Every CVE Search/ Get API key

CVE-2019-9794

A vulnerability was discovered where specific command line arguments are not properly discarded...

9.8 CriticalFix available

A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This could be used to retrieve and execute files whose location is supplied through these command line arguments if Firefox is configured as the default URI handler for a given URI scheme in third party applications and these applications insufficiently sanitize URL data. Note: This issue only affects Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.77%Down 9.0 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This could be used to retrieve and execute files whose location is supplied through these command line arguments if Firefox is configured as the default URI handler for a given URI scheme in third party applications and these applications insufficiently sanitize URL data. Note: This issue only affects Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.

Record
CVE-2019-9794
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-88
Updated
2026-11-02
CVE List No score

A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This could be used to retrieve and execute files whose location is supplied through these command line arguments if Firefox is configured as the default URI handler for a given URI scheme in third party applications and these applications insufficiently sanitize URL data. Note: This issue only affects Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.

Record
CVE-2019-9794
Updated
2026-11-02
EUVDEUVD-2019-19156 No score

A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This could be used to retrieve and execute files whose location is supplied through these command line arguments if Firefox is configured as the default URI handler for a given URI scheme in third party applications and these applications insufficiently sanitize URL data. Note: This issue only affects Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.

Record
EUVD-2019-19156
Updated
2026-11-03
GitHub AdvisoriesGHSA-2cx8-vq8f-mwm5 9.8

A vulnerability was discovered where specific command line arguments are not properly discarded...

A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This could be used to retrieve and execute files whose location is supplied through these command line arguments if Firefox is configured as the default URI handler for a given URI scheme in third party applications and these applications insufficiently sanitize URL data. Note: This issue only affects Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.

Record
GHSA-2cx8-vq8f-mwm5
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20, CWE-88
Updated
2026-11-02
OSVALPINE-CVE-2019-9794 9.8

A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This could be used to retrieve and execute files whose location is supplied through these command line arguments if Firefox is configured as the default URI handler for a given URI scheme in third party applications and these applications insufficiently sanitize URL data. Note: This issue only affects Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.

Record
ALPINE-CVE-2019-9794
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVUBUNTU-CVE-2019-9794 9.8

A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This could be used to retrieve and execute files whose location is supplied through these command line arguments if Firefox is configured as the default URI handler for a given URI scheme in third party applications and these applications insufficiently sanitize URL data. Note: This issue only affects Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.

Record
UBUNTU-CVE-2019-9794
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVMGASA-2019-0129 No score

Updated thunderbird packages fix security vulnerability

Use-after-free when removing in-use DOM elements. (CVE-2019-9790)

Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey. (CVE-2019-9791)

IonMonkey leaks JS_OPTIMIZED_OUT magic value to script. (CVE-2019-9792)

Improper bounds checks when Spectre mitigations are disabled. (CVE-2019-9793)

Command line arguments not discarded during execution. (CVE-2019-9794)

Type-confusion in IonMonkey JIT compiler. (CVE-2019-9795)

Use-after-free with SMIL animation controller. (CVE-2019-9796)

Windows programs that are not 'URL Handlers' are exposed to web content. (CVE-2019-9801)

Proxy Auto-Configuration file can define localhost access to be proxied. (CVE-2018-18506)

Memory safety bugs fixed in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. (CVE-2019-9788)

IonMonkey MArraySlice has incorrect alias information. (CVE-2019-9810)

Ionmonkey type confusion with proto mutations. (CVE-2019-9813)

Record
MGASA-2019-0129
Updated
2026-11-02
OSVopenSUSE-SU-2019:1077-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Mozilla Firefox was updated to 60.6.1esr / MFSA 2019-10 (bsc#1130262)

  • CVE-2019-9810: IonMonkey MArraySlice has incorrect alias information
  • CVE-2019-9813: Ionmonkey type confusion with proto mutations

Mozilla Firefox was updated to 60.6.0esr / MFSA 2019-08 (boo#1129821)

