Every CVE Search/ Get API key

CVE-2018-18511

Cross-origin images can be read from a canvas element in violation of the same-origin policy...

4.3 MediumFix available

CVE-2018-18511 is a medium vulnerability (CVSS 4.3) in Mozilla Firefox, published December 31, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.62%, the 76th percentile. Fixed in firefox-esr 60.7.0esr-1.

Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. Note: This only affects Firefox 65. Previous versions are unaffected.. This vulnerability affects Firefox < 65.0.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

1.62%Down 2.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 4.3

Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. Note: This only affects Firefox 65. Previous versions are unaffected.. This vulnerability affects Firefox < 65.0.1.

Record
CVE-2018-18511
CVSS 3.0
4.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. Note: This only affects Firefox 65. Previous versions are unaffected.. This vulnerability affects Firefox < 65.0.1.

Record
CVE-2018-18511
Updated
2026-11-02
EUVDEUVD-2018-10236 No score

Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. Note: This only affects Firefox 65. Previous versions are unaffected.. This vulnerability affects Firefox < 65.0.1.

Record
EUVD-2018-10236
Updated
2026-11-03
GitHub AdvisoriesGHSA-pp2c-fw86-vf75 4.3

Cross-origin images can be read from a canvas element in violation of the same-origin policy...

Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. Note: This only affects Firefox 65. Previous versions are unaffected.. This vulnerability affects Firefox < 65.0.1.

Record
GHSA-pp2c-fw86-vf75
CVSS 3.0
4.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV 4.3

Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. Note: This only affects Firefox 65. Previous versions are unaffected.. This vulnerability affects Firefox < 65.0.1.

Record
CVE-2018-18511
CVSS 3.0
4.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2018-18511 4.3

Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. Note: This only affects Firefox 65. Previous versions are unaffected.. This vulnerability affects Firefox < 65.0.1.

Record
DEBIAN-CVE-2018-18511
CVSS 3.0
4.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-02
Show 17 moreShow less
OSVRHSA-2019:1265 9.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2019:1265
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:1267 9.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2019:1267
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:1269 9.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2019:1269
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:1308 9.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2019:1308
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:1309 9.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2019:1309
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:1310 9.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2019:1310
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-18511 4.3

Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. Note: This only affects Firefox 65. Previous versions are unaffected.. This vulnerability affects Firefox < 65.0.1.

Record
UBUNTU-CVE-2018-18511
CVSS 3.0
4.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVMGASA-2019-0190 No score

Updated thunderbird packages fix security vulnerabilities

Updated thunderbird packages fixes bugs and security vulnerabilities:

Cross-origin theft of images with ImageBitmapRenderingContext. (CVE-2018-18511)

Out-of-bounds read in Skia. (CVE-2019-5798)

Use-after-free in png_image_free of libpng library. (CVE-2019-7317)

Cross-origin theft of images with createImageBitmap. (CVE-2019-9797)

Memory safety bugs fixed in Thunderbird 60.7. (CVE-2019-9800)

Type confusion with object groups and UnboxedObjects. (CVE-2019-9816)

Stealing of cross-domain images using canvas. (CVE-2019-9817)

Use-after-free in crash generation server. (CVE-2019-9818)

Compartment mismatch with fetch API. (CVE-2019-9819)

Use-after-free of ChromeEventHandler by DocShell. (CVE-2019-9820)

Use-after-free in XMLHttpRequest. (CVE-2019-11691)

Use-after-free removing listeners in the event listener manager. (CVE-2019-11692)

Buffer overflow in WebGL bufferdata on Linux. (CVE-2019-11693)

Theft of user history data through drag and drop of hyperlinks to and from bookmarks. (CVE-2019-11698)

Inline-PGP messages that allows an attacker to have Enigmail display a correctly signed or encrypted message info, but display a different unauthenticated text.

