csaf_suse - suse-su-2020:0078-1

suse-su-2020:0078-1

Vulnerability from csaf_suse

Published

2020-01-13 09:26

Modified

2020-01-13 09:26

Summary

Security update for MozillaFirefox

Notes

Title of the patch

Security update for MozillaFirefox

Description of the patch

This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 68.4.1 ESR * Fixed: Security fix MFSA 2020-03 (bsc#1160498) * CVE-2019-17026 (bmo#1607443) IonMonkey type confusion with StoreElementHole and FallibleStoreElement - Firefox Extended Support Release 68.4.0 ESR * Fixed: Various security fixes MFSA 2020-02 (bsc#1160305) * CVE-2019-17015 (bmo#1599005) Memory corruption in parent process during new content process initialization on Windows * CVE-2019-17016 (bmo#1599181) Bypass of @namespace CSS sanitization during pasting * CVE-2019-17017 (bmo#1603055) Type Confusion in XPCVariant.cpp * CVE-2019-17021 (bmo#1599008) Heap address disclosure in parent process during content process initialization on Windows * CVE-2019-17022 (bmo#1602843) CSS sanitization does not escape HTML tags * CVE-2019-17024 (bmo#1507180, bmo#1595470, bmo#1598605, bmo#1601826) Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4

Patchnames

SUSE-2020-78,SUSE-SLE-Module-Desktop-Applications-15-2020-78,SUSE-SLE-Module-Desktop-Applications-15-SP1-2020-78,SUSE-SLE-Module-Development-Tools-OBS-15-2020-78,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2020-78

