CVE-2019-11753
The Firefox installer allows Firefox to be installed to a custom user writable location, leaving...
The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malware. If the Mozilla Maintenance Service is manipulated to update this unprotected location and the updated maintenance service in the unprotected location has been altered, the altered maintenance service can run with elevated privileges during the update process due to a lack of integrity checks. This allows for privilege escalation if the executable has been replaced locally. <br>Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.. This vulnerability affects Firefox < 69, Firefox ESR < 60.9, and Firefox ESR < 68.1.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malware. If the Mozilla Maintenance Service is manipulated to update this unprotected location and the updated maintenance service in the unprotected location has been altered, the altered maintenance service can run with elevated privileges during the update process due to a lack of integrity checks. This allows for privilege escalation if the executable has been replaced locally. <br>Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.. This vulnerability affects Firefox < 69, Firefox ESR < 60.9, and Firefox ESR < 68.1.
- Record
CVE-2019-11753- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-354
- Updated
- 2026-11-02
CVE List No score
The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malware. If the Mozilla Maintenance Service is manipulated to update this unprotected location and the updated maintenance service in the unprotected location has been altered, the altered maintenance service can run with elevated privileges during the update process due to a lack of integrity checks. This allows for privilege escalation if the executable has been replaced locally. <br>Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.. This vulnerability affects Firefox < 69, Firefox ESR < 60.9, and Firefox ESR < 68.1.
- Record
CVE-2019-11753- Updated
- 2026-11-02
EUVDEUVD-2019-3423 No score
The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malware. If the Mozilla Maintenance Service is manipulated to update this unprotected location and the updated maintenance service in the unprotected location has been altered, the altered maintenance service can run with elevated privileges during the update process due to a lack of integrity checks. This allows for privilege escalation if the executable has been replaced locally. <br>Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.. This vulnerability affects Firefox < 69, Firefox ESR < 60.9, and Firefox ESR < 68.1.
- Record
EUVD-2019-3423- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8h86-hhcq-m432
The Firefox installer allows Firefox to be installed to a custom user writable location, leaving...
The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malware. If the Mozilla Maintenance Service is manipulated to update this unprotected location and the updated maintenance service in the unprotected location has been altered, the altered maintenance service can run with elevated privileges during the update process due to a lack of integrity checks. This allows for privilege escalation if the executable has been replaced locally. <br>Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.. This vulnerability affects Firefox < 69, Firefox ESR < 60.9, and Firefox ESR < 68.1.
- Record
GHSA-8h86-hhcq-m432- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-354
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-11753
The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malware. If the Mozilla Maintenance Service is manipulated to update this unprotected location and the updated maintenance service in the unprotected location has been altered, the altered maintenance service can run with elevated privileges during the update process due to a lack of integrity checks. This allows for privilege escalation if the executable has been replaced locally. <br>Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.. This vulnerability affects Firefox < 69, Firefox ESR < 60.9, and Firefox ESR < 68.1.
- Record
UBUNTU-CVE-2019-11753- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0267 No score
Updated firefox packages fix security vulnerabilities
The updated packages fix several bugs and some security issues:
Sandbox escape through Firefox Sync. (CVE-2019-9812)
Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9. (CVE-2019-11740)
Same-origin policy violation with SVG filters and canvas to steal cross-origin images. (CVE-2019-11742)
Cross-origin access to unload event attributes. (CVE-2019-11743)
XSS by breaking out of title and textarea elements using innerHTML. (CVE-2019-11744)
Use-after-free while manipulating video. (CVE-2019-11746)
Use-after-free while extracting a key value in IndexedDB. (CVE-2019-11752)
Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (CVE-2019-11753)
- Record
MGASA-2019-0267- Updated
- 2026-11-02
Show 10 moreShow less
OSVMGASA-2019-0268 No score
Updated firefox packages fix security vulnerabilities
The updated packages fix several bugs and some security issues:
Sandbox escape through Firefox Sync. (CVE-2019-9812)
Stored passwords in 'Saved Logins' can be copied without master password entry. (CVE-2019-11733)
Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1. (CVE-2019-11735)
File manipulation and privilege escalation in Mozilla Maintenance Service. (CVE-2019-11736)
Content security policy bypass through hash-based sources in directives. (CVE-2019-11738)
Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9. (CVE-2019-11740)
Same-origin policy violation with SVG filters and canvas to steal cross-origin images. (CVE-2019-11742)
Cross-origin access to unload event attributes. (CVE-2019-11743)
XSS by breaking out of title and textarea elements using innerHTML. (CVE-2019-11744)
Use-after-free while manipulating video. (CVE-2019-11746)
'Forget about this site' removes sites from pre-loaded HSTS list. (CVE-2019-11747)
Persistence of WebRTC permissions in a third party context. (CVE-2019-11748)
Camera information available without prompting using getUserMedia. (CVE-2019-11749)
Type confusion in Spidermonkey. (CVE-2019-11750)