Record
MGASA-2019-0190
Updated
2026-11-02
OSVMGASA-2019-0191 No score

Updated firefox packages fix security vulnerabilities

Updated firefox packages fix security vulnerabilities.

Cross-origin theft of images with ImageBitmapRenderingContext. (CVE-2018-18511)

Out-of-bounds read in Skia. (CVE-2019-5798)

Use-after-free in png_image_free of libpng library. (CVE-2019-7317)

Cross-origin theft of images with createImageBitmap. (CVE-2019-9797)

Memory safety bugs fixed in Firefox 67, Firefox ESR 60.7, and firefox 60.7. (CVE-2019-9800)

Type confusion with object groups and UnboxedObjects. (CVE-2019-9816)

Stealing of cross-domain images using canvas. (CVE-2019-9817)

Use-after-free in crash generation server. (CVE-2019-9818)

Compartment mismatch with fetch API. (CVE-2019-9819)

Use-after-free of ChromeEventHandler by DocShell. (CVE-2019-9820)

Use-after-free in XMLHttpRequest. (CVE-2019-11691)

Use-after-free removing listeners in the event listener manager. (CVE-2019-11692)

Buffer overflow in WebGL bufferdata on Linux. (CVE-2019-11693)

Theft of user history data through drag and drop of hyperlinks to and from bookmarks. (CVE-2019-11698)

Record
MGASA-2019-0191
Updated
2026-11-02
OSVopenSUSE-SU-2019:1534-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

MozillaFirefox was updated to 60.7.0esr (boo#1135824 MFSA 2019-14):

  • CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext
  • CVE-2019-11691: Use-after-free in XMLHttpRequest
  • CVE-2019-11692: Use-after-free removing listeners in the event listener manager
  • CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux
  • CVE-2019-11694: (Windows only) Uninitialized memory memory leakage in Windows sandbox
  • CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks
  • CVE-2019-5798: Out-of-bounds read in Skia
  • CVE-2019-7317: Use-after-free in png_image_free of libpng library
  • CVE-2019-9797: Cross-origin theft of images with createImageBitmap
  • CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7
  • CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS
  • CVE-2019-9816: Type confusion with object groups and UnboxedObjects
  • CVE-2019-9817: Stealing of cross-domain images using canvas
  • CVE-2019-9818: (Windows only) Use-after-free in crash generation server
  • CVE-2019-9819: Compartment mismatch with fetch API
  • CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell
  • CVE-2019-9821: Use-after-free in AssertWorkerThread
Record
openSUSE-SU-2019:1534-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:1664-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

Mozilla Thunderbird was updated to 60.7.2 / MFSA 2019-20 (boo#1138872):

  • CVE-2019-11707: Type confusion in Array.pop
  • CVE-2019-11708: sandbox escape using Prompt:Open

Mozilla Thunderbird was updated to 60.7.1 / MFSA 2019-17 (boo#1137595):

  • CVE-2019-11703: Heap buffer overflow in icalparser.c
  • CVE-2019-11704: Heap buffer overflow in icalvalue.c
  • CVE-2019-11705: Stack buffer overflow in icalrecur.c
  • CVE-2019-11706: Type confusion in icalproperty.c

Also fixed: No prompt for smartcard PIN when S/MIME signing is used

Mozilla Thunderbird was updated to 60.7.0 / MFSA 2019-15 (boo#1135824):

  • Attachment pane of Write window no longer focussed when attaching files using a keyboard shortcut

  • CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS

  • CVE-2019-9816: Type confusion with object groups and UnboxedObjects

  • CVE-2019-9817: Stealing of cross-domain images using canvas

  • CVE-2019-9818 (Windows only): Use-after-free in crash generation server

  • CVE-2019-9819: Compartment mismatch with fetch API

  • CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell

  • CVE-2019-11691: Use-after-free in XMLHttpRequest

  • CVE-2019-11692: Use-after-free removing listeners in the event listener manager

  • CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux

  • CVE-2019-7317: Use-after-free in png_image_free of libpng library

  • CVE-2019-9797: Cross-origin theft of images with createImageBitmap

  • CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext

  • CVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox

  • CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks

  • CVE-2019-5798: Out-of-bounds read in Skia

  • CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7

  • Disable building with LTO (boo#1133267).
Record
openSUSE-SU-2019:1664-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10600-1 No score

MozillaFirefox-92.0-1.2 on GA media

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10600-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10601-1 No score

MozillaThunderbird-91.1.1-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10601-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02
OSVSUSE-SU-2019:1458-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

Mozilla Thunderbird was updated to 60.7.0.

  • Attachment pane of Write window no longer focussed when attaching files using a keyboard shortcut

These security issues were fixed (MFSA 2019-15 bsc#1135824):

  • CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS
  • CVE-2019-9816: Type confusion with object groups and UnboxedObjects
  • CVE-2019-9817: Stealing of cross-domain images using canvas
  • CVE-2019-9818: Use-after-free in crash generation server
  • CVE-2019-9819: Compartment mismatch with fetch API
  • CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell
  • CVE-2019-11691: Use-after-free in XMLHttpRequest
  • CVE-2019-11692: Use-after-free removing listeners in the event listener manager
  • CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux
  • CVE-2019-7317: Use-after-free in png_image_free of libpng library
  • CVE-2019-9797: Cross-origin theft of images with createImageBitmap
  • CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext
  • CVE-2019-11694: (Windows only) Uninitialized memory memory leakage in Windows sandbox
  • CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks
  • CVE-2019-5798: Out-of-bounds read in Skia
  • CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7
Record
SUSE-SU-2019:1458-1
Updated
2026-11-02
OSVUSN-3896-1 No score

firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, bypass same origin protections, or execute arbitrary code.

Record
USN-3896-1
Updated
2026-11-02
OSVUSN-3997-1 No score

thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass same-origin protections, or execute arbitrary code. (CVE-2019-18511, CVE-2019-11691, CVE-2019-11692, CVE-2019-11693, CVE-2019-9797, CVE-2019-9800, CVE-2019-9817, CVE-2019-9819, CVE-2019-9820)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service, or execute arbitrary code. (CVE-2019-5798, CVE-2019-7317)

A type confusion bug was discovered with object groups and UnboxedObjects. If a user were tricked in to opening a specially crafted website in a browsing context after enabling the UnboxedObjects feature, an attacker could potentially exploit this to bypass security checks. (CVE-2019-9816)

It was discovered that history data could be exposed via drag and drop of hyperlinks to and from bookmarks. If a user were tricked in to dragging a specially crafted hyperlink to a bookmark toolbar or sidebar, and subsequently back in to the web content area, an attacker could potentially exploit this to obtain sensitive information. (CVE-2019-11698)