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for MozillaFirefox",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for MozillaFirefox fixes the following issues:\n\n- Firefox Extended Support Release 68.4.1 ESR\n  * Fixed: Security fix\n  MFSA 2020-03 (bsc#1160498)\n  * CVE-2019-17026 (bmo#1607443)\n    IonMonkey type confusion with StoreElementHole and\n    FallibleStoreElement \n- Firefox Extended Support Release 68.4.0 ESR\n  * Fixed: Various security fixes\n  MFSA 2020-02 (bsc#1160305)\n  * CVE-2019-17015 (bmo#1599005)\n    Memory corruption in parent process during new content\n    process initialization on Windows\n  * CVE-2019-17016 (bmo#1599181)\n    Bypass of @namespace CSS sanitization during pasting\n  * CVE-2019-17017 (bmo#1603055)\n    Type Confusion in XPCVariant.cpp\n  * CVE-2019-17021 (bmo#1599008)\n    Heap address disclosure in parent process during content\n    process initialization on Windows\n  * CVE-2019-17022 (bmo#1602843)\n    CSS sanitization does not escape HTML tags\n  * CVE-2019-17024 (bmo#1507180, bmo#1595470, bmo#1598605,\n    bmo#1601826)\n    Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2020-78,SUSE-SLE-Module-Desktop-Applications-15-2020-78,SUSE-SLE-Module-Desktop-Applications-15-SP1-2020-78,SUSE-SLE-Module-Development-Tools-OBS-15-2020-78,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2020-78",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_0078-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2020:0078-1",
        "url": "https://www.suse.com/support/update/announcement/2020/suse-su-20200078-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2020:0078-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2020-January/006331.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1160305",
        "url": "https://bugzilla.suse.com/1160305"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1160498",
        "url": "https://bugzilla.suse.com/1160498"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-17015 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-17015/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-17016 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-17016/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-17017 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-17017/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-17021 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-17021/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-17022 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-17022/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-17024 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-17024/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-17026 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-17026/"
      }
    ],
    "title": "Security update for MozillaFirefox",
    "tracking": {
      "current_release_date": "2020-01-13T09:26:02Z",
      "generator": {
        "date": "2020-01-13T09:26:02Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2020:0078-1",
      "initial_release_date": "2020-01-13T09:26:02Z",
      "revision_history": [
        {
          "date": "2020-01-13T09:26:02Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MozillaFirefox-68.4.1-3.66.1.aarch64",
                "product": {
                  "name": "MozillaFirefox-68.4.1-3.66.1.aarch64",
                  "product_id": "MozillaFirefox-68.4.1-3.66.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaFirefox-branding-upstream-68.4.1-3.66.1.aarch64",
                "product": {
                  "name": "MozillaFirefox-branding-upstream-68.4.1-3.66.1.aarch64",
                  "product_id": "MozillaFirefox-branding-upstream-68.4.1-3.66.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
                "product": {
                  "name": "MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
                  "product_id": "MozillaFirefox-devel-68.4.1-3.66.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
                "product": {
                  "name": "MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
                  "product_id": "MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
                "product": {
                  "name": "MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
                  "product_id": "MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MozillaFirefox-68.4.1-3.66.1.ppc64le",
                "product": {
                  "name": "MozillaFirefox-68.4.1-3.66.1.ppc64le",
                  "product_id": "MozillaFirefox-68.4.1-3.66.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaFirefox-branding-upstream-68.4.1-3.66.1.ppc64le",
                "product": {
                  "name": "MozillaFirefox-branding-upstream-68.4.1-3.66.1.ppc64le",
                  "product_id": "MozillaFirefox-branding-upstream-68.4.1-3.66.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
                "product": {
                  "name": "MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
                  "product_id": "MozillaFirefox-devel-68.4.1-3.66.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
                "product": {
                  "name": "MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
                  "product_id": "MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
                "product": {
                  "name": "MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
                  "product_id": "MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MozillaFirefox-68.4.1-3.66.1.s390x",
                "product": {
                  "name": "MozillaFirefox-68.4.1-3.66.1.s390x",
                  "product_id": "MozillaFirefox-68.4.1-3.66.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaFirefox-branding-upstream-68.4.1-3.66.1.s390x",
                "product": {
                  "name": "MozillaFirefox-branding-upstream-68.4.1-3.66.1.s390x",
                  "product_id": "MozillaFirefox-branding-upstream-68.4.1-3.66.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaFirefox-devel-68.4.1-3.66.1.s390x",
                "product": {
                  "name": "MozillaFirefox-devel-68.4.1-3.66.1.s390x",
                  "product_id": "MozillaFirefox-devel-68.4.1-3.66.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
                "product": {
                  "name": "MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
                  "product_id": "MozillaFirefox-translations-common-68.4.1-3.66.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
                "product": {
                  "name": "MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
                  "product_id": "MozillaFirefox-translations-other-68.4.1-3.66.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "MozillaFirefox-68.4.1-3.66.1.x86_64",
                "product": {
                  "name": "MozillaFirefox-68.4.1-3.66.1.x86_64",
                  "product_id": "MozillaFirefox-68.4.1-3.66.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaFirefox-branding-upstream-68.4.1-3.66.1.x86_64",
                "product": {
                  "name": "MozillaFirefox-branding-upstream-68.4.1-3.66.1.x86_64",
                  "product_id": "MozillaFirefox-branding-upstream-68.4.1-3.66.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaFirefox-buildsymbols-68.4.1-3.66.1.x86_64",
                "product": {
                  "name": "MozillaFirefox-buildsymbols-68.4.1-3.66.1.x86_64",
                  "product_id": "MozillaFirefox-buildsymbols-68.4.1-3.66.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
                "product": {
                  "name": "MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
                  "product_id": "MozillaFirefox-devel-68.4.1-3.66.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
                "product": {
                  "name": "MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
                  "product_id": "MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
                "product": {
                  "name": "MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
                  "product_id": "MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Desktop Applications 15",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Desktop Applications 15",
                  "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-desktop-applications:15"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1",
                  "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-desktop-applications:15:sp1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-68.4.1-3.66.1.aarch64 as component of SUSE Linux Enterprise Module for Desktop Applications 15",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64"
        },
        "product_reference": "MozillaFirefox-68.4.1-3.66.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-68.4.1-3.66.1.ppc64le as component of SUSE Linux Enterprise Module for Desktop Applications 15",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le"
        },
        "product_reference": "MozillaFirefox-68.4.1-3.66.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-68.4.1-3.66.1.s390x as component of SUSE Linux Enterprise Module for Desktop Applications 15",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x"
        },
        "product_reference": "MozillaFirefox-68.4.1-3.66.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-68.4.1-3.66.1.x86_64 as component of SUSE Linux Enterprise Module for Desktop Applications 15",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64"
        },
        "product_reference": "MozillaFirefox-68.4.1-3.66.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-devel-68.4.1-3.66.1.aarch64 as component of SUSE Linux Enterprise Module for Desktop Applications 15",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64"