Malicious code execution through command line parameters. (CVE-2019-11751)
Use-after-free while extracting a key value in IndexedDB. (CVE-2019-11752)
Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (CVE-2019-11753)
- Record
MGASA-2019-0268- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2251-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox to 68.1 fixes the following issues:
Security issues fixed:
- CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)
- CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)
- CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
- CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)
- CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)
- CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)
- CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
- CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868)
- CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
- CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868)
- CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868)
- CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322)
- CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868)
- CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665)
- CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293)
- CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292)
- CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302)
- CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
- CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)
- CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)
- CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)
- CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
- CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
- CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)
Non-security issues fixed:
- Latest update now also released for s390x. (bsc#1109465)
- Fixed a segmentation fault on s390vsl082. (bsc#1117473)
- Fixed a crash on SLES15 s390x. (bsc#1124525)
- Fixed a segmentation fault. (bsc#1133810)
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:2251-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2260-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox to 68.1 fixes the following issues:
Security issues fixed:
- CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)
- CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)
- CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
- CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)
- CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)
- CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)
- CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
- CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868)
- CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
- CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868)
- CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868)
- CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322)
- CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868)
- CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665)
- CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293)
- CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292)
- CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302)
- CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
- CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)
- CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)
- CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)
- CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
- CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
- CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)
Non-security issues fixed:
- Latest update now also released for s390x. (bsc#1109465)
- Fixed a segmentation fault on s390vsl082. (bsc#1117473)
- Fixed a crash on SLES15 s390x. (bsc#1124525)
- Fixed a segmentation fault. (bsc#1133810)
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:2260-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10600-1 No score
MozillaFirefox-92.0-1.2 on GA media
These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10600-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:14173-1 No score
Security update for MozillaFirefox, firefox-glib2, firefox-gtk3
This update for MozillaFirefox, firefox-glib2, firefox-gtk3 fixes the following issues:
Mozilla Firefox was updated to the 60.9.0esr release:
Security Advisory MFSA 2019-27:
- Use-after-free while manipulating video CVE-2019-11746 (bmo#1564449, bsc#1149297)
- XSS by breaking out of title and textarea elements using innerHTML CVE-2019-11744 (bmo#1562033, bsc#1149297)
- Same-origin policy violation with SVG filters and canvas to steal cross-origin images CVE-2019-11742 (bmo#1559715, bsc#1149303)
- Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location CVE-2019-11753 (bmo#1574980, bsc#1149295)
- Use-after-free while extracting a key value in IndexedDB CVE-2019-11752 (bmo#1501152, bsc#1149296)
- Sandbox escape through Firefox Sync CVE-2019-9812 (bmo#1538008, bmo#1538015, bsc#1149294)
- Cross-origin access to unload event attributes CVE-2019-11743 (bmo#1560495, bsc#1149298) Navigation-Timing Level 2 specification
- Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 CVE-2019-11740 (bmo#1563133, bmo#1573160, bsc#1149299)
- Rebuild glib2 schemas on SLE-11 (bsc#1145550)
Changes in firefox-glib2:
- Fix the rpm macros %glib2_gsettings_schema_* which were replaced with %nil in Factory because they're no longer needed, but we still need them in SLE11 (bsc#1145550)
Changes in firefox-gtk3:
- Rebuild so %glib2_gsettings_schema_post gets called with fixed rpm macros %glib2_gsettings_schema_* in firefox-glib2 package which were replaced with %nil in Factory because they're no longer needed, but we still need them in SLE11 (bsc#1145550)
- Record
SUSE-SU-2019:14173-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:14246-1 No score
Security update for Mozilla Firefox
This update contains the Mozilla Firefox ESR 68.2 release.
Mozilla Firefox was updated to ESR 68.2 release:
-
Enterprise: New administrative policies were added. More information and templates are available at the Policy Templates page.