Record
USN-3997-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firefox-esr
Debian:12
 before 60.7.0esr-1
60.7.0esr-1
firefox-esr
Debian:13
 before 60.7.0esr-1
60.7.0esr-1
firefox-esr
Debian:14
 before 60.7.0esr-1
60.7.0esr-1
thunderbird
Debian:12
 before 1:60.7.0-1
1:60.7.0-1
thunderbird
Debian:13
 before 1:60.7.0-1
1:60.7.0-1
thunderbird
Debian:14
 before 1:60.7.0-1
1:60.7.0-1
firefox-esr
Debian:8
 before 60.7.0esr-1~deb8u1, plus listed versions
45.0.1esr-145.0.2esr-145.0esr-145.0esr-245.1.0esr-1
Show 45 moreShow less
45.1.1esr-145.2.0esr-145.2.0esr-1~deb7u145.2.0esr-1~deb8u145.3.0esr-145.3.0esr-1~deb7u145.3.0esr-1~deb8u145.3.0esr-245.4.0esr-145.4.0esr-1~deb7u145.4.0esr-1~deb7u245.4.0esr-1~deb8u145.4.0esr-1~deb8u245.4.0esr-245.5.0esr-145.5.0esr-1~deb8u145.5.1esr-145.5.1esr-1~deb7u145.5.1esr-1~deb8u145.6.0esr-145.6.0esr-1~deb7u145.6.0esr-1~deb8u145.7.0esr-145.7.0esr-1~deb7u145.7.0esr-1~deb8u145.7.0esr-245.7.0esr-345.7.0esr-445.8.0esr-145.8.0esr-1~deb7u145.8.0esr-1~deb8u145.9.0esr-145.9.0esr-1~deb7u145.9.0esr-1~deb8u152.0.1esr-152.0.2esr-152.0esr-152.1.0esr-152.2.0esr-152.2.0esr-1~deb7u152.2.0esr-1~deb8u152.2.0esr-1~deb9u152.2.0esr-252.3.0esr-152.3.0esr-1~deb7u1
60.7.0esr-1~deb8u1
thunderbird
Debian:8
 before 1:60.7.0-1~deb8u1, plus listed versions
1.5-41.5.0.2-11.5.0.2-21.5.0.2-31.5.0.4-1
Show 45 moreShow less
1.5.0.4-21.5.0.4-31.5.0.5-11.5.0.7-11.5.0.7-21:52.4.0-11:52.4.0-1~deb7u11:52.4.0-1~deb8u11:52.4.0-1~deb9u11:52.4.0-2~exp11:52.5.0-11:52.5.0-1~deb7u11:52.5.0-1~deb8u11:52.5.0-1~deb9u11:52.5.2-11:52.5.2-1~deb7u11:52.5.2-21:52.5.2-2~deb8u11:52.5.2-2~deb9u11:52.6.0-11:52.6.0-1+alpha.11:52.6.0-1+alpha.21:52.6.0-1~deb7u11:52.6.0-1~deb8u11:52.6.0-1~deb9u11:52.7.0-11:52.7.0-1~deb7u11:52.7.0-1~deb8u11:52.7.0-1~deb9u11:52.8.0-11:52.8.0-1~deb7u11:52.8.0-1~deb8u11:52.8.0-1~deb9u11:52.9.0-11:52.9.1-11:52.9.1-1~deb8u11:52.9.1-1~deb9u11:58.0~b3-11:60.0-11:60.0-21:60.0-2~deb9u11:60.0-31:60.0-3~deb9u11:60.0~b10-11:60.0~b2-1
1:60.7.0-1~deb8u1
firefox-esr
Debian:9
 before 60.7.0esr-1~deb9u1, plus listed versions
45.9.0esr-152.0.1esr-152.0.2esr-152.0esr-152.1.0esr-1
Show 45 moreShow less
52.2.0esr-152.2.0esr-1~deb7u152.2.0esr-1~deb8u152.2.0esr-1~deb9u152.2.0esr-252.3.0esr-152.3.0esr-1~deb7u152.3.0esr-1~deb8u152.3.0esr-1~deb8u252.3.0esr-1~deb9u152.3.0esr-252.4.0esr-1~deb8u152.4.0esr-1~deb9u152.4.0esr-252.4.0esr-2~deb7u152.5.0esr-152.5.0esr-1~deb7u152.5.0esr-1~deb8u152.5.0esr-1~deb9u152.5.2esr-152.5.2esr-1~deb7u152.5.2esr-1~deb8u152.5.2esr-1~deb9u152.5.3esr-152.6.0esr-152.6.0esr-1~deb7u152.6.0esr-1~deb8u152.6.0esr-1~deb9u152.6.0esr-252.6.0esr-2+alpha.152.6.0esr-2+alpha.252.7.0esr-152.7.0esr-1~deb8u152.7.0esr-1~deb9u152.7.1esr-152.7.1esr-1~deb7u152.7.1esr-1~deb8u152.7.1esr-1~deb9u152.7.2esr-152.7.2esr-1~deb7u152.7.2esr-1~deb8u152.7.2esr-1~deb9u152.7.3esr-152.7.3esr-1~deb7u152.7.3esr-1~deb8u1