        },
        "product_reference": "MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-devel-68.4.1-3.66.1.ppc64le as component of SUSE Linux Enterprise Module for Desktop Applications 15",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le"
        },
        "product_reference": "MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-devel-68.4.1-3.66.1.s390x as component of SUSE Linux Enterprise Module for Desktop Applications 15",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x"
        },
        "product_reference": "MozillaFirefox-devel-68.4.1-3.66.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-devel-68.4.1-3.66.1.x86_64 as component of SUSE Linux Enterprise Module for Desktop Applications 15",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64"
        },
        "product_reference": "MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64 as component of SUSE Linux Enterprise Module for Desktop Applications 15",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64"
        },
        "product_reference": "MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le as component of SUSE Linux Enterprise Module for Desktop Applications 15",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le"
        },
        "product_reference": "MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-translations-common-68.4.1-3.66.1.s390x as component of SUSE Linux Enterprise Module for Desktop Applications 15",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x"
        },
        "product_reference": "MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64 as component of SUSE Linux Enterprise Module for Desktop Applications 15",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64"
        },
        "product_reference": "MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64 as component of SUSE Linux Enterprise Module for Desktop Applications 15",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64"
        },
        "product_reference": "MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le as component of SUSE Linux Enterprise Module for Desktop Applications 15",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le"
        },
        "product_reference": "MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-translations-other-68.4.1-3.66.1.s390x as component of SUSE Linux Enterprise Module for Desktop Applications 15",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x"
        },
        "product_reference": "MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64 as component of SUSE Linux Enterprise Module for Desktop Applications 15",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
        },
        "product_reference": "MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-68.4.1-3.66.1.aarch64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64"
        },
        "product_reference": "MozillaFirefox-68.4.1-3.66.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-68.4.1-3.66.1.ppc64le as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le"
        },
        "product_reference": "MozillaFirefox-68.4.1-3.66.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-68.4.1-3.66.1.s390x as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x"
        },
        "product_reference": "MozillaFirefox-68.4.1-3.66.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-68.4.1-3.66.1.x86_64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64"
        },
        "product_reference": "MozillaFirefox-68.4.1-3.66.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-devel-68.4.1-3.66.1.aarch64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64"
        },
        "product_reference": "MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-devel-68.4.1-3.66.1.ppc64le as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le"
        },
        "product_reference": "MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-devel-68.4.1-3.66.1.x86_64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64"
        },
        "product_reference": "MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64"
        },
        "product_reference": "MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le"
        },
        "product_reference": "MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-translations-common-68.4.1-3.66.1.s390x as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x"
        },
        "product_reference": "MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64"
        },
        "product_reference": "MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64"
        },
        "product_reference": "MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le"
        },
        "product_reference": "MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-translations-other-68.4.1-3.66.1.s390x as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x"
        },
        "product_reference": "MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
        },
        "product_reference": "MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-17015",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-17015"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR \u003c 68.4 and Firefox \u003c 72.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-17015",
          "url": "https://www.suse.com/security/cve/CVE-2019-17015"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1160305 for CVE-2019-17015",
          "url": "https://bugzilla.suse.com/1160305"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-01-13T09:26:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-17015"
    },
    {
      "cve": "CVE-2019-17016",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-17016"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When pasting a \u0026lt;style\u0026gt; tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR \u003c 68.4 and Firefox \u003c 72.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-17016",
          "url": "https://www.suse.com/security/cve/CVE-2019-17016"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1160305 for CVE-2019-17016",
          "url": "https://bugzilla.suse.com/1160305"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-01-13T09:26:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-17016"
    },
    {
      "cve": "CVE-2019-17017",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-17017"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox ESR \u003c 68.4 and Firefox \u003c 72.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-17017",
          "url": "https://www.suse.com/security/cve/CVE-2019-17017"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1160305 for CVE-2019-17017",
          "url": "https://bugzilla.suse.com/1160305"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-01-13T09:26:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-17017"
    },
    {
      "cve": "CVE-2019-17021",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-17021"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR \u003c 68.4 and Firefox \u003c 72.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-17021",
          "url": "https://www.suse.com/security/cve/CVE-2019-17021"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1160305 for CVE-2019-17021",
          "url": "https://bugzilla.suse.com/1160305"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-01-13T09:26:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-17021"
    },
    {
      "cve": "CVE-2019-17022",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-17022"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When pasting a \u0026lt;style\u0026gt; tag from the clipboard into a rich text editor, the CSS sanitizer does not escape \u0026lt; and \u0026gt; characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node\u0027s innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist. This vulnerability affects Firefox ESR \u003c 68.4 and Firefox \u003c 72.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-17022",
          "url": "https://www.suse.com/security/cve/CVE-2019-17022"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1160305 for CVE-2019-17022",
          "url": "https://bugzilla.suse.com/1160305"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-01-13T09:26:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-17022"
    },
    {
      "cve": "CVE-2019-17024",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-17024"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR \u003c 68.4 and Firefox \u003c 72.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-17024",
          "url": "https://www.suse.com/security/cve/CVE-2019-17024"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1160305 for CVE-2019-17024",
          "url": "https://bugzilla.suse.com/1160305"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-01-13T09:26:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-17024"
    },
    {
      "cve": "CVE-2019-17026",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-17026"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR \u003c 68.4.1, Thunderbird \u003c 68.4.1, and Firefox \u003c 72.0.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-17026",
          "url": "https://www.suse.com/security/cve/CVE-2019-17026"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1160498 for CVE-2019-17026",
          "url": "https://bugzilla.suse.com/1160498"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-68.4.1-3.66.1.x86_64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-68.4.1-3.66.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-01-13T09:26:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-17026"
    }
  ]
}