  • CVE-2019-9790: Use-after-free when removing in-use DOM elements
  • CVE-2019-9791: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey
  • CVE-2019-9792: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script
  • CVE-2019-9793: Improper bounds checks when Spectre mitigations are disabled
  • CVE-2019-9794: Command line arguments not discarded during execution
  • CVE-2019-9795: Type-confusion in IonMonkey JIT compiler
  • CVE-2019-9796: Use-after-free with SMIL animation controller
  • CVE-2018-18506: Proxy Auto-Configuration file can define localhost access to be proxied
  • CVE-2019-9788: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6

Mozilla Firefox 60.5.2esr also had one change:

  • Fix a frequent crash when reading various Reuters news articles.
Record
openSUSE-SU-2019:1077-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:1126-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

Security issues fixed:

  • Update to MozillaThunderbird 60.6.1 (bsc#1130262):

  • CVE-2019-9813: Fixed Ionmonkey type confusion with proto mutations

  • CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information

  • Update to MozillaThunderbird 60.6 (bsc#1129821):

  • CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file

  • CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content

  • CVE-2019-9788: Fixed multiple memory safety bugs

  • CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements

  • CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement with IonMonkey

  • CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

  • CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled

  • CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution

  • CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler

  • CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller

Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-11/

Record
openSUSE-SU-2019:1126-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:1162-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird to version 60.5.1 fixes the following issues:

Security issues fixed:

  • Update to MozillaThunderbird 60.6.1 (bsc#1130262):

  • CVE-2019-9813: Fixed Ionmonkey type confusion with proto mutations

  • CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information

  • Update to MozillaThunderbird 60.6 (bsc#1129821):

  • CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file

  • CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content

  • CVE-2019-9788: Fixed multiple memory safety bugs

  • CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements

  • CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement with IonMonkey

  • CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

  • CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled

  • CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution

  • CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler

  • CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller

  • Update to MozillaThunderbird 60.5.1 (bsc#1125330):

  • CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library which can occur when creating a path, leading to a potentially exploitable crash.

  • CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library which can occur after specific transform operations, leading to a potentially exploitable crash.

  • CVE-2018-18335: Fixed a buffer overflow vulnerability in the Skia library which can occur with Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration in Firefox ESR. Note: this does not affect other versions and platforms where Canvas 2D acceleration is already disabled by default.

  • CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures showing mistakenly that emails bring a valid sugnature. Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-11/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/

Record
openSUSE-SU-2019:1162-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10600-1 No score

MozillaFirefox-92.0-1.2 on GA media

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10600-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02
OSVSUSE-SU-2019:0852-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Security issuess addressed:

  • update to Firefox ESR 60.6.1 (bsc#1130262):

  • CVE-2019-9813: Fixed Ionmonkey type confusion with proto mutations

  • CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information

  • Update to Firefox ESR 60.6 (bsc#1129821):

  • CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file

  • CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content

  • CVE-2019-9788: Fixed multiple memory safety bugs

  • CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements

  • CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement with IonMonkey

  • CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

  • CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled

  • CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution

  • CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler

  • CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller

  • Update to Firefox ESR 60.5.1 (bsc#1125330):

  • CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library which can occur when creating a path, leading to a potentially exploitable crash.

  • CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library which can occur after specific transform operations, leading to a potentially exploitable crash.

  • CVE-2018-18335: Fixed a buffer overflow vulnerability in the Skia library which can occur with Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration in Firefox ESR. Note: this does not affect other versions and platforms where Canvas 2D acceleration is already disabled by default.

Other issue addressed:

  • Fixed an issue with MozillaFirefox-translations-common which was causing error on update (bsc#1127987).

Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/ Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/

Record
SUSE-SU-2019:0852-1
Updated
2026-11-02
OSVSUSE-SU-2019:0853-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird to version 60.5.1 fixes the following issues:

Security issues fixed:

  • Update to MozillaThunderbird 60.6.1 (bsc#1130262):

  • CVE-2019-9813: Fixed Ionmonkey type confusion with proto mutations

  • CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information

  • Update to MozillaThunderbird 60.6 (bsc#1129821):

  • CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file

  • CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content

  • CVE-2019-9788: Fixed multiple memory safety bugs

  • CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements

  • CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement with IonMonkey

  • CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

  • CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled

  • CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution

  • CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler

  • CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller

  • Update to MozillaThunderbird 60.5.1 (bsc#1125330):

  • CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library which can occur when creating a path, leading to a potentially exploitable crash.

  • CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library which can occur after specific transform operations, leading to a potentially exploitable crash.

  • CVE-2018-18335: Fixed a buffer overflow vulnerability in the Skia library which can occur with Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration in Firefox ESR. Note: this does not affect other versions and platforms where Canvas 2D acceleration is already disabled by default.

  • CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures showing mistakenly that emails bring a valid sugnature. Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-11/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/

Record
SUSE-SU-2019:0853-1
Updated
2026-11-02
OSVSUSE-SU-2019:0871-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox to version ESR 60.6.1 fixes the following issues:

Security issuess addressed:

  • update to Firefox ESR 60.6.1 (bsc#1130262):

  • CVE-2019-9813: Fixed Ionmonkey type confusion with proto mutations

  • CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information

  • Update to Firefox ESR 60.6 (bsc#1129821):

  • CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file

  • CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content

  • CVE-2019-9788: Fixed multiple memory safety bugs

  • CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements

  • CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement with IonMonkey

  • CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

  • CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled

  • CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution

  • CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler

  • CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller

  • Update to Firefox ESR 60.5.1 (bsc#1125330):

  • CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library which can occur when creating a path, leading to a potentially exploitable crash.

  • CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library which can occur after specific transform operations, leading to a potentially exploitable crash.

  • CVE-2018-18335: Fixed a buffer overflow vulnerability in the Skia library which can occur with Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration in Firefox ESR. Note: this does not affect other versions and platforms where Canvas 2D acceleration is already disabled by default.

Other issue addressed:

  • Fixed an issue with MozillaFirefox-translations-common which was causing error on update (bsc#1127987).

Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/ Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/