60.7.0esr-1~deb9u1
thunderbird
Debian:9
 before 1:60.7.0-1~deb9u1, plus listed versions
1.5-41.5.0.2-11.5.0.2-21.5.0.2-31.5.0.4-1
Show 45 moreShow less
1.5.0.4-21.5.0.4-31.5.0.5-11.5.0.7-11.5.0.7-21:52.4.0-11:52.4.0-1~deb7u11:52.4.0-1~deb8u11:52.4.0-1~deb9u11:52.4.0-2~exp11:52.5.0-11:52.5.0-1~deb7u11:52.5.0-1~deb8u11:52.5.0-1~deb9u11:52.5.2-11:52.5.2-1~deb7u11:52.5.2-21:52.5.2-2~deb8u11:52.5.2-2~deb9u11:52.6.0-11:52.6.0-1+alpha.11:52.6.0-1+alpha.21:52.6.0-1~deb7u11:52.6.0-1~deb8u11:52.6.0-1~deb9u11:52.7.0-11:52.7.0-1~deb7u11:52.7.0-1~deb8u11:52.7.0-1~deb9u11:52.8.0-11:52.8.0-1~deb7u11:52.8.0-1~deb8u11:52.8.0-1~deb9u11:52.9.0-11:52.9.1-11:52.9.1-1~deb8u11:52.9.1-1~deb9u11:58.0~b3-11:60.0-11:60.0-21:60.0-2~deb9u11:60.0-31:60.0-3~deb9u11:60.0~b10-11:60.0~b2-1
1:60.7.0-1~deb9u1
Show 51 moreShow less
Affected packages
PackageAffectedFixed
thunderbird
Mageia:6
 before 60.7.0-1.mga6
60.7.0-1.mga6
thunderbird-l10n
Mageia:6
 before 60.7.0-1.mga6
60.7.0-1.mga6
firefox
Mageia:6
 before 60.7.0-1.mga6
60.7.0-1.mga6
firefox-l10n
Mageia:6
 before 60.7.0-1.mga6
60.7.0-1.mga6
firefox
Red Hat:enterprise_linux:7::client
 before 0:60.7.0-1.el7_6
0:60.7.0-1.el7_6
firefox-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:60.7.0-1.el7_6
0:60.7.0-1.el7_6
firefox
Red Hat:enterprise_linux:7::server
 before 0:60.7.0-1.el7_6
0:60.7.0-1.el7_6
firefox-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:60.7.0-1.el7_6
0:60.7.0-1.el7_6
firefox
Red Hat:enterprise_linux:7::workstation
 before 0:60.7.0-1.el7_6
0:60.7.0-1.el7_6
firefox-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:60.7.0-1.el7_6
0:60.7.0-1.el7_6
firefox
Red Hat:enterprise_linux:6::client
 before 0:60.7.0-1.el6_10
0:60.7.0-1.el6_10
firefox-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:60.7.0-1.el6_10
0:60.7.0-1.el6_10
firefox
Red Hat:enterprise_linux:6::computenode
 before 0:60.7.0-1.el6_10
0:60.7.0-1.el6_10
firefox-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:60.7.0-1.el6_10
0:60.7.0-1.el6_10
firefox
Red Hat:enterprise_linux:6::server
 before 0:60.7.0-1.el6_10
0:60.7.0-1.el6_10
firefox-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:60.7.0-1.el6_10
0:60.7.0-1.el6_10
firefox
Red Hat:enterprise_linux:6::workstation
 before 0:60.7.0-1.el6_10
0:60.7.0-1.el6_10
firefox-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:60.7.0-1.el6_10