CVE-2019-17024 (GCVE-0-2019-17024)

Vulnerability from cvelistv5

Published

2020-01-08 21:31

Modified

2024-08-05 01:24

Severity ?

CWE

Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4

Summary

Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

References

►

URL

Tags

	https://bugzilla.mozilla.org/buglist.cgi?bug_id=1507180%2C1595470%2C1598605%2C1601826	x_refsource_MISC
	https://www.mozilla.org/security/advisories/mfsa2020-01/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2020-02/	x_refsource_CONFIRM
	https://seclists.org/bugtraq/2020/Jan/12	mailing-list, x_refsource_BUGTRAQ
	https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2020/dsa-4600	vendor-advisory, x_refsource_DEBIAN
	https://usn.ubuntu.com/4234-1/	vendor-advisory, x_refsource_UBUNTU
	https://seclists.org/bugtraq/2020/Jan/18	mailing-list, x_refsource_BUGTRAQ
	https://access.redhat.com/errata/RHSA-2020:0085	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0086	vendor-advisory, x_refsource_REDHAT
	http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html	x_refsource_MISC
	https://access.redhat.com/errata/RHSA-2020:0111	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html	vendor-advisory, x_refsource_SUSE
	https://access.redhat.com/errata/RHSA-2020:0120	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0123	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0127	vendor-advisory, x_refsource_REDHAT
	https://usn.ubuntu.com/4241-1/	vendor-advisory, x_refsource_UBUNTU
	https://www.debian.org/security/2020/dsa-4603	vendor-advisory, x_refsource_DEBIAN
	https://seclists.org/bugtraq/2020/Jan/26	mailing-list, x_refsource_BUGTRAQ
	https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html	vendor-advisory, x_refsource_SUSE
	https://access.redhat.com/errata/RHSA-2020:0292	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0295	vendor-advisory, x_refsource_REDHAT
	https://security.gentoo.org/glsa/202003-02	vendor-advisory, x_refsource_GENTOO
	https://usn.ubuntu.com/4335-1/	vendor-advisory, x_refsource_UBUNTU

