{"kind": "product", "path": "vulns/suse-linux-enterprise-module-for-desktop-applications-15/mozillafirefox", "name": "mozillafirefox", "product": "mozillafirefox", "ecosystem": "SUSE:Linux Enterprise Module for Desktop Applications 15", "items": [{"id": "SUSE-SU-2020:0383-1", "noindex": false, "published": "2020-02-17T07:47:56Z", "modified": "2026-02-04T03:51:26.600345Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2020:0383-1", "title": "Security update for MozillaFirefox", "description": "This update for MozillaFirefox fixes the following issues:\n\n- Firefox Extended Support Release 68.5.0 ESR\n  * Fixed: Various stability and security fixes\n- Mozilla Firefox ESR68.5\n  MFSA 2020-06 (bsc#1163368)\n  * CVE-2020-6796 (bmo#1610426)\n    Missing bounds check on shared memory read in the parent\n    process\n  * CVE-2020-6797 (bmo#1596668)\n    Extensions granted downloads.open permission could open\n    arbitrary applications on Mac OSX\n  * CVE-2020-6798 (bmo#1602944)\n    Incorrect parsing of template tag could result in JavaScript\n    injection\n  * CVE-2020-6799 (bmo#1606596)\n    Arbitrary code execution when opening pdf links from other\n", "references": ["https://www.suse.com/support/update/announcement/2020/suse-su-20200383-1/", "https://bugzilla.suse.com/1163368", "https://www.suse.com/security/cve/CVE-2020-6796"], "fixes": ["68.5.0-3.72.1"], "products": [{"name": "mozillafirefox", "path": "vulns/suse-linux-enterprise-module-for-desktop-applications-15/mozillafirefox", "ecosystem": "SUSE:Linux Enterprise Module for Desktop Applications 15"}]}, {"id": "SUSE-SU-2020:0078-1", "noindex": false, "published": "2020-01-13T09:26:02Z", "modified": "2026-02-04T03:53:17.420434Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2020:0078-1", "title": "Security update for MozillaFirefox", "description": "This update for MozillaFirefox fixes the following issues:\n\n- Firefox Extended Support Release 68.4.1 ESR\n  * Fixed: Security fix\n  MFSA 2020-03 (bsc#1160498)\n  * CVE-2019-17026 (bmo#1607443)\n    IonMonkey type confusion with StoreElementHole and\n    FallibleStoreElement \n- Firefox Extended Support Release 68.4.0 ESR\n  * Fixed: Various security fixes\n  MFSA 2020-02 (bsc#1160305)\n  * CVE-2019-17015 (bmo#1599005)\n    Memory corruption in parent process during new content\n    process initialization on Windows\n  * CVE-2019-17016 (bmo#1599181)\n    Bypass of @namespace CSS sanitization during pasting\n  * CVE-2019-17017 (bmo#1603055)\n    Type Confus", "references": ["https://www.suse.com/support/update/announcement/2020/suse-su-20200078-1/", "https://bugzilla.suse.com/1160305", "https://bugzilla.suse.com/1160498"], "fixes": ["68.4.1-3.66.1"], "products": [{"name": "mozillafirefox", "path": "vulns/suse-linux-enterprise-module-for-desktop-applications-15/mozillafirefox", "ecosystem": "SUSE:Linux Enterprise Module for Desktop Applications 15"}]}, {"id": "SUSE-SU-2019:3337-1", "noindex": false, "published": "2019-12-18T17:17:32Z", "modified": "2026-02-04T04:22:27.151003Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2019:3337-1", "title": "Security update for MozillaFirefox", "description": "This update for MozillaFirefox fixes the following issues:\n\nMozilla Firefox was updated to 68.3esr (MFSA 2019-37 bsc#1158328)\t  \n\t  \nSecurity issues fixed: \n\n- CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)\n- CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments \n  in WebRTC code (bmo#1580156)\n- CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a \n  block cipher (bmo#1586176)\n- CVE-2019-17009: Fixed an issue where updater temporary files accessible to \n  unprivileged processes (bmo#1510494)\n- CVE-2019-17010: Fixed a use-after-free when performing device orientation \n  ", "references": ["https://www.suse.com/support/update/announcement/2019/suse-su-20193337-1/", "https://bugzilla.suse.com/1157652", "https://bugzilla.suse.com/1158328"], "fixes": ["68.3.0-3.62.2"], "products": [{"name": "mozillafirefox", "path": "vulns/suse-linux-enterprise-module-for-desktop-applications-15/mozillafirefox", "ecosystem": "SUSE:Linux Enterprise Module for Desktop Applications 15"}]}, {"id": "SUSE-SU-2019:2871-1", "noindex": false, "published": "2019-10-31T07:49:41Z", "modified": "2025-05-02T04:08:41.215291Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2019:2871-1", "title": "Security update for MozillaFirefox, MozillaFirefox-branding-SLE", "description": "This update for MozillaFirefox, MozillaFirefox-branding-SLE fixes the following issues:\n\nChanges in MozillaFirefox:\n\nSecurity issues fixed:\n\n-  CVE-2019-15903: Fixed a heap overflow in the expat library (bsc#1149429).