Record
SUSE-SU-2019:0871-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firefox-esr
Alpine:v3.10
 before 60.6.1-r0
60.6.1-r0
firefox-esr
Alpine:v3.11
 before 60.6.1-r0
60.6.1-r0
firefox-esr
Alpine:v3.12
 before 60.6.1-r0
60.6.1-r0
firefox-esr
Alpine:v3.13
 before 60.6.1-r0
60.6.1-r0
firefox-esr
Alpine:v3.14
 before 60.6.1-r0
60.6.1-r0
firefox-esr
Alpine:v3.15
 before 60.6.1-r0
60.6.1-r0
firefox-esr
Alpine:v3.16
 before 60.6.1-r0
60.6.1-r0
firefox-esr
Alpine:v3.17
 before 60.6.1-r0
60.6.1-r0
firefox-esr
Alpine:v3.18
 before 60.6.1-r0
60.6.1-r0
firefox-esr
Alpine:v3.19
 before 60.6.1-r0
60.6.1-r0
Show 33 moreShow less
Affected packages
PackageAffectedFixed
firefox-esr
Alpine:v3.20
 before 60.6.1-r0
60.6.1-r0
firefox-esr
Alpine:v3.21
 before 60.6.1-r0
60.6.1-r0
firefox-esr
Alpine:v3.22
 before 60.6.1-r0
60.6.1-r0
firefox-esr
Alpine:v3.23
 before 60.6.1-r0
60.6.1-r0
firefox-esr
Alpine:v3.9
 before 60.6.1-r0
60.6.1-r0
thunderbird
Mageia:6
From an advisory covering 12 CVEs
 before 60.6.1-1.mga6
60.6.1-1.mga6
thunderbird-l10n
Mageia:6
From an advisory covering 12 CVEs
 before 60.6.1-1.mga6
60.6.1-1.mga6
MozillaFirefox
SUSE:OpenStack Cloud 7
From an advisory covering 15 CVEs
 before 60.6.1esr-109.63.2
60.6.1esr-109.63.2
MozillaFirefox
SUSE:Linux Enterprise Desktop 12 SP3
From an advisory covering 15 CVEs
 before 60.6.1esr-109.63.2
60.6.1esr-109.63.2
MozillaFirefox
SUSE:Linux Enterprise Desktop 12 SP4
From an advisory covering 15 CVEs
 before 60.6.1esr-109.63.2
60.6.1esr-109.63.2
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 15 CVEs
 before 60.6.1esr-109.63.2
60.6.1esr-109.63.2
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 15 CVEs
 before 60.6.1esr-109.63.2
60.6.1esr-109.63.2
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP3
From an advisory covering 15 CVEs
 before 60.6.1esr-109.63.2
60.6.1esr-109.63.2
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP4
From an advisory covering 15 CVEs
 before 60.6.1esr-109.63.2
60.6.1esr-109.63.2
MozillaFirefox
SUSE:Linux Enterprise Server 12-LTSS
From an advisory covering 15 CVEs
 before 60.6.1esr-109.63.2
60.6.1esr-109.63.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP1-LTSS
From an advisory covering 15 CVEs
 before 60.6.1esr-109.63.2
60.6.1esr-109.63.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 15 CVEs
 before 60.6.1esr-109.63.2
60.6.1esr-109.63.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 15 CVEs
 before 60.6.1esr-109.63.2
60.6.1esr-109.63.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3
From an advisory covering 15 CVEs
 before 60.6.1esr-109.63.2
60.6.1esr-109.63.2
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 15 CVEs
 before 60.6.1esr-109.63.2
60.6.1esr-109.63.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 15 CVEs
 before 60.6.1esr-109.63.2
60.6.1esr-109.63.2
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 15 CVEs
 before 60.6.1esr-109.63.2
60.6.1esr-109.63.2
MozillaFirefox
SUSE:Enterprise Storage 4
From an advisory covering 15 CVEs
 before 60.6.1esr-109.63.2
60.6.1esr-109.63.2
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15
From an advisory covering 16 CVEs
 before 60.6.1-3.28.1
60.6.1-3.28.1
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15
From an advisory covering 15 CVEs
 before 60.6.1-3.29.3
60.6.1-3.29.3
mozjs52
Ubuntu:18.04:LTS
 All versions, plus listed versions
52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1
 None known
mozjs38
Ubuntu:18.04:LTS
 All versions, plus listed versions
38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4
 None known
mozjs52
Ubuntu:20.04:LTS
 All versions, plus listed versions
52.9.1-1build152.9.1-1ubuntu3
 None known
MozillaFirefox
openSUSE:Leap 15.0
From an advisory covering 11 CVEs
 before 60.6.1-lp150.3.45.1
60.6.1-lp150.3.45.1
MozillaThunderbird
SUSE:Package Hub 12
From an advisory covering 13 CVEs
 before 60.6.1-82.1
60.6.1-82.1
MozillaThunderbird
openSUSE:Leap 15.0
From an advisory covering 16 CVEs
 before 60.6.1-lp150.3.37.1
60.6.1-lp150.3.37.1
MozillaFirefox
openSUSE:Tumbleweed
From an advisory covering 661 CVEs
 before 92.0-1.2
92.0-1.2
firefox-esr
openSUSE:Tumbleweed
From an advisory covering 1860 CVEs
 before 128.5.1-1.1
128.5.1-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-9794 is a critical vulnerability (CVSS 9.8) in Mozilla Firefox, published March 29, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.77%, the 78th percentile. Fixed in firefox-esr 60.6.1-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,691 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open