Every CVE Search/ Get API key

CVE-2019-11727

A vulnerability exists where it possible to force Network Security Services (NSS) to sign...

5.3 MediumFix available

A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

1.81%Down 0.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.3

A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

Record
CVE-2019-11727
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-295
Updated
2026-11-02
CVE List No score

A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

Record
CVE-2019-11727
Updated
2026-11-02
EUVDEUVD-2019-3397 No score

A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

Record
EUVD-2019-3397
Updated
2026-11-03
GitHub AdvisoriesGHSA-pwq5-w788-7w28 5.3

A vulnerability exists where it possible to force Network Security Services (NSS) to sign...

A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

Record
GHSA-pwq5-w788-7w28
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-295
Updated
2026-11-02
OSV 5.3

A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

Record
CVE-2019-11727
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2019-11727 5.3

A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

Record
DEBIAN-CVE-2019-11727
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 19 moreShow less
OSVRHSA-2019:1951 7.5

Red Hat Security Advisory: nss and nspr security, bug fix, and enhancement update

Record
RHSA-2019:1951
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2020:4076 8.1

Red Hat Security Advisory: nss and nspr security, bug fix, and enhancement update

Record
RHSA-2020:4076
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-11727 5.3

A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

Record
UBUNTU-CVE-2019-11727
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVMGASA-2019-0213 No score

Updated firefox packages fix security vulnerability

Sandbox escape via installation of malicious language pack. (CVE-2019-9811)

Script injection within domain through inner window reuse. (CVE-2019-11711)

Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects. (CVE-2019-11712)

Use-after-free with HTTP/2 cached stream. (CVE-2019-11713)

NeckoChild can trigger crash when accessed off of main thread. (CVE-2019-11714)

Empty or malformed p256-ECDH public keys may trigger a segmentation fault. (CVE-2019-11729)

HTML parsing error can contribute to content XSS. (CVE-2019-11715)

globalThis not enumerable until accessed. (CVE-2019-11716)

Caret character improperly escaped in origins. (CVE-2019-11717)

Activity Stream writes unsanitized content to innerHTML. (CVE-2019-11718)

Out-of-bounds read when importing curve25519 private key. (CVE-2019-11719)

Character encoding XSS vulnerability. (CVE-2019-11720)

Domain spoofing through unicode latin 'kra' character. (CVE-2019-11721)

Same-origin policy treats all files in a directory as having the same-origin. (CVE-2019-11730)

Cookie leakage during add-on fetching across private browsing boundaries. (CVE-2019-11723)

Retired site input.mozilla.org has remote troubleshooting permissions. (CVE-2019-11724)

Websocket resources bypass safebrowsing protections. (CVE-2019-11725)

PKCS#1 v1.5 signatures can be used for TLS 1.3. (CVE-2019-11727)

Port scanning through Alt-Svc header. (CVE-2019-11728)

Memory safety bugs fixed in Firefox 68. (CVE-2019-11710)

Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8. (CVE-2019-11709)

Record
MGASA-2019-0213
Updated
2026-11-02
OSVMGASA-2019-0272 No score

Updated thunderbird packages fix security vulnerabilities

This update provides an update to thunderbird 68.0, updates enigmail to 2.1.2 and fixes the following security issues:

Memory safety bugs fixed in Firefox 68, Firefox ESR 60.8, and Thunderbird 68. (CVE-2019-11709)

Memory safety bugs fixed in Firefox 68 and Thunderbird 68. (CVE-2019-11710)

Script injection within domain through inner window reuse. (CVE-2019-11711)

Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects. (CVE-2019-11712)

Use-after-free with HTTP/2 cached stream. (CVE-2019-11713)

NeckoChild can trigger crash when accessed off of main thread. (CVE-2019-11714)

HTML parsing error can contribute to content XSS. (CVE-2019-11715)

globalThis not enumerable until accessed. (CVE-2019-11716)

Caret character improperly escaped in origins. (CVE-2019-11717)

Out-of-bounds read when importing curve25519 private key. (CVE-2019-11719)

Character encoding XSS vulnerability. (CVE-2019-11720)

Domain spoofing through unicode latin 'kra' character. (CVE-2019-11721)

Cookie leakage during add-on fetching across private browsing boundaries. (CVE-2019-11723)

Retired site input.mozilla.org has remote troubleshooting permissions. (CVE-2019-11724)

Websocket resources bypass safebrowsing protections. (CVE-2019-11725)

PKCS#1 v1.5 signatures can be used for TLS 1.3. (CVE-2019-11727)

Port scanning through Alt-Svc header. (CVE-2019-11728)

Empty or malformed p256-ECDH public keys may trigger a segmentation fault. (CVE-2019-11729)

Same-origin policy treats all files in a directory as having the same-origin. (CVE-2019-11730)

NOTE! If your lightning calendar disappears with this update, see the referenced support.mozilla.org link in the advisories.