0:60.7.0-1.el6_10
firefox
Red Hat:enterprise_linux:8::appstream
 before 0:60.7.0-1.el8_0
0:60.7.0-1.el8_0
firefox-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:60.7.0-1.el8_0
0:60.7.0-1.el8_0
firefox-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:60.7.0-1.el8_0
0:60.7.0-1.el8_0
thunderbird
Red Hat:enterprise_linux:8::appstream
 before 0:60.7.0-1.el8_0
0:60.7.0-1.el8_0
thunderbird-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:60.7.0-1.el8_0
0:60.7.0-1.el8_0
thunderbird-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:60.7.0-1.el8_0
0:60.7.0-1.el8_0
thunderbird
Red Hat:enterprise_linux:7::client
 before 0:60.7.0-1.el7_6
0:60.7.0-1.el7_6
thunderbird-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:60.7.0-1.el7_6
0:60.7.0-1.el7_6
thunderbird
Red Hat:enterprise_linux:7::server
 before 0:60.7.0-1.el7_6
0:60.7.0-1.el7_6
thunderbird-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:60.7.0-1.el7_6
0:60.7.0-1.el7_6
thunderbird
Red Hat:enterprise_linux:7::workstation
 before 0:60.7.0-1.el7_6
0:60.7.0-1.el7_6
thunderbird-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:60.7.0-1.el7_6
0:60.7.0-1.el7_6
thunderbird
Red Hat:enterprise_linux:6::client
 before 0:60.7.0-1.el6_10
0:60.7.0-1.el6_10
thunderbird-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:60.7.0-1.el6_10
0:60.7.0-1.el6_10
thunderbird
Red Hat:enterprise_linux:6::server
 before 0:60.7.0-1.el6_10
0:60.7.0-1.el6_10
thunderbird-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:60.7.0-1.el6_10
0:60.7.0-1.el6_10
thunderbird
Red Hat:enterprise_linux:6::workstation
 before 0:60.7.0-1.el6_10
0:60.7.0-1.el6_10
thunderbird-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:60.7.0-1.el6_10
0:60.7.0-1.el6_10
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15
 before 60.7.0-3.33.2
60.7.0-3.33.2
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP1
 before 60.7.0-3.33.2
60.7.0-3.33.2
firefox
Ubuntu:14.04:LTS
 before 65.0.1+build2-0ubuntu0.14.04.1, plus listed versions
24.0+build1-0ubuntu125.0+build3-0ubuntu0.13.10.128.0~b2+build1-0ubuntu228.0+build1-0ubuntu128.0+build2-0ubuntu1
Show 45 moreShow less
28.0+build2-0ubuntu229.0+build1-0ubuntu0.14.04.230.0+build1-0ubuntu0.14.04.331.0+build1-0ubuntu0.14.04.132.0+build1-0ubuntu0.14.04.132.0.3+build1-0ubuntu0.14.04.133.0+build2-0ubuntu0.14.04.134.0+build2-0ubuntu0.14.04.135.0+build3-0ubuntu0.14.04.235.0.1+build1-0ubuntu0.14.04.136.0+build2-0ubuntu0.14.04.436.0.1+build2-0ubuntu0.14.04.136.0.4+build1-0ubuntu0.14.04.137.0+build2-0ubuntu0.14.04.137.0.1+build1-0ubuntu