\n-  CVE-2019-11757: Fixed a use-after-free when creating index updates in IndexedDB (bsc#1154738).\n-  CVE-2019-11758: Fixed a potentially exploitable crash due to 360 Total Security (bsc#1154738).\n-  CVE-2019-11759: Fixed a stack buffer overflow in HKDF output (bsc#1154738).\n-  CVE-2019-11760: Fixed a stack buffer overflow in WebRTC networking (bsc#1154738).\n-  CVE-2019-11761: Fixed an unintended access to a privileged JSONView o", "references": ["https://www.suse.com/support/update/announcement/2019/suse-su-20192871-1/", "https://bugzilla.suse.com/1104841", "https://bugzilla.suse.com/1129528"], "fixes": ["68.2.0-3.59.1"], "products": [{"name": "mozillafirefox", "path": "vulns/suse-linux-enterprise-module-for-desktop-applications-15/mozillafirefox", "ecosystem": "SUSE:Linux Enterprise Module for Desktop Applications 15"}]}, {"id": "SUSE-SU-2019:2545-1", "noindex": false, "published": "2019-10-03T15:21:52Z", "modified": "2026-02-04T02:41:09.294257Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2019:2545-1", "title": "Security update for MozillaFirefox", "description": "This update for MozillaFirefox to 68.1 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)\n- CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)\n- CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)\n- CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)\n- CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)\n- CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)\n- CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)\n- CVE-201", "references": ["https://www.suse.com/support/update/announcement/2019/suse-su-20192545-1/", "https://bugzilla.suse.com/1109465", "https://bugzilla.suse.com/1117473"], "fixes": ["68.1.0-3.54.2"], "products": [{"name": "mozillafirefox", "path": "vulns/suse-linux-enterprise-module-for-desktop-applications-15/mozillafirefox", "ecosystem": "SUSE:Linux Enterprise Module for Desktop Applications 15"}]}, {"id": "SUSE-SU-2019:1869-1", "noindex": false, "published": "2019-07-17T12:04:06Z", "modified": "2026-02-04T03:53:22.327974Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2019:1869-1", "title": "Security update for MozillaFirefox", "description": "This update for MozillaFirefox, mozilla-nss fixes the following issues:\n\nMozillaFirefox to version ESR 60.8:\n\n- CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868).\n- CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868).\n- CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868).\n- CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868).\n- CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868).\n- CVE-2019-11715: HTML parsing error can contribute to cont", "references": ["https://www.suse.com/support/update/announcement/2019/suse-su-20191869-1/", "https://bugzilla.suse.com/1140868", "https://www.suse.com/security/cve/CVE-2019-11709"], "fixes": ["60.8.0-3.51.4"], "products": [{"name": "mozillafirefox", "path": "vulns/suse-linux-enterprise-module-for-desktop-applications-15/mozillafirefox", "ecosystem": "SUSE:Linux Enterprise Module for Desktop Applications 15"}]}, {"id": "SUSE-SU-2019:1682-1", "noindex": false, "published": "2019-06-22T11:20:26Z", "modified": "2026-02-04T03:24:19.438981Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2019:1682-1", "title": "Security update for MozillaFirefox", "description": "This update for MozillaFirefox fixes the following issues:\n\n- Mozilla Firefox Firefox 60.7.2\n  MFSA 2019-19 (bsc#1138872)\n\n- CVE-2019-11708: Fix sandbox escape using Prompt:Open.