Record
MGASA-2019-0272
Updated
2026-11-02
OSVopenSUSE-SU-2019:2248-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird to version 68.1.1 fixes the following issues:

  • CVE-2019-11709: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11711: Fixed a script injection within domain through inner window reuse. (bsc#1140868)
  • CVE-2019-11712: Fixed an insufficient validation of cross-origin POST requests within NPAPI plugins. (bsc#1140868)
  • CVE-2019-11713: Fixed a use-after-free with HTTP/2 cached stream. (bsc#1140868)
  • CVE-2019-11714: Fixed a crash in NeckoChild. (bsc#1140868)
  • CVE-2019-11715: Fixed an HTML parsing error that can contribute to content XSS. (bsc#1140868)
  • CVE-2019-11716: Fixed an enumeration issue in globalThis. (bsc#1140868)
  • CVE-2019-11717: Fixed an improper escaping of the caret character in origins. (bsc#1140868)
  • CVE-2019-11719: Fixed an out-of-bounds read when importing curve25519 private key. (bsc#1140868)
  • CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
  • CVE-2019-11721: Fixed domain spoofing through unicode latin 'kra' character. (bsc#1140868)
  • CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
  • CVE-2019-11724: Fixed a permissions issue with the retired site input.mozilla.org. (bsc#1140868)
  • CVE-2019-11725: Fixed a SafeBrowsing bypass through WebSockets. (bsc#1140868)
  • CVE-2019-11727: Fixed an insufficient validation for PKCS#1 v1.5 signatures being used with TLS 1.3. (bsc#1140868)
  • CVE-2019-11728: Fixed port scanning through Alt-Svc header. (bsc#1140868)
  • CVE-2019-11729: Fixed a segmentation fault due to empty or malformed p256-ECDH public keys. (bsc#1140868)
  • CVE-2019-11730: Fixed an insufficient enforcement of the same-origin policy that treats all files in a directory as having the same-origin. (bsc#1140868)
  • CVE-2019-11739: Fixed a Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message. (bsc#1150939)
  • CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
  • CVE-2019-11742: Fixed a same-origin policy violation with SVG filters and canvas that enabled theft of cross-origin images. (bsc#1149303)
  • CVE-2019-11743: Fixed a cross-origin access issue. (bsc#1149298)
  • CVE-2019-11744: Fixed a XSS involving breaking out of title and textarea elements using innerHTML. (bsc#1149304)
  • CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
  • CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
  • CVE-2019-11755: Fixed an insufficient validation of S/MIME messages that allowed the author to be spoofed. (bsc#1152375)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2248-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2249-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird to version 68.1.1 fixes the following issues:

