{"id":"CVE-2019-17009","aliases":["ALPINE-CVE-2019-17009","EUVD-2019-7483","GHSA-9wr8-jjcr-qw4x","MGASA-2019-0376","MGASA-2019-0377","SUSE-SU-2019:14260-1","SUSE-SU-2019:3337-1","SUSE-SU-2019:3339-1","SUSE-SU-2019:3347-1","UBUNTU-CVE-2019-17009","openSUSE-SU-2020:0002-1","openSUSE-SU-2020:0003-1"],"status":"published","title":"When running, the updater service wrote status and log files to an unrestricted location;...","description":"When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.*. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00333,"percentile":0.26689,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2019-12-08T18:12:18Z","modified":"2026-11-03T06:32:29Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"firefox-esr","fixed_in":["68.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"firefox-esr","fixed_in":["68.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"firefox-esr","fixed_in":["68.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"firefox-esr","fixed_in":["68.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"firefox-esr","fixed_in":["68.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"firefox-esr","fixed_in":["68.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"firefox-esr","fixed_in":["68.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"firefox-esr","fixed_in":["68.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"firefox-esr","fixed_in":["68.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"firefox-esr","fixed_in":["68.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"firefox-esr","fixed_in":["68.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"firefox-esr","fixed_in":["68.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"firefox-esr","fixed_in":["68.3.0-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-r0"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-1.mga7"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:7","package":"firefox-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-1.mga7"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:7","package":"nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.24-1.mga7"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:7","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-1.mga7"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:7","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-1.mga7"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-78.54.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23-29.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.47.1-38.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-3.62.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-3.62.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-3.61.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP1","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-3.61.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-109.98.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-109.98.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-109.98.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-109.98.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-109.98.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-109.98.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-109.98.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-109.98.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-109.98.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-109.98.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-109.98.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-109.98.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-109.98.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-109.98.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-109.98.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-109.98.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-109.98.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-109.98.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-109.98.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-109.98.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.3.1-0ubuntu3","52.3.1-7fakesync1","52.8.1-0ubuntu0.18.04.1","52.9.1-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs38","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["38.8.0~repack1-0ubuntu1","38.8.0~repack1-0ubuntu3","38.8.0~repack1-0ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.9.1-1build1","52.9.1-1ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-lp151.2.21.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.3.0-lp151.2.19.1"}]}],"bundled":8}],"products":[{"vendor":"mozilla","product":"firefox"},{"vendor":"mozilla","product":"firefox esr"},{"vendor":"mozilla","product":"firefox_esr"},{"vendor":"mozilla","product":"thunderbird"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1510494","tags":["x_refsource_MISC","x_transferred","Permissions Required"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2019-36/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2019-38/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2019-37/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17009"},{"url":"https://github.com/advisories/GHSA-9wr8-jjcr-qw4x"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-17009","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0376.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25820","tags":["report"]},{"url":"https://www.mozilla.org/en-US/firefox/68.3.0/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-37/","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0377.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25821","tags":["report"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/68.3.0/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201914260-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1158328","tags":["report"]},{"url":"https://bugzilla.suse.com/1158527","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17012","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193337-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1157652","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193339-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193347-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-17009","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17009","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-37/#CVE-2019-17009","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17009","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IT3UIP5O2QPRMJEIU4SZ6MBHNKBLUYZT/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NRHDWT3QC423VY6ACEY346YD3PPCAECZ/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-17009","description":"When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.*. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71.","status":"published","published":"2020-01-08T21:22:53Z","modified":"2024-08-05T01:24:48.744Z","updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2019-7483","description":"When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.*. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71.","status":"published","published":"2020-01-08T21:22:53Z","modified":"2024-08-05T01:24:48Z","updated_at":"2026-11-03T02:40:31.468839Z"}],"ghsa":[{"id":"GHSA-9wr8-jjcr-qw4x","title":"When running, the updater service wrote status and log files to an unrestricted location;...","description":"When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.*. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71.","status":"published","published":"2022-05-24T17:05:49Z","modified":"2023-01-29T05:00:59Z","updated_at":"2026-11-02T14:44:42.615019Z"}],"nvd":[{"id":"CVE-2019-17009","description":"When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.*. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71.","status":"published","published":"2020-01-08T22:15:11.81Z","modified":"2026-06-17T02:23:08.58Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:42.416368Z"}],"osv":[{"id":"ALPINE-CVE-2019-17009","description":"When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.*. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71.","status":"published","published":"2020-01-08T22:15:11.81Z","modified":"2026-11-03T06:32:29.526963538Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"UBUNTU-CVE-2019-17009","description":"When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.*. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71.","status":"published","published":"2020-01-08T22:15:00Z","modified":"2026-04-22T12:13:39.027144Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"MGASA-2019-0376","title":"Updated firefox packages fix security vulnerabilities","description":"Updated firefox packages fix security vulnerabilities:\n\nStack corruption due to incorrect number of arguments in WebRTC code.\n(CVE-2019-13722)\n\nBuffer overflow in plain text serializer. (CVE-2019-17005)\n\nUse-after-free in worker destruction. (CVE-2019-17008)\n\nUpdater temporary files accessible to unprivileged processes. \n(CVE-2019-17009)\n\nUse-after-free when performing device orientation checks.\n(CVE-2019-17010)\n\nUse-after-free when retrieving a document in antitracking.\n(CVE-2019-17011)\n\nMemory safety bugs fixed in Firefox 71 and Firefox ESR 68.3.\n(CVE-2019-17012)\n","status":"published","published":"2019-12-08T18:12:18Z","modified":"2026-04-16T04:43:00.742627779Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"MGASA-2019-0377","title":"Updated thunderbird packages fix security vulnerabilities","description":"Updated thunderbird packages fix security vulnerabilities:\n\nStack corruption due to incorrect number of arguments in WebRTC code.\n(CVE-2019-13722)\n\nBuffer overflow in plain text serializer. (CVE-2019-17005)\n\nUse-after-free in worker destruction. (CVE-2019-17008)\n\nUpdater temporary files accessible to unprivileged processes.\n(CVE-2019-17009)\n\nUse-after-free when performing device orientation checks.\n(CVE-2019-17010)\n\nUse-after-free when retrieving a document in antitracking.\n(CVE-2019-17011)\n\nMemory safety bugs fixed in Firefox 71, Firefox ESR 68.3, and Thunderbird 68.3.\n(CVE-2019-17012)\n","status":"published","published":"2019-12-08T18:12:18Z","modified":"2026-04-16T04:43:36.345518141Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0002-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\n\nMozilla Firefox was updated to 68.3esr (MFSA 2019-37 bsc#1158328)\t  \n\t  \nSecurity issues fixed: \n\n- CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)\n- CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments \n  in WebRTC code (bmo#1580156)\n- CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a \n  block cipher (bmo#1586176)\n- CVE-2019-17009: Fixed an issue where updater temporary files accessible to \n  unprivileged processes (bmo#1510494)\n- CVE-2019-17010: Fixed a use-after-free when performing device orientation \n  checks (bmo#1581084)\n- CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)\n- CVE-2019-17011: Fixed a use-after-free when retrieving a document \n  in antitracking (bmo#1591334)\n- CVE-2019-17012: Fixed multiple memmory issues\n  (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, \n  bmo#1592502)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-01-09T16:29:33Z","modified":"2026-02-04T03:49:32.397852Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:0003-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\nMozilla Thunderbird was updated to 68.3esr (MFSA 2019-38 bsc#1158328) \t  \n\nSecurity issues fixed: \n\n- CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)\n- CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments \n  in WebRTC code (bmo#1580156)\n- CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a \n  block cipher (bmo#1586176)\n- CVE-2019-17009: Fixed an issue where updater temporary files accessible to \n  unprivileged processes (bmo#1510494)\n- CVE-2019-17010: Fixed a use-after-free when performing device orientation \n  checks (bmo#1581084)\n- CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)\n- CVE-2019-17011: Fixed a use-after-free when retrieving a document \n  in antitracking (bmo#1591334)\n- CVE-2019-17012: Fixed multiple memmory issues\n  (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, \n  bmo#1592502)\n\nOther issues addressed:\n\n- New: Message display toolbar action WebExtension API (bmo#1531597)\n- New: Navigation buttons are now available in content tabs (bmo#787683)\n- Fixed an issue where write window was not always correct (bmo#1593280)\n- Fixed toolbar issues (bmo#1584160)\n- Fixed issues with LDAP lookup when SSL was enabled (bmo#1576364)\n- Fixed an issue with scam link confirmation panel (bmo#1596413)\n- Fixed an issue with the write window where the Link Properties \n  dialog was not showing named anchors in context menu (bmo#1593629)\n- Fixed issues with calendar (bmo#1588516)\n- Fixed issues with chat where reordering via drag-and-drop was not working\n  on Instant messaging status dialog (bmo#1591505)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-01-09T16:29:51Z","modified":"2026-02-04T02:21:13.258278Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"SUSE-SU-2019:14260-1","title":"Security update for MozillaFirefox, mozilla-nspr, mozilla-nss","description":"This update for MozillaFirefox, mozilla-nspr, mozilla-nss fixes the following issues:\n\nUpdate Firefox Extended Support Release to 68.3.0 ESR (MFSA 2019-37 / bsc#1158328)\n\nSecurity issues fixed:\n\n- CVE-2019-17008: Use-after-free in worker destruction (bmo#1546331).