Impacted products

Vendor

Product

Version

►

Mozilla

Firefox ESR

Version: before 68.4

Mozilla

Firefox

Version: before 72

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:24:48.822Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1507180%2C1595470%2C1598605%2C1601826"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2020-01/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2020-02/"
          },
          {
            "name": "20200109 [SECURITY] [DSA 4600-1] firefox-esr security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/12"
          },
          {
            "name": "[debian-lts-announce] 20200109 [SECURITY] [DLA 2061-1] firefox-esr security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html"
          },
          {
            "name": "DSA-4600",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4600"
          },
          {
            "name": "USN-4234-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4234-1/"
          },
          {
            "name": "20200112 [slackware-security] mozilla-thunderbird (SSA:2020-010-01)",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/18"
          },
          {
            "name": "RHSA-2020:0085",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0085"
          },
          {
            "name": "RHSA-2020:0086",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0086"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html"
          },
          {
            "name": "RHSA-2020:0111",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0111"
          },
          {
            "name": "openSUSE-SU-2020:0060",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html"
          },
          {
            "name": "RHSA-2020:0120",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0120"
          },
          {
            "name": "RHSA-2020:0123",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0123"
          },
          {
            "name": "RHSA-2020:0127",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0127"
          },
          {
            "name": "USN-4241-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4241-1/"
          },
          {
            "name": "DSA-4603",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4603"
          },
          {
            "name": "20200120 [SECURITY] [DSA 4603-1] thunderbird security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/26"
          },
          {
            "name": "[debian-lts-announce] 20200120 [SECURITY] [DLA 2071-1] thunderbird security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html"
          },
          {
            "name": "openSUSE-SU-2020:0094",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html"
          },
          {
            "name": "RHSA-2020:0292",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0292"
          },
          {
            "name": "RHSA-2020:0295",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0295"
          },
          {
            "name": "GLSA-202003-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-02"
          },
          {
            "name": "USN-4335-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4335-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.4"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 72"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR \u003c 68.4 and Firefox \u003c 72."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-29T02:07:08",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1507180%2C1595470%2C1598605%2C1601826"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2020-01/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2020-02/"
        },
        {
          "name": "20200109 [SECURITY] [DSA 4600-1] firefox-esr security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/12"
        },
        {
          "name": "[debian-lts-announce] 20200109 [SECURITY] [DLA 2061-1] firefox-esr security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html"
        },
        {
          "name": "DSA-4600",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4600"
        },
        {
          "name": "USN-4234-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4234-1/"
        },
        {
          "name": "20200112 [slackware-security] mozilla-thunderbird (SSA:2020-010-01)",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/18"
        },
        {
          "name": "RHSA-2020:0085",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0085"
        },
        {
          "name": "RHSA-2020:0086",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0086"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html"
        },
        {
          "name": "RHSA-2020:0111",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0111"
        },
        {
          "name": "openSUSE-SU-2020:0060",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html"
        },
        {
          "name": "RHSA-2020:0120",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0120"
        },
        {
          "name": "RHSA-2020:0123",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0123"
        },
        {
          "name": "RHSA-2020:0127",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0127"
        },
        {
          "name": "USN-4241-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4241-1/"
        },
        {
          "name": "DSA-4603",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4603"
        },
        {
          "name": "20200120 [SECURITY] [DSA 4603-1] thunderbird security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/26"
        },
        {
          "name": "[debian-lts-announce] 20200120 [SECURITY] [DLA 2071-1] thunderbird security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html"
        },
        {
          "name": "openSUSE-SU-2020:0094",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html"
        },
        {
          "name": "RHSA-2020:0292",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0292"
        },
        {
          "name": "RHSA-2020:0295",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0295"
        },
        {
          "name": "GLSA-202003-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-02"
        },
        {
          "name": "USN-4335-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4335-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2019-17024",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.4"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 72"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR \u003c 68.4 and Firefox \u003c 72."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1507180%2C1595470%2C1598605%2C1601826",
              "refsource": "MISC",
              "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1507180%2C1595470%2C1598605%2C1601826"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2020-01/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2020-01/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2020-02/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2020-02/"
            },
            {
              "name": "20200109 [SECURITY] [DSA 4600-1] firefox-esr security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/12"
            },
            {
              "name": "[debian-lts-announce] 20200109 [SECURITY] [DLA 2061-1] firefox-esr security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html"
            },
            {
              "name": "DSA-4600",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4600"
            },
            {
              "name": "USN-4234-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4234-1/"
            },
            {
              "name": "20200112 [slackware-security] mozilla-thunderbird (SSA:2020-010-01)",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/18"
            },
            {
              "name": "RHSA-2020:0085",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0085"
            },
            {
              "name": "RHSA-2020:0086",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0086"
            },
            {
              "name": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html"
            },
            {
              "name": "RHSA-2020:0111",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0111"
            },
            {
              "name": "openSUSE-SU-2020:0060",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html"
            },
            {
              "name": "RHSA-2020:0120",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0120"
            },
            {
              "name": "RHSA-2020:0123",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0123"
            },
            {
              "name": "RHSA-2020:0127",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0127"
            },
            {
              "name": "USN-4241-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4241-1/"
            },
            {
              "name": "DSA-4603",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4603"
            },
            {
              "name": "20200120 [SECURITY] [DSA 4603-1] thunderbird security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/26"
            },
            {
              "name": "[debian-lts-announce] 20200120 [SECURITY] [DLA 2071-1] thunderbird security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html"
            },
            {
              "name": "openSUSE-SU-2020:0094",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html"
            },
            {
              "name": "RHSA-2020:0292",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0292"
            },
            {
              "name": "RHSA-2020:0295",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0295"
            },
            {
              "name": "GLSA-202003-02",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-02"
            },
            {
              "name": "USN-4335-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4335-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2019-17024",
    "datePublished": "2020-01-08T21:31:03",
    "dateReserved": "2019-09-30T00:00:00",
    "dateUpdated": "2024-08-05T01:24:48.822Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-17021 (GCVE-0-2019-17021)