  • CVE-2019-11709: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11711: Fixed a script injection within domain through inner window reuse. (bsc#1140868)
  • CVE-2019-11712: Fixed an insufficient validation of cross-origin POST requests within NPAPI plugins. (bsc#1140868)
  • CVE-2019-11713: Fixed a use-after-free with HTTP/2 cached stream. (bsc#1140868)
  • CVE-2019-11714: Fixed a crash in NeckoChild. (bsc#1140868)
  • CVE-2019-11715: Fixed an HTML parsing error that can contribute to content XSS. (bsc#1140868)
  • CVE-2019-11716: Fixed an enumeration issue in globalThis. (bsc#1140868)
  • CVE-2019-11717: Fixed an improper escaping of the caret character in origins. (bsc#1140868)
  • CVE-2019-11719: Fixed an out-of-bounds read when importing curve25519 private key. (bsc#1140868)
  • CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
  • CVE-2019-11721: Fixed domain spoofing through unicode latin 'kra' character. (bsc#1140868)
  • CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
  • CVE-2019-11724: Fixed a permissions issue with the retired site input.mozilla.org. (bsc#1140868)
  • CVE-2019-11725: Fixed a SafeBrowsing bypass through WebSockets. (bsc#1140868)
  • CVE-2019-11727: Fixed an insufficient validation for PKCS#1 v1.5 signatures being used with TLS 1.3. (bsc#1140868)
  • CVE-2019-11728: Fixed port scanning through Alt-Svc header. (bsc#1140868)
  • CVE-2019-11729: Fixed a segmentation fault due to empty or malformed p256-ECDH public keys. (bsc#1140868)
  • CVE-2019-11730: Fixed an insufficient enforcement of the same-origin policy that treats all files in a directory as having the same-origin. (bsc#1140868)
  • CVE-2019-11739: Fixed a Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message. (bsc#1150939)
  • CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
  • CVE-2019-11742: Fixed a same-origin policy violation with SVG filters and canvas that enabled theft of cross-origin images. (bsc#1149303)
  • CVE-2019-11743: Fixed a cross-origin access issue. (bsc#1149298)
  • CVE-2019-11744: Fixed a XSS involving breaking out of title and textarea elements using innerHTML. (bsc#1149304)
  • CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
  • CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
  • CVE-2019-11755: Fixed an insufficient validation of S/MIME messages that allowed the author to be spoofed. (bsc#1152375)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2249-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2251-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox to 68.1 fixes the following issues:

Security issues fixed:

  • CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)
  • CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)
  • CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)
  • CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)
  • CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)
  • CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
  • CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868)
  • CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
  • CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868)
  • CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868)
  • CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322)
  • CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868)
  • CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665)
  • CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293)
  • CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292)
  • CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302)
  • CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
  • CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)
  • CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)
  • CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)
  • CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
  • CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
  • CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)

Non-security issues fixed:

  • Latest update now also released for s390x. (bsc#1109465)
  • Fixed a segmentation fault on s390vsl082. (bsc#1117473)
  • Fixed a crash on SLES15 s390x. (bsc#1124525)
  • Fixed a segmentation fault. (bsc#1133810)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2251-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2260-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox to 68.1 fixes the following issues:

Security issues fixed:

  • CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)
  • CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)
  • CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)
  • CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)
  • CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)
  • CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
  • CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868)
  • CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
  • CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868)
  • CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868)
  • CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322)
  • CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868)
  • CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665)
  • CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293)
  • CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292)
  • CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302)
  • CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
  • CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)
  • CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)
  • CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)
  • CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
  • CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
  • CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)

Non-security issues fixed:

  • Latest update now also released for s390x. (bsc#1109465)
  • Fixed a segmentation fault on s390vsl082. (bsc#1117473)
  • Fixed a crash on SLES15 s390x. (bsc#1124525)
  • Fixed a segmentation fault. (bsc#1133810)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2260-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10600-1 No score

MozillaFirefox-92.0-1.2 on GA media

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10600-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11058-1 No score

libfreebl3-3.69.1-1.2 on GA media

These are all security issues fixed in the libfreebl3-3.69.1-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11058-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02
OSVSUSE-SU-2019:14246-1 No score

Security update for Mozilla Firefox

This update contains the Mozilla Firefox ESR 68.2 release.

Mozilla Firefox was updated to ESR 68.2 release:

  • Enterprise: New administrative policies were added. More information and templates are available at the Policy Templates page.

  • Various security fixes: MFSA 2019-33 (bsc#1154738)

    • CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber
    • CVE-2019-11757: Use-after-free when creating index updates in IndexedDB
    • CVE-2019-11758: Potentially exploitable crash due to 360 Total Security
    • CVE-2019-11759: Stack buffer overflow in HKDF output
    • CVE-2019-11760: Stack buffer overflow in WebRTC networking
    • CVE-2019-11761: Unintended access to a privileged JSONView object
    • CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation
    • CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique
    • CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2

Other Issues resolved:

  • [bsc#1104841] Newer versions of firefox have a dependency on GLIBCXX_3.4.20
  • [bsc#1074235] MozillaFirefox: background tab crash reports sent inadvertently without user opt-in
  • [bsc#1043008] Firefox hangs randomly when browsing and scrolling
  • [bsc#1025108] Firefox stops loading page until mouse is moved
  • [bsc#905528] Firefox malfunctions due to broken omni.ja archives
Record
SUSE-SU-2019:14246-1
Updated
2026-11-02
OSVSUSE-SU-2019:2515-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird to version 68.1.1 fixes the following issues:

