.0+build2-0ubuntu0.18.04.362.0+build2-0ubuntu0.18.04.462.0+build2-0ubuntu0.18.04.562.0.3+build1-0ubuntu0.18.04.163.0+build2-0ubuntu0.18.04.263.0.3+build1-0ubuntu0.18.04.164.0+build3-0ubuntu0.18.04.165.0+build2-0ubuntu0.18.04.165.0.1+build2-0ubuntu0.18.04.166.0+build3-0ubuntu0.18.04.166.0.1+build1-0ubuntu0.18.04.166.0.2+build1-0ubuntu0.18.04.166.0.3+build1-0ubuntu0.18.04.166.0.4+build3-0ubuntu0.18.04.166.0.5+build1-0ubuntu0.18.04.167.0+build2-0ubuntu0.18.04.167.0.1+build1-0ubuntu0.18.04.167.0.2+build2-0ubuntu0.18.04.167.0.3+build1-0ubuntu0.18.04.167.0.4+build1-0ubuntu0.18.04.168.0+build3-0ubuntu0.18.04.168.0.1+build1-0ubuntu0.18.04.168.0.2+build1-0ubuntu0.18.04.1
69.0+build2-0ubuntu0.18.04.1
thunderbird
Ubuntu:16.04:LTS
From an advisory covering 7 CVEs
 before 1:60.9.0+build1-0ubuntu0.16.04.2, plus listed versions
1:38.3.0+build1-0ubuntu21:38.5.1+build2-0ubuntu11:38.6.0+build1-0ubuntu11:38.7.2+build1-0ubuntu0.16.04.11:38.8.0+build1-0ubuntu0.16.04.1
Show 23 moreShow less
1:45.2.0+build1-0ubuntu0.16.04.11:45.3.0+build1-0ubuntu0.16.04.21:45.4.0+build1-0ubuntu0.16.04.11:45.5.1+build1-0ubuntu0.16.04.11:45.7.0+build1-0ubuntu0.16.04.11:45.8.0+build1-0ubuntu0.16.04.11:52.1.1+build1-0ubuntu0.16.04.11:52.2.1+build1-0ubuntu0.16.04.11:52.3.0+build1-0ubuntu0.16.04.11:52.4.0+build1-0ubuntu0.16.04.21:52.5.0+build1-0ubuntu0.16.04.11:52.6.0+build1-0ubuntu0.16.04.11:52.7.0+build1-0ubuntu0.16.04.11:52.8.0+build1-0ubuntu0.16.04.11:52.9.1+build3-0ubuntu0.16.04.11:60.2.1+build1-0ubuntu0.16.04.41:60.4.0+build2-0ubuntu0.16.04.11:60.5.1+build2-0ubuntu0.16.04.11:60.6.1+build2-0ubuntu0.16.04.11:60.7.0+build1-0ubuntu0.16.04.11:60.7.1+build1-0ubuntu0.16.04.11:60.7.2+build2-0ubuntu0.16.04.11:60.8.0+build1-0ubuntu0.16.04.2
1:60.9.0+build1-0ubuntu0.16.04.2
thunderbird
Ubuntu:18.04:LTS
From an advisory covering 7 CVEs
 before 1:60.9.0+build1-0ubuntu0.18.04.1, plus listed versions
1:52.4.0+build1-0ubuntu21:52.6.0+build1-0ubuntu11:52.7.0+build1-0ubuntu11:52.8.0+build1-0ubuntu0.18.04.11:52.9.1+build3-0ubuntu0.18.04.1
Show 8 moreShow less
1:60.2.1+build1-0ubuntu0.18.04.21:60.4.0+build2-0ubuntu0.18.04.11:60.5.1+build2-0ubuntu0.18.04.11:60.6.1+build2-0ubuntu0.18.04.11:60.7.0+build1-0ubuntu0.18.04.11:60.7.1+build1-0ubuntu0.18.04.11:60.7.2+build2-0ubuntu0.18.04.11:60.8.0+build1-0ubuntu0.18.04.1
1:60.9.0+build1-0ubuntu0.18.04.1
MozillaThunderbird
openSUSE:Leap 15.0
From an advisory covering 27 CVEs
 before 68.1.1-lp150.3.51.1
68.1.1-lp150.3.51.1
enigmail
openSUSE:Leap 15.0
From an advisory covering 27 CVEs
 before 2.1.2-lp150.34.1
2.1.2-lp150.34.1
MozillaThunderbird
openSUSE:Leap 15.1
From an advisory covering 27 CVEs
 before 68.1.1-lp151.2.13.1
68.1.1-lp151.2.13.1
enigmail
openSUSE:Leap 15.1
From an advisory covering 27 CVEs
 before 2.1.2-lp151.2.6.1
2.1.2-lp151.2.6.1
MozillaFirefox
openSUSE:Leap 15.1
From an advisory covering 29 CVEs
 before 68.1.0-lp151.2.14.1
68.1.0-lp151.2.14.1
MozillaFirefox
openSUSE:Leap 15.0
From an advisory covering 29 CVEs
 before 68.1.0-lp150.3.66.1
68.1.0-lp150.3.66.1
MozillaFirefox
openSUSE:Tumbleweed
From an advisory covering 661 CVEs
 before 92.0-1.2
92.0-1.2
MozillaThunderbird
openSUSE:Tumbleweed
From an advisory covering 394 CVEs
 before 91.1.1-1.1
91.1.1-1.1
firefox-esr
openSUSE:Tumbleweed
From an advisory covering 1860 CVEs
 before 128.5.1-1.1
128.5.1-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-11744 is a medium vulnerability (CVSS 6.1) in Mozilla Firefox, published September 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.45%, the 73rd percentile. Fixed in firefox-esr 69.9.0-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 283 versions and 2,090 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open