\n- CVE-2019-13722: Stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156).\n- CVE-2019-11745: Out of bounds write in NSS when encrypting with a block cipher (bmo#1586176).\n- CVE-2019-17009: Updater temporary files accessible to unprivileged processes (bmo#1510494).\n- CVE-2019-17010: Use-after-free when performing device orientation checks (bmo#1581084).\n- CVE-2019-17005: Buffer overflow in plain text serializer (bmo#1584170).\n- CVE-2019-17011: Use-after-free when retrieving a document in antitracking (bmo#1591334).\n- CVE-2019-17012: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 (bmo#1449736, bmo#1533957, bmo#1560667, bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502).\n\nUpdate mozilla-nss to version 3.47.1 (bsc#1158527):\n\nSecurity issues fixed:\n\n- CVE-2019-11745: EncryptUpdate should use maxout, not block size.\n\nBug fixes:\n\n- Fix a crash that could be caused by client certificates during startup (bmo#1590495, bsc#1158527)\n- Fix compile-time warnings from uninitialized variables in a perl script (bmo#1589810)\n- Support AES HW acceleration on ARMv8 (bmo#1152625)\n- Allow per-socket run-time ordering of the cipher suites presented in ClientHello (bmo#1267894)\n- Add CMAC to FreeBL and PKCS #11 libraries (bmo#1570501)\n- Remove arbitrary HKDF output limit by allocating space as needed (bmo#1577953)\n\nUpdate mozilla-nspr to version 4.23:\n\nBug fixes:\n\n- fixed a build failure that was introduced in 4.22\n- correctness fix for Win64 socket polling\n- whitespace in C files was cleaned up and no longer uses tab characters for indenting\n- added support for the ARC architecture\n- removed support for the following platforms: OSF1/Tru64, DGUX, IRIX, Symbian, BeOS\n- correctness and build fixes\n","status":"published","published":"2019-12-20T14:34:01Z","modified":"2026-02-04T03:48:18.669351Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:3337-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\n\nMozilla Firefox was updated to 68.3esr (MFSA 2019-37 bsc#1158328)\t  \n\t  \nSecurity issues fixed: \n\n- CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)\n- CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments \n  in WebRTC code (bmo#1580156)\n- CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a \n  block cipher (bmo#1586176)\n- CVE-2019-17009: Fixed an issue where updater temporary files accessible to \n  unprivileged processes (bmo#1510494)\n- CVE-2019-17010: Fixed a use-after-free when performing device orientation \n  checks (bmo#1581084)\n- CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)\n- CVE-2019-17011: Fixed a use-after-free when retrieving a document \n  in antitracking (bmo#1591334)\n- CVE-2019-17012: Fixed multiple memmory issues\n  (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, \n  bmo#1592502)\n","status":"published","published":"2019-12-18T17:17:32Z","modified":"2026-02-04T04:22:27.151003Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2019:3339-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\nMozilla Thunderbird was updated to 68.3esr (MFSA 2019-38 bsc#1158328) \t  \n\nSecurity issues fixed: \n\n- CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)\n- CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments \n  in WebRTC code (bmo#1580156)\n- CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a \n  block cipher (bmo#1586176)\n- CVE-2019-17009: Fixed an issue where updater temporary files accessible to \n  unprivileged processes (bmo#1510494)\n- CVE-2019-17010: Fixed a use-after-free when performing device orientation \n  checks (bmo#1581084)\n- CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)\n- CVE-2019-17011: Fixed a use-after-free when retrieving a document \n  in antitracking (bmo#1591334)\n- CVE-2019-17012: Fixed multiple memmory issues\n  (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, \n  bmo#1592502)\n\nOther issues addressed:\n\n- New: Message display toolbar action WebExtension API (bmo#1531597)\n- New: Navigation buttons are now available in content tabs (bmo#787683)\n- Fixed an issue where write window was not always correct (bmo#1593280)\n- Fixed toolbar issues (bmo#1584160)\n- Fixed issues with LDAP lookup when SSL was enabled (bmo#1576364)\n- Fixed an issue with scam link confirmation panel (bmo#1596413)\n- Fixed an issue with the write window where the Link Properties \n  dialog was not showing named anchors in context menu (bmo#1593629)\n- Fixed issues with calendar (bmo#1588516)\n- Fixed issues with chat where reordering via drag-and-drop was not working\n  on Instant messaging status dialog (bmo#1591505)\n","status":"published","published":"2019-12-18T17:18:32Z","modified":"2026-02-04T03:13:54.81347Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2019:3347-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\n\nMozilla Firefox was updated to 68.3esr (MFSA 2019-37 bsc#1158328)\t  \n\t  \nSecurity issues fixed: \n\n- CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)\n- CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments \n  in WebRTC code (bmo#1580156)\n- CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a \n  block cipher (bmo#1586176)\n- CVE-2019-17009: Fixed an issue where updater temporary files accessible to \n  unprivileged processes (bmo#1510494)\n- CVE-2019-17010: Fixed a use-after-free when performing device orientation \n  checks (bmo#1581084)\n- CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)\n- CVE-2019-17011: Fixed a use-after-free when retrieving a document \n  in antitracking (bmo#1591334)\n- CVE-2019-17012: Fixed multiple memmory issues\n  (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, \n  bmo#1592502)\n","status":"published","published":"2019-12-19T15:12:50Z","modified":"2026-02-04T03:05:57.866893Z","updated_at":"2026-11-02T15:53:47.06185Z"}]}}