  • CVE-2019-11709: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11711: Fixed a script injection within domain through inner window reuse. (bsc#1140868)
  • CVE-2019-11712: Fixed an insufficient validation of cross-origin POST requests within NPAPI plugins. (bsc#1140868)
  • CVE-2019-11713: Fixed a use-after-free with HTTP/2 cached stream. (bsc#1140868)
  • CVE-2019-11714: Fixed a crash in NeckoChild. (bsc#1140868)
  • CVE-2019-11715: Fixed an HTML parsing error that can contribute to content XSS. (bsc#1140868)
  • CVE-2019-11716: Fixed an enumeration issue in globalThis. (bsc#1140868)
  • CVE-2019-11717: Fixed an improper escaping of the caret character in origins. (bsc#1140868)
  • CVE-2019-11719: Fixed an out-of-bounds read when importing curve25519 private key. (bsc#1140868)
  • CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
  • CVE-2019-11721: Fixed domain spoofing through unicode latin 'kra' character. (bsc#1140868)
  • CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
  • CVE-2019-11724: Fixed a permissions issue with the retired site input.mozilla.org. (bsc#1140868)
  • CVE-2019-11725: Fixed a SafeBrowsing bypass through WebSockets. (bsc#1140868)
  • CVE-2019-11727: Fixed an insufficient validation for PKCS#1 v1.5 signatures being used with TLS 1.3. (bsc#1140868)
  • CVE-2019-11728: Fixed port scanning through Alt-Svc header. (bsc#1140868)
  • CVE-2019-11729: Fixed a segmentation fault due to empty or malformed p256-ECDH public keys. (bsc#1140868)
  • CVE-2019-11730: Fixed an insufficient enforcement of the same-origin policy that treats all files in a directory as having the same-origin. (bsc#1140868)
  • CVE-2019-11739: Fixed a Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message. (bsc#1150939)
  • CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
  • CVE-2019-11742: Fixed a same-origin policy violation with SVG filters and canvas that enabled theft of cross-origin images. (bsc#1149303)
  • CVE-2019-11743: Fixed a cross-origin access issue. (bsc#1149298)
  • CVE-2019-11744: Fixed a XSS involving breaking out of title and textarea elements using innerHTML. (bsc#1149304)
  • CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
  • CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
  • CVE-2019-11755: Fixed an insufficient validation of S/MIME messages that allowed the author to be spoofed. (bsc#1152375)
Record
SUSE-SU-2019:2515-1
Updated
2026-11-02
OSVSUSE-SU-2019:2545-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox to 68.1 fixes the following issues:

Security issues fixed:

  • CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)
  • CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)
  • CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
  • CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)
  • CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)
  • CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)
  • CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
  • CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868)
  • CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
  • CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868)
  • CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868)
  • CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322)
  • CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868)
  • CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665)
  • CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293)
  • CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292)
  • CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302)
  • CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
  • CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)
  • CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)
  • CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)
  • CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
  • CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
  • CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)

Non-security issues fixed:

  • Latest update now also released for s390x. (bsc#1109465)
  • Fixed a segmentation fault on s390vsl082. (bsc#1117473)
  • Fixed a crash on SLES15 s390x. (bsc#1124525)
  • Fixed a segmentation fault. (bsc#1133810)
Record
SUSE-SU-2019:2545-1
Updated
2026-11-02
OSVSUSE-SU-2019:2620-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Updated to new ESR version 68.1 (bsc#1149323).

In addition to the already fixed vulnerabilities released in previous ESR updates, the following were also fixed: CVE-2019-11751, CVE-2019-11736, CVE-2019-9812, CVE-2019-11748, CVE-2019-11749, CVE-2019-11750, CVE-2019-11738, CVE-2019-11747, CVE-2019-11735.

Several run-time issues were also resolved (bsc#1117473, bsc#1124525, bsc#1133810).

The version displayed in Help > About is now correct (bsc#1087200).