0.14.04.137.0.2+build1-0ubuntu0.14.04.138.0+build3-0ubuntu0.14.04.139.0+build5-0ubuntu0.14.04.139.0.3+build2-0ubuntu0.14.04.140.0+build4-0ubuntu0.14.04.140.0+build4-0ubuntu0.14.04.440.0.3+build1-0ubuntu0.14.04.141.0+build3-0ubuntu0.14.04.141.0.1+build2-0ubuntu0.14.04.141.0.2+build2-0ubuntu0.14.04.142.0+build2-0ubuntu0.14.04.143.0+build1-0ubuntu0.14.04.143.0.4+build3-0ubuntu0.14.04.144.0+build3-0ubuntu0.14.04.144.0.1+build2-0ubuntu0.14.04.144.0.2+build1-0ubuntu0.14.04.145.0+build2-0ubuntu0.14.04.145.0.1+build1-0ubuntu0.14.04.245.0.2+build1-0ubuntu0.14.04.146.0+build5-0ubuntu0.14.04.246.0.1+build1-0ubuntu0.14.04.347.0+build3-0ubuntu0.14.04.148.0+build2-0ubuntu0.14.04.149.0+build4-0ubuntu0.14.04.149.0.2+build2-0ubuntu0.14.04.150.0+build2-0ubuntu0.14.04.250.0.2+build1-0ubuntu0.14.04.150.1.0+build2-0ubuntu0.14.04.151.0.1+build2-0ubuntu0.14.04.151.0.1+build2-0ubuntu0.14.04.2
65.0.1+build2-0ubuntu0.14.04.1
firefox
Ubuntu:16.04:LTS
 before 65.0.1+build2-0ubuntu0.16.04.1, plus listed versions
41.0.2+build2-0ubuntu142.0+build2-0ubuntu144.0+build3-0ubuntu244.0.1+build1-0ubuntu144.0.2+build1-0ubuntu1
Show 45 moreShow less
45.0+build2-0ubuntu145.0.1+build1-0ubuntu145.0.2+build1-0ubuntu146.0+build5-0ubuntu0.16.04.246.0.1+build1-0ubuntu0.16.04.247.0+build3-0ubuntu0.16.04.148.0+build2-0ubuntu0.16.04.149.0+build4-0ubuntu0.16.04.149.0.2+build2-0ubuntu0.16.04.250.0+build2-0ubuntu0.16.04.250.0.2+build1-0ubuntu0.16.04.150.1.0+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.252.0+build2-0ubuntu0.16.04.152.0.1+build2-0ubuntu0.16.04.152.0.2+build1-0ubuntu0.16.04.153.0+build6-0ubuntu0.16.04.153.0.2+build1-0ubuntu0.16.04.253.0.3+build1-0ubuntu0.16.04.254.0+build3-0ubuntu0.16.04.155.0.1+build2-0ubuntu0.16.04.255.0.2+build1-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.257.0+build4-0ubuntu0.16.04.557.0+build4-0ubuntu0.16.04.657.0.1+build2-0ubuntu0.16.04.157.0.3+build1-0ubuntu0.16.04.157.0.4+build1-0ubuntu0.16.04.158.0+build6-0ubuntu0.16.04.158.0.1+build1-0ubuntu0.16.04.158.0.2+build1-0ubuntu0.16.04.159.0+build5-0ubuntu0.16.04.159.0.1+build1-0ubuntu0.16.04.159.0.2+build1-0ubuntu0.16.04.159.0.2+build1-0ubuntu0.16.04.360.0+build2-0ubuntu0.16.04.160.0.1+build2-0ubuntu0.16.04.160.0.2+build1-0ubuntu0.16.04.161.0+build3-0ubuntu0.16.04.261.0.1+build1-0ubuntu0.16.04.162.0+build2-0ubuntu0.16.04.362.0+build2-0ubuntu0.16.04.462.0+build2-0ubuntu0.16.04.5
65.0.1+build2-0ubuntu0.16.04.1
thunderbird
Ubuntu:16.04:LTS
 before 1:60.7.0+build1-0ubuntu0.16.04.1, plus listed versions
1:38.3.0+build1-0ubuntu21:38.5.1+build2-0ubuntu11:38.6.0+build1-0ubuntu11:38.7.2+build1-0ubuntu0.16.04.11:38.8.0+build1-0ubuntu0.16.04.1