-
Various security fixes: MFSA 2019-33 (bsc#1154738)
- CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber
- CVE-2019-11757: Use-after-free when creating index updates in IndexedDB
- CVE-2019-11758: Potentially exploitable crash due to 360 Total Security
- CVE-2019-11759: Stack buffer overflow in HKDF output
- CVE-2019-11760: Stack buffer overflow in WebRTC networking
- CVE-2019-11761: Unintended access to a privileged JSONView object
- CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation
- CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique
- CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2
Other Issues resolved:
- [bsc#1104841] Newer versions of firefox have a dependency on GLIBCXX_3.4.20
- [bsc#1074235] MozillaFirefox: background tab crash reports sent inadvertently without user opt-in
- [bsc#1043008] Firefox hangs randomly when browsing and scrolling
- [bsc#1025108] Firefox stops loading page until mouse is moved
- [bsc#905528] Firefox malfunctions due to broken omni.ja archives
- Record
SUSE-SU-2019:14246-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2436-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox to ESR 60.9 fixes the following issues:
Security issues fixed:
- CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)
- CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
- CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)
- CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)
- CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
- CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)
- CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
- Record
SUSE-SU-2019:2436-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2545-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox to 68.1 fixes the following issues:
Security issues fixed:
- CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)
- CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)
- CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
- CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)
- CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)
- CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)
- CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
- CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868)
- CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
- CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868)
- CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868)
- CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322)
- CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868)
- CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665)
- CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293)
- CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292)
- CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302)
- CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
- CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)
- CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)
- CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)
- CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
- CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
- CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)
Non-security issues fixed:
- Latest update now also released for s390x. (bsc#1109465)
- Fixed a segmentation fault on s390vsl082. (bsc#1117473)
- Fixed a crash on SLES15 s390x. (bsc#1124525)
- Fixed a segmentation fault. (bsc#1133810)
- Record
SUSE-SU-2019:2545-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2620-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Updated to new ESR version 68.1 (bsc#1149323).
In addition to the already fixed vulnerabilities released in previous ESR updates, the following were also fixed: CVE-2019-11751, CVE-2019-11736, CVE-2019-9812, CVE-2019-11748, CVE-2019-11749, CVE-2019-11750, CVE-2019-11738, CVE-2019-11747, CVE-2019-11735.
Several run-time issues were also resolved (bsc#1117473, bsc#1124525, bsc#1133810).
The version displayed in Help > About is now correct (bsc#1087200).
- Record
SUSE-SU-2019:2620-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firefoxMageia:6 From an advisory covering 8 CVEs |
before 60.9.0-1.mga6 | 60.9.0-1.mga6 |
firefox-l10nMageia:6 From an advisory covering 8 CVEs |
before 60.9.0-1.mga6 | 60.9.0-1.mga6 |
rootcertsMageia:6 From an advisory covering 8 CVEs |
before 20190820.00-1.mga6 | 20190820.00-1.mga6 |
nsprMageia:6 From an advisory covering 8 CVEs |
before 4.22-1.mga6 | 4.22-1.mga6 |
nssMageia:6 From an advisory covering 8 CVEs |
before 3.36.8-1.2.mga6 | 3.36.8-1.2.mga6 |
firefoxMageia:7 From an advisory covering 17 CVEs |
before 68.1.0-1.mga7 | 68.1.0-1.mga7 |
firefox-l10nMageia:7 From an advisory covering 17 CVEs |
before 68.1.0-1.mga7 | 68.1.0-1.mga7 |
rootcertsMageia:7 From an advisory covering 17 CVEs |
before 20190820.00-1.mga7 | 20190820.00-1.mga7 |
nsprMageia:7 From an advisory covering 17 CVEs |
before 4.22-1.mga7 | 4.22-1.mga7 |
nssMageia:7 From an advisory covering 17 CVEs |
before 3.46.0-1.mga7 | 3.46.0-1.mga7 |
Show 88 moreShow less
| Package | Affected | Fixed |
|---|---|---|
MozillaFirefoxSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 8 CVEs |
before 60.9.0esr-78.46.2 | 60.9.0esr-78.46.2 |
firefox-glib2SUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 8 CVEs |
before 2.54.3-2.11.1 | 2.54.3-2.11.1 |
firefox-gtk3SUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 8 CVEs |
before 3.10.9-2.12.2 | 3.10.9-2.12.2 |
MozillaFirefoxSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 68.2.0-78.51.4 | 68.2.0-78.51.4 |
MozillaFirefox-branding-SLEDSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 68-21.9.8 | 68-21.9.8 |
firefox-atkSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 2.26.1-2.8.4 | 2.26.1-2.8.4 |
firefox-cairoSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 1.15.10-2.13.4 | 1.15.10-2.13.4 |
firefox-gdk-pixbufSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 2.36.11-2.8.4 | 2.36.11-2.8.4 |
firefox-glib2SUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 2.54.3-2.14.7 | 2.54.3-2.14.7 |
firefox-gtk3SUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 3.10.9-2.15.3 | 3.10.9-2.15.3 |
firefox-harfbuzzSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 1.7.5-2.7.4 | 1.7.5-2.7.4 |
firefox-libffiSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 3.2.1.git259-2.3.3 | 3.2.1.git259-2.3.3 |
firefox-libffi-gcc5SUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 5.3.1+r233831-14.1 | 5.3.1+r233831-14.1 |
firefox-pangoSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 1.40.14-2.7.4 | 1.40.14-2.7.4 |
mozilla-nsprSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 4.21-29.6.1 | 4.21-29.6.1 |
mozilla-nssSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 3.45-38.9.3 | 3.45-38.9.3 |
MozillaFirefoxSUSE:HPE Helion OpenStack 8 From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:OpenStack Cloud 7 From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:OpenStack Cloud 8 From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:Linux Enterprise Software Development Kit 12 SP4 From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP1-LTSS From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:Enterprise Storage 4 From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:Enterprise Storage 5 From an advisory covering 8 CVEs |
before 60.9.0-109.86.1 | 60.9.0-109.86.1 |
MozillaFirefoxSUSE:Linux Enterprise Module for Desktop Applications 15 From an advisory covering 29 CVEs |
before 68.1.0-3.54.2 | 68.1.0-3.54.2 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Module for Desktop Applications 15 From an advisory covering 29 CVEs |
before 68-4.8.5 | 68-4.8.5 |
MozillaFirefoxSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 From an advisory covering 29 CVEs |
before 68.1.0-3.54.2 | 68.1.0-3.54.2 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Module for Desktop Applications 15 SP1 From an advisory covering 29 CVEs |
before 68-4.8.5 | 68-4.8.5 |
MozillaFirefoxSUSE:HPE Helion OpenStack 8 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:HPE Helion OpenStack 8 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:OpenStack Cloud 7 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:OpenStack Cloud 7 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:OpenStack Cloud 8 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:OpenStack Cloud 8 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:OpenStack Cloud Crowbar 8 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Software Development Kit 12 SP4 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefoxSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP1-LTSS From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server 12 SP1-LTSS From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server 12 SP4 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server 12 SP5 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Enterprise Storage 4 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Enterprise Storage 4 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
MozillaFirefoxSUSE:Enterprise Storage 5 From an advisory covering 38 CVEs |
before 68.1.0-109.89.1 | 68.1.0-109.89.1 |
MozillaFirefox-branding-SLESUSE:Enterprise Storage 5 From an advisory covering 38 CVEs |
before 68-32.8.1 | 68-32.8.1 |
mozjs52Ubuntu:18.04:LTS |
All versions, plus listed versions 52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1 |
None known |
mozjs38Ubuntu:18.04:LTS |
All versions, plus listed versions 38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4 |
None known |
mozjs52Ubuntu:20.04:LTS |
All versions, plus listed versions 52.9.1-1build152.9.1-1ubuntu3 |
None known |
MozillaFirefoxopenSUSE:Leap 15.1 From an advisory covering 29 CVEs |
before 68.1.0-lp151.2.14.1 | 68.1.0-lp151.2.14.1 |
MozillaFirefoxopenSUSE:Leap 15.0 From an advisory covering 29 CVEs |
before 68.1.0-lp150.3.66.1 | 68.1.0-lp150.3.66.1 |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 661 CVEs |
before 92.0-1.2 | 92.0-1.2 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 1860 CVEs |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-11753 is a high vulnerability (CVSS 7.8) in Mozilla Firefox, published September 12, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. No source names a fixed version.
References
bugzilla.mozilla.org/show_bug.cgi?id=1574980
mozilla.org/security/advisories/mfsa2019-25
lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2019-11753
github.com/advisories/GHSA-8h86-hhcq-m432
advisories.mageia.org/MGASA-2019-0267.html
bugs.mageia.org/show_bug.cgi?id=25359
hg.mozilla.org/projects/nss/log/default/lib/ckfw/builtins/certdata.txt
groups.google.com/forum
developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes
access.redhat.com/errata/RHSA-2019:2663
suse.com/support/update/announcement/2019/suse-su-201914173-1
bugzilla.suse.com/1145550
ubuntu.com/security/CVE-2019-11753
cve.org/CVERecord?id=CVE-2019-11753
Left out here: 1,892 references. The JSON record has them.