Record
SUSE-SU-2019:2620-1
Updated
2026-11-02
OSVSUSE-SU-2020:14418-1 No score

Security update for mozilla-nspr, mozilla-nss

This update for mozilla-nspr, mozilla-nss fixes the following issues:

mozilla-nss was updated to version 3.53.1

  • CVE-2019-11745: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate
  • CVE-2020-12402: Fixed a potential side channel attack during RSA key generation (bsc#1173032).
  • CVE-2020-12399: Fixed a timing attack on DSA signature generation (bsc#1171978).
  • CVE-2019-17006: Added length checks for cryptographic primitives (bsc#1159819).
  • CVE-2019-11727: A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages.
  • Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony (bsc#1168669).
  • Fixed an issue where Firefox tab was crashing (bsc#1170908).

Release notes: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53_release_notes

mozilla-nspr was updated to version 4.25.

Record
SUSE-SU-2020:14418-1
Updated
2026-11-02
OSVUSN-4054-1 No score

firefox vulnerabilities

A sandbox escape was discovered in Firefox. If a user were tricked in to installing a malicious language pack, an attacker could exploit this to gain additional privileges. (CVE-2019-9811)

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass same origin restrictions, conduct cross-site scripting (XSS) attacks, conduct cross-site request forgery (CSRF) attacks, spoof origin attributes, spoof the addressbar contents, bypass safebrowsing protections, or execute arbitrary code. (CVE-2019-11709, CVE-2019-11710, CVE-2019-11711, CVE-2019-11712, CVE-2019-11713, CVE-2019-11714, CVE-2019-11715, CVE-2019-11716, CVE-2019-11717, CVE-2019-11718, CVE-2019-11719, CVE-2019-11720, CVE-2019-11721, CVE-2019-11723, CVE-2019-11724, CVE-2019-11725, CVE-2019-11727, CVE-2019-11728, CVE-2019-11729)

It was discovered that Firefox treats all files in a directory as same origin. If a user were tricked in to downloading a specially crafted HTML file, an attacker could potentially exploit this to obtain sensitive information from local files. (CVE-2019-11730)

Record
USN-4054-1
Updated
2026-11-02
OSVUSN-4060-1 No score

nss vulnerabilities

Henry Corrigan-Gibbs discovered that NSS incorrectly handled importing certain curve25519 private keys. An attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2019-11719)

Hubert Kario discovered that NSS incorrectly handled PKCS#1 v1.5 signatures when using TLSv1.3. An attacker could possibly use this issue to trick NSS into using PKCS#1 v1.5 signatures, contrary to expectations. This issue only applied to Ubuntu 19.04. (CVE-2019-11727)

Jonas Allmann discovered that NSS incorrectly handled certain p256-ECDH public keys. An attacker could possibly use this issue to cause NSS to crash, resulting in a denial of service. (CVE-2019-11729)