\n  * Insufficient vetting of parameters passed with the Prompt:Open IPC\n    message between child and parent processes could result in the non-sandboxed\n    parent process opening web content chosen by a compromised child process.\n    When combined with additional vulnerabilities this could result in executing\n    arbitrary code on the user's computer.\n\n", "references": ["https://www.suse.com/support/update/announcement/2019/suse-su-20191682-1/", "https://bugzilla.suse.com/1138872", "https://www.suse.com/security/cve/CVE-2019-11708"], "fixes": ["60.7.2-3.48.1"], "products": [{"name": "mozillafirefox", "path": "vulns/suse-linux-enterprise-module-for-desktop-applications-15/mozillafirefox", "ecosystem": "SUSE:Linux Enterprise Module for Desktop Applications 15"}]}, {"id": "SUSE-SU-2019:1629-1", "noindex": false, "published": "2019-06-21T09:16:57Z", "modified": "2026-02-04T04:17:52.385329Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2019:1629-1", "title": "Security update for MozillaFirefox", "description": "This update for MozillaFirefox to version 60.7.1 fixes the following issues:\n\nSecurity issue fixed:    \n\n- CVE-2019-11707: Fixed a type confusion vulnerability in Arrary.pop (bsc#1138614)    \n\nOther issues addressed: \n\n- Added the new Mozilla's GPG key expiring on 2021-05-29 to the mozilla.keyring file\n- Fixed broken language plugins (bsc#1137792)\n", "references": ["https://www.suse.com/support/update/announcement/2019/suse-su-20191629-1/", "https://bugzilla.suse.com/1137792", "https://bugzilla.suse.com/1138614"], "fixes": ["60.7.1-3.45.1"], "products": [{"name": "mozillafirefox", "path": "vulns/suse-linux-enterprise-module-for-desktop-applications-15/mozillafirefox", "ecosystem": "SUSE:Linux Enterprise Module for Desktop Applications 15"}]}, {"id": "SUSE-SU-2019:1405-1", "noindex": false, "published": "2019-06-03T11:30:37Z", "modified": "2026-02-04T02:53:03.331818Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2019:1405-1", "title": "Security update for MozillaFirefox", "description": "This update for MozillaFirefox fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-11691: Use-after-free in XMLHttpRequest\n- CVE-2019-11692: Use-after-free removing listeners in the event listener manager\n- CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux\n- CVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox\n- CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks\n- CVE-2019-7317: Use-after-free in png_image_free of libpng library\n- CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7\n- CVE-2019-9815: Disable hyperthreading on conten", "references": ["https://www.suse.com/support/update/announcement/2019/suse-su-20191405-1/", "https://bugzilla.suse.com/1135824", "https://www.suse.com/security/cve/CVE-2019-11691"], "fixes": ["60.7.0-3.40.6"], "products": [{"name": "mozillafirefox", "path": "vulns/suse-linux-enterprise-module-for-desktop-applications-15/mozillafirefox", "ecosystem": "SUSE:Linux Enterprise Module for Desktop Applications 15"}]}, {"id": "SUSE-SU-2019:0871-1", "noindex": false, "published": "2019-04-04T11:36:46Z", "modified": "2026-02-04T03:08:26.943945Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2019:0871-1", "title": "Security update for MozillaFirefox", "description": "This update for MozillaFirefox to version ESR 60.6.1 fixes the following issues:\n\nSecurity issuess addressed:\t  \n\n- update to Firefox ESR 60.6.1 (bsc#1130262):\n\n- CVE-2019-9813: Fixed Ionmonkey type confusion with __proto__ mutations\n- CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information\n\n- Update to Firefox ESR 60.6 (bsc#1129821):\n\n- CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file \n- CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content\n- CVE-2019-9788: Fixed multiple memory safety bugs\n- CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM el", "references": ["https://www.suse.com/support/update/announcement/2019/suse-su-20190871-1/", "https://bugzilla.suse.com/1125330", "https://bugzilla.suse.com/1127987"], "fixes": ["60.6.1-3.29.3"], "products": [{"name": "mozillafirefox", "path": "vulns/suse-linux-enterprise-module-for-desktop-applications-15/mozillafirefox", "ecosystem": "SUSE:Linux Enterprise Module for Desktop Applications 15"}]}, {"id": "SUSE-SU-2019:0273-1", "noindex": false, "published": "2019-02-06T15:48:32Z", "modified": "2026-02-04T02:15:09.719023Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2019:0273-1", "title": "Security update for MozillaFirefox", "description": "This update for MozillaFirefox, mozilla-nss fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-18500: Fixed a use-after-free parsing HTML5 stream (bsc#1122983).