Show 19 moreShow less
1:45.2.0+build1-0ubuntu0.16.04.11:45.3.0+build1-0ubuntu0.16.04.21:45.4.0+build1-0ubuntu0.16.04.11:45.5.1+build1-0ubuntu0.16.04.11:45.7.0+build1-0ubuntu0.16.04.11:45.8.0+build1-0ubuntu0.16.04.11:52.1.1+build1-0ubuntu0.16.04.11:52.2.1+build1-0ubuntu0.16.04.11:52.3.0+build1-0ubuntu0.16.04.11:52.4.0+build1-0ubuntu0.16.04.21:52.5.0+build1-0ubuntu0.16.04.11:52.6.0+build1-0ubuntu0.16.04.11:52.7.0+build1-0ubuntu0.16.04.11:52.8.0+build1-0ubuntu0.16.04.11:52.9.1+build3-0ubuntu0.16.04.11:60.2.1+build1-0ubuntu0.16.04.41:60.4.0+build2-0ubuntu0.16.04.11:60.5.1+build2-0ubuntu0.16.04.11:60.6.1+build2-0ubuntu0.16.04.1
1:60.7.0+build1-0ubuntu0.16.04.1
firefox
Ubuntu:18.04:LTS
 before 65.0.1+build2-0ubuntu0.18.04.1, plus listed versions
56.0+build6-0ubuntu157.0.1+build2-0ubuntu159.0.1+build1-0ubuntu159.0.2+build1-0ubuntu160.0+build2-0ubuntu1
Show 12 moreShow less
60.0.1+build2-0ubuntu0.18.04.160.0.2+build1-0ubuntu0.18.04.161.0+build3-0ubuntu0.18.04.161.0.1+build1-0ubuntu0.18.04.162.0+build2-0ubuntu0.18.04.362.0+build2-0ubuntu0.18.04.462.0+build2-0ubuntu0.18.04.562.0.3+build1-0ubuntu0.18.04.163.0+build2-0ubuntu0.18.04.263.0.3+build1-0ubuntu0.18.04.164.0+build3-0ubuntu0.18.04.165.0+build2-0ubuntu0.18.04.1
65.0.1+build2-0ubuntu0.18.04.1
thunderbird
Ubuntu:18.04:LTS
 before 1:60.7.0+build1-0ubuntu0.18.04.1, plus listed versions
1:52.4.0+build1-0ubuntu21:52.6.0+build1-0ubuntu11:52.7.0+build1-0ubuntu11:52.8.0+build1-0ubuntu0.18.04.11:52.9.1+build3-0ubuntu0.18.04.1
Show 4 moreShow less
1:60.2.1+build1-0ubuntu0.18.04.21:60.4.0+build2-0ubuntu0.18.04.11:60.5.1+build2-0ubuntu0.18.04.11:60.6.1+build2-0ubuntu0.18.04.1
1:60.7.0+build1-0ubuntu0.18.04.1
mozjs52
Ubuntu:18.04:LTS
 All versions, plus listed versions
52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1
 None known
mozjs38
Ubuntu:18.04:LTS
 All versions, plus listed versions
38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4
 None known
mozjs52
Ubuntu:20.04:LTS
 All versions, plus listed versions
52.9.1-1build152.9.1-1ubuntu3
 None known
MozillaFirefox
openSUSE:Leap 15.0
 before 60.7.0-lp150.3.54.5
60.7.0-lp150.3.54.5
MozillaThunderbird
SUSE:Package Hub 12
 before 60.7.2-85.1
60.7.2-85.1
MozillaFirefox
openSUSE:Tumbleweed
 before 92.0-1.2
92.0-1.2
MozillaThunderbird
openSUSE:Tumbleweed
 before 91.1.1-1.1
91.1.1-1.1
firefox-esr
openSUSE:Tumbleweed
 before 128.5.1-1.1
128.5.1-1.1

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 231 versions and 1,866 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open