Record
USN-4060-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nss
Debian:12
 before 2:3.45-1
2:3.45-1
nss
Debian:13
 before 2:3.45-1
2:3.45-1
nss
Debian:14
 before 2:3.45-1
2:3.45-1
firefox
Mageia:7
 before 68.0-1.1.mga7
68.0-1.1.mga7
firefox-l10n
Mageia:7
 before 68.0-1.mga7
68.0-1.mga7
nss
Mageia:7
 before 3.45.0-1.mga7
3.45.0-1.mga7
rootcerts
Mageia:7
 before 20190604.00-1.mga7
20190604.00-1.mga7
thunderbird
Mageia:7
 before 68.0-1.3.mga7
68.0-1.3.mga7
thunderbird-l10n
Mageia:7
 before 68.0-1.mga7
68.0-1.mga7
nspr
Red Hat:enterprise_linux:8::appstream
 before 0:4.21.0-2.el8_0
0:4.21.0-2.el8_0
Show 159 moreShow less
Affected packages
PackageAffectedFixed
nspr-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:4.21.0-2.el8_0
0:4.21.0-2.el8_0
nspr-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:4.21.0-2.el8_0
0:4.21.0-2.el8_0
nspr-devel
Red Hat:enterprise_linux:8::appstream
 before 0:4.21.0-2.el8_0
0:4.21.0-2.el8_0
nss
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-devel
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-softokn
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-softokn-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-softokn-devel
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-softokn-freebl
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-softokn-freebl-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-softokn-freebl-devel
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-sysinit
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-sysinit-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-tools
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-tools-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-util
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-util-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-util-devel
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nspr
Red Hat:enterprise_linux:7::client
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nspr-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nss
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-softokn
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-freebl
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-sysinit
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-tools
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-util
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nss-util-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nspr-devel
Red Hat:enterprise_linux:7::client
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nss-devel
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-pkcs11-devel
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-softokn-devel
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-freebl-devel
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-util-devel
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nspr-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nspr-devel
Red Hat:enterprise_linux:7::computenode
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nss-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-devel
Red Hat:enterprise_linux:7::computenode
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-pkcs11-devel
Red Hat:enterprise_linux:7::computenode
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-softokn-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-devel
Red Hat:enterprise_linux:7::computenode
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-freebl-devel
Red Hat:enterprise_linux:7::computenode
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-util-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nss-util-devel
Red Hat:enterprise_linux:7::computenode
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nspr
Red Hat:enterprise_linux:7::server
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nspr-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nspr-devel
Red Hat:enterprise_linux:7::server
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nss
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-devel
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-softokn
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-devel
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-freebl
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-freebl-devel
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-sysinit
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-tools
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-util
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nss-util-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nss-util-devel
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nss-pkcs11-devel
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nspr
Red Hat:enterprise_linux:7::workstation
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nspr-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nspr-devel