\n- CVE-2018-18501: Fixed multiple memory safety bugs (bsc#1122983).\n- CVE-2018-18505: Fixed a privilege escalation through IPC channel messages (bsc#1122983).\n- CVE-2018-12404: Cache side-channel variant of the Bleichenbacher attack (bsc#1119069).\n\nNon-security issue fixed:\n\n- Update to MozillaFirefox ESR 60.5.0\n- Update to mozilla-nss 3.41.1\n", "references": ["https://www.suse.com/support/update/announcement/2019/suse-su-20190273-1/", "https://bugzilla.suse.com/1119069", "https://bugzilla.suse.com/1120374"], "fixes": ["60.5.0-3.24.2"], "products": [{"name": "mozillafirefox", "path": "vulns/suse-linux-enterprise-module-for-desktop-applications-15/mozillafirefox", "ecosystem": "SUSE:Linux Enterprise Module for Desktop Applications 15"}]}, {"id": "SUSE-SU-2018:4235-1", "noindex": false, "published": "2018-12-21T17:47:33Z", "modified": "2026-02-04T04:35:50.433821Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2018:4235-1", "title": "Security update for MozillaFirefox, mozilla-nspr and mozilla-nss", "description": "This update for MozillaFirefox, mozilla-nss and mozilla-nspr fixes the following issues:\n\nIssues fixed in MozillaFirefox:\n\n- Update to Firefox ESR 60.4 (bsc#1119105)\n- CVE-2018-17466: Fixed a buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11\n- CVE-2018-18492: Fixed a use-after-free with select element\n- CVE-2018-18493: Fixed a buffer overflow in accelerated 2D canvas with Skia\n- CVE-2018-18494: Fixed a Same-origin policy violation using location attribute and performance.getEntries\n  to steal cross-origin URLs\n- CVE-2018-18498: Fixed a integer overflow when calculating buffer sizes for images\n- CVE-2018-12405: Fixe", "references": ["https://www.suse.com/support/update/announcement/2018/suse-su-20184235-1/", "https://bugzilla.suse.com/1097410", "https://bugzilla.suse.com/1106873"], "fixes": ["60.4.0-3.21.1"], "products": [{"name": "mozillafirefox", "path": "vulns/suse-linux-enterprise-module-for-desktop-applications-15/mozillafirefox", "ecosystem": "SUSE:Linux Enterprise Module for Desktop Applications 15"}]}, {"id": "SUSE-SU-2018:3656-1", "noindex": false, "published": "2018-11-07T15:20:16Z", "modified": "2026-02-04T04:10:09.346555Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2018:3656-1", "title": "Security update for MozillaFirefox", "description": "This update for MozillaFirefox fixes the following issues:\n\nSecurity issues fixed:\n\n- Update to Mozilla Firefox 60.3.0esr: MFSA 2018-27 (bsc#1112852)\n- CVE-2018-12392: Crash with nested event loops.\n- CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript.\n- CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting.\n- CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts.\n- CVE-2018-12397: WebExtension local file access vulnerability.\n- CVE-2018-12389: Memory safety bugs fixed in Firefox ESR 60.3.\n- CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firef", "references": ["https://www.suse.com/support/update/announcement/2018/suse-su-20183656-1/", "https://bugzilla.suse.com/1112852", "https://www.suse.com/security/cve/CVE-2018-12389"], "fixes": ["60.3.0-3.17.1"], "products": [{"name": "mozillafirefox", "path": "vulns/suse-linux-enterprise-module-for-desktop-applications-15/mozillafirefox", "ecosystem": "SUSE:Linux Enterprise Module for Desktop Applications 15"}]}, {"id": "SUSE-SU-2018:3476-1", "noindex": false, "published": "2018-10-25T18:09:44Z", "modified": "2025-05-02T04:07:41.578309Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2018:3476-1", "title": "Security update