Red Hat:enterprise_linux:7::workstation
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nss
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-devel
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-softokn
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-devel
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-freebl
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-freebl-devel
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-sysinit
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-tools
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-util
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nss-util-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nss-util-devel
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nss-pkcs11-devel
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 68.2.0-78.51.4
68.2.0-78.51.4
MozillaFirefox-branding-SLED
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 68-21.9.8
68-21.9.8
firefox-atk
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 2.26.1-2.8.4
2.26.1-2.8.4
firefox-cairo
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 1.15.10-2.13.4
1.15.10-2.13.4
firefox-gdk-pixbuf
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 2.36.11-2.8.4
2.36.11-2.8.4
firefox-glib2
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 2.54.3-2.14.7
2.54.3-2.14.7
firefox-gtk3
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 3.10.9-2.15.3
3.10.9-2.15.3
firefox-harfbuzz
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 1.7.5-2.7.4
1.7.5-2.7.4
firefox-libffi
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 3.2.1.git259-2.3.3
3.2.1.git259-2.3.3
firefox-libffi-gcc5
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 5.3.1+r233831-14.1
5.3.1+r233831-14.1
firefox-pango
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 1.40.14-2.7.4
1.40.14-2.7.4
mozilla-nspr
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 4.21-29.6.1
4.21-29.6.1
mozilla-nss
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 3.45-38.9.3
3.45-38.9.3
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15
 before 68.1.1-3.51.1
68.1.1-3.51.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP1
 before 68.1.1-3.51.1
68.1.1-3.51.1
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15
 before 68.1.0-3.54.2
68.1.0-3.54.2
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Module for Desktop Applications 15
 before 68-4.8.5
68-4.8.5
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
 before 68.1.0-3.54.2
68.1.0-3.54.2
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
 before 68-4.8.5
68-4.8.5
MozillaFirefox
SUSE:HPE Helion OpenStack 8
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:HPE Helion OpenStack 8
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:OpenStack Cloud 7
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:OpenStack Cloud 7
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:OpenStack Cloud 8
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:OpenStack Cloud 8
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:OpenStack Cloud Crowbar 8
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:OpenStack Cloud Crowbar 8
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Desktop 12 SP4
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Desktop 12 SP4
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP1-LTSS
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP1-LTSS
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-LTSS
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP2-LTSS
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP4
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP4
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP5
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP5
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Enterprise Storage 4
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Enterprise Storage 4
 before 68-32.8.1
68-32.8.1
MozillaFirefox
SUSE:Enterprise Storage 5
 before 68.1.0-109.89.1
68.1.0-109.89.1
MozillaFirefox-branding-SLE
SUSE:Enterprise Storage 5
 before 68-32.8.1
68-32.8.1
mozilla-nspr
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 4.25-29.12.2
4.25-29.12.2
mozilla-nss
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 3.53.1-38.23.1
3.53.1-38.23.1
firefox
Ubuntu:16.04:LTS
 before 68.0+build3-0ubuntu0.16.04.1, plus listed versions
41.0.2+build2-0ubuntu142.0+build2-0ubuntu144.0+build3-0ubuntu244.0.1+build1-0ubuntu144.0.2+build1-0ubuntu1
Show 45 moreShow less
45.0+build2-0ubuntu145.0.1+build1-0ubuntu145.0.2+build1-0ubuntu146.0+build5-0ubuntu0.16.04.246.0.1+build1-0ubuntu0.16.04.247.0+build3-0ubuntu0.16.04.148.0+build2-0ubuntu0.16.04.149.0+build4-0ubuntu0.16.04.149.0.2+build2-0ubuntu0.16.04.250.0+build2-0ubuntu0.16.04.250.0.2+build1-0ubuntu0.16.04.150.1.0+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.252.0+build2-0ubuntu0.16.04.152.0.1+build2-0ubuntu0.16.04.152.0.2+build1-0ubuntu0.16.04.153.0+build6-0ubuntu0.16.04.153.0.2+build1-0ubuntu0.16.04.253.0.3+build1-0ubuntu0.16.04.254.0+build3-0ubuntu0.16.04.155.0.1+build2-0ubuntu0.16.04.255.0.2+build1-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.257.0+build4-0ubuntu0.16.04.557.0+build4-0ubuntu0.16.04.657.0.1+build2-0ubuntu0.16.04.157.0.3+build1-0ubuntu0.16.04.157.0.4+build1-0ubuntu0.16.04.158.0+build6-0ubuntu0.16.04.158.0.1+build1-0ubuntu0.16.04.158.0.2+build1-0ubuntu0.16.04.159.0+build5-0ubuntu0.16.04.159.0.1+build1-0ubuntu0.16.04.159.0.2+build1-0ubuntu0.16.04.159.0.2+build1-0ubuntu0.16.04.360.0+build2-0ubuntu0.16.04.160.0.1+build2-0ubuntu0.16.04.160.0.2+build1-0ubuntu0.16.04.161.0+build3-0ubuntu0.16.04.261.0.1+build1-0ubuntu0.16.04.162.0+build2-0ubuntu0.16.04.362.0+build2-0ubuntu0.16.04.462.0+build2-0ubuntu0.16.04.5
68.0+build3-0ubuntu0.16.04.1
thunderbird
Ubuntu:16.04:LTS
 before 1:68.7.0+build1-0ubuntu0.16.04.2, plus listed versions
1:38.3.0+build1-0ubuntu21:38.5.1+build2-0ubuntu11:38.6.0+build1-0ubuntu11:38.7.2+build1-0ubuntu0.16.04.11:38.8.0+build1-0ubuntu0.16.04.1
Show 25 moreShow less
1:45.2.0+build1-0ubuntu0.16.04.11:45.3.0+build1-0ubuntu0.16.04.21:45.4.0+build1-0ubuntu0.16.04.11:45.5.1+build1-0ubuntu0.16.04.11:45.7.0+build1-0ubuntu0.16.04.11:45.8.0+build1-0ubuntu0.16.04.11:52.1.1+build1-0ubuntu0.16.04.11:52.2.1+build1-0ubuntu0.16.04.11:52.3.0+build1-0ubuntu0.16.04.11:52.4.0+build1-0ubuntu0.16.04.21:52.5.0+build1-0ubuntu0.16.04.11:52.6.0+build1-0ubuntu0.16.04.11:52.7.0+build1-0ubuntu0.16.04.11:52.8.0+build1-0ubuntu0.16.04.11:52.9.1+build3-0ubuntu0.16.04.11:60.2.1+build1-0ubuntu0.16.04.41:60.4.0+build2-0ubuntu0.16.04.11:60.5.1+build2-0ubuntu0.16.04.11:60.6.1+build2-0ubuntu0.16.04.11:60.7.0+build1-0ubuntu0.16.04.11:60.7.1+build1-0ubuntu0.16.04.11:60.7.2+build2-0ubuntu0.16.04.11:60.8.0+build1-0ubuntu0.16.04.21:60.9.0+build1-0ubuntu0.16.04.21:60.9.1+build1-0ubuntu0.16.04.1
1:68.7.0+build1-0ubuntu0.16.04.2
firefox
Ubuntu:18.04:LTS
 before 68.0+build3-0ubuntu0.18.04.1, plus listed versions
56.0+build6-0ubuntu157.0.1+build2-0ubuntu159.0.1+build1-0ubuntu159.0.2+build1-0ubuntu160.0+build2-0ubuntu1
Show 24 moreShow less
60.0.1+build2-0ubuntu0.18.04.160.0.2+build1-0ubuntu0.18.04.161.0+build3-0ubuntu0.18.04.161.0.1+build1-0ubuntu0.18.04.162.0+build2-0ubuntu0.18.04.362.0+build2-0ubuntu0.18.04.462.0+build2-0ubuntu0.18.04.562.0.3+build1-0ubuntu0.18.04.163.0+build2-0ubuntu0.18.04.263.0.3+build1-0ubuntu0.18.04.164.0+build3-0ubuntu0.18.04.165.0+build2-0ubuntu0.18.04.165.0.1+build2-0ubuntu0.18.04.166.0+build3-0ubuntu0.18.04.166.0.1+build1-0ubuntu0.18.04.166.0.2+build1-0ubuntu0.18.04.166.0.3+build1-0ubuntu0.18.04.166.0.4+build3-0ubuntu0.18.04.166.0.5+build1-0ubuntu0.18.04.167.0+build2-0ubuntu0.18.04.167.0.1+build1-0ubuntu0.18.04.167.0.2+build2-0ubuntu0.18.04.167.0.3+build1-0ubuntu0.18.04.167.0.4+build1-0ubuntu0.18.04.1
68.0+build3-0ubuntu0.18.04.1
mozjs52
Ubuntu:18.04:LTS
 All versions, plus listed versions
52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1
 None known
mozjs38
Ubuntu:18.04:LTS
 All versions, plus listed versions
38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4
 None known
mozjs52
Ubuntu:20.04:LTS
 All versions, plus listed versions
52.9.1-1build152.9.1-1ubuntu3
 None known
nss
Ubuntu:16.04:LTS
 before 2:3.28.4-0ubuntu0.16.04.6, plus listed versions
2:3.19.2-1ubuntu12:3.19.2.1-0ubuntu12:3.21-1ubuntu22:3.21-1ubuntu32:3.21-1ubuntu4
Show 7 moreShow less
2:3.23-0ubuntu0.16.04.12:3.26.2-0ubuntu0.16.04.22:3.28.4-0ubuntu0.16.04.12:3.28.4-0ubuntu0.16.04.22:3.28.4-0ubuntu0.16.04.32:3.28.4-0ubuntu0.16.04.42:3.28.4-0ubuntu0.16.04.5
2:3.28.4-0ubuntu0.16.04.6
nss
Ubuntu:18.04:LTS
 before 2:3.35-2ubuntu2.3, plus listed versions
2:3.32-1ubuntu32:3.34-1ubuntu12:3.35-2ubuntu22:3.35-2ubuntu2.12:3.35-2ubuntu2.2
2:3.35-2ubuntu2.3
MozillaThunderbird
openSUSE:Leap 15.0
 before 68.1.1-lp150.3.51.1
68.1.1-lp150.3.51.1
enigmail
openSUSE:Leap 15.0
 before 2.1.2-lp150.34.1
2.1.2-lp150.34.1
MozillaThunderbird
openSUSE:Leap 15.1
 before 68.1.1-lp151.2.13.1
68.1.1-lp151.2.13.1
enigmail
openSUSE:Leap 15.1
 before 2.1.2-lp151.2.6.1
2.1.2-lp151.2.6.1
MozillaFirefox
openSUSE:Leap 15.1
 before 68.1.0-lp151.2.14.1
68.1.0-lp151.2.14.1
MozillaFirefox
openSUSE:Leap 15.0
 before 68.1.0-lp150.3.66.1
68.1.0-lp150.3.66.1
MozillaFirefox
openSUSE:Tumbleweed
 before 92.0-1.2
92.0-1.2
mozilla-nss
openSUSE:Tumbleweed
 before 3.69.1-1.2
3.69.1-1.2
firefox-esr
openSUSE:Tumbleweed
 before 128.5.1-1.1
128.5.1-1.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-11727 is a medium vulnerability (CVSS 5.3) in Mozilla Firefox, published July 11, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.81%, the 78th percentile. Fixed in nss 2:3.45-1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 17 versions and 2,012 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open