for MozillaFirefox", "description": "\n  \nThis update for MozillaFirefox to 60.2.2ESR fixes the following issues:\n\nSecurity issues fixed:\n\nMFSA 2018-24:\n\n- CVE-2018-12386: A Type confusion in JavaScript allowed remote code execution (bsc#1110506)\n- CVE-2018-12387: Array.prototype.push stack pointer vulnerability may have enabled exploits in the sandboxed content process (bsc#1110507)\n\nMFSA 2018-23:\n\n- CVE-2018-12385: Fixed a crash in TransportSecurityInfo due to cached data (bsc#1109363)\n- CVE-2018-12383: Setting a master password did not delete unencrypted previously stored passwords (bsc#1107343)\n \nNon security issues fixed:\n\n- Avoid undefined behavior in IPC fd-passing code (b", "references": ["https://www.suse.com/support/update/announcement/2018/suse-su-20183476-1/", "https://bugzilla.suse.com/1094767", "https://bugzilla.suse.com/1107343"], "fixes": ["60.2.2-3.13.3"], "products": [{"name": "mozillafirefox", "path": "vulns/suse-linux-enterprise-module-for-desktop-applications-15/mozillafirefox", "ecosystem": "SUSE:Linux Enterprise Module for Desktop Applications 15"}]}, {"id": "SUSE-SU-2018:2890-1", "noindex": false, "published": "2018-09-27T10:04:13Z", "modified": "2026-02-04T04:39:49.131748Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2018:2890-1", "title": "Security update for MozillaFirefox", "description": "This update for MozillaFirefox to ESR 60.2 fixes several issues.\n\nThese general changes are part of the version 60 release.\n\n- New browser engine with speed improvements\n- Redesigned graphical user interface elements\n- Unified address and search bar for new installations\n- New tab page listing top visited, recently visited and recommended pages\n- Support for configuration policies in enterprise deployments via JSON files\n- Support for Web Authentication, allowing the use of USB tokens for\n  authentication to web sites\n\nThe following changes affect compatibility:\n\n- Now exclusively supports extensions built using the WebExtension API.\n- Unsupp", "references": ["https://www.suse.com/support/update/announcement/2018/suse-su-20182890-1/", "https://bugzilla.suse.com/1107343", "https://www.suse.com/security/cve/CVE-2017-16541"], "fixes": ["60.2.0-3.10.1"], "products": [{"name": "mozillafirefox", "path": "vulns/suse-linux-enterprise-module-for-desktop-applications-15/mozillafirefox", "ecosystem": "SUSE:Linux Enterprise Module for Desktop Applications 15"}]}, {"id": "SUSE-SU-2018:2298-1", "noindex": false, "published": "2018-08-10T09:36:01Z", "modified": "2026-02-04T03:28:27.464993Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/suse-su-2018:2298-1", "title": "Security update for MozillaFirefox", "description": "This update for MozillaFirefox to the 52.9 ESR release fixes the following issues:\n\nThese security issues were fixed:\n\n- Firefox ESR 52.9:\n- CVE-2018-5188 Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9 (bsc#1098998). \n- CVE-2018-12368 No warning when opening executable SettingContent-ms files (bsc#1098998).\n- CVE-2018-12366 Invalid data handling during QCMS transformations (bsc#1098998).\n- CVE-2018-12365 Compromised IPC child process can list local filenames (bsc#1098998).\n- CVE-2018-12364 CSRF attacks through 307 redirects and NPAPI plugins (bsc#1098998).\n- CVE-2018-12363 Use-after-free when appending DOM node", "references": ["https://www.suse.com/support/update/announcement/2018/suse-su-20182298-1/", "https://bugzilla.suse.com/1092548", "https://bugzilla.suse.com/1096449"], "fixes": ["52.9.0esr-3.7.12"], "products": [{"name": "mozillafirefox", "path": "vulns/suse-linux-enterprise-module-for-desktop-applications-15/mozillafirefox", "ecosystem": "SUSE:Linux Enterprise Module for Desktop Applications 15"}]}], "total": 16, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "mozillafirefox", "path": "vulns/suse-linux-enterprise-module-for-desktop-applications-15/mozillafirefox", "ecosystem": "SUSE:Linux Enterprise Module for Desktop Applications 15"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-02-04T04:39:49.131748Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}