Vulnerability from cvelistv5

Published

2020-01-08 21:29

Modified

2024-08-05 01:24

Severity ?

CWE

Heap address disclosure in parent process during content process initialization on Windows

Summary

During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

References

►

URL

Tags

	https://bugzilla.mozilla.org/show_bug.cgi?id=1599008	x_refsource_MISC
	https://www.mozilla.org/security/advisories/mfsa2020-01/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2020-02/	x_refsource_CONFIRM
	https://seclists.org/bugtraq/2020/Jan/18	mailing-list, x_refsource_BUGTRAQ
	http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html	vendor-advisory, x_refsource_SUSE

Impacted products

Vendor

Product

Version

►

Mozilla

Firefox ESR

Version: before 68.4

Mozilla

Firefox

Version: before 72

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:24:48.727Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1599008"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2020-01/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2020-02/"
          },
          {
            "name": "20200112 [slackware-security] mozilla-thunderbird (SSA:2020-010-01)",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/18"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html"
          },
          {
            "name": "openSUSE-SU-2020:0060",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html"
          },
          {
            "name": "openSUSE-SU-2020:0094",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.4"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 72"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR \u003c 68.4 and Firefox \u003c 72."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Heap address disclosure in parent process during content process initialization on Windows",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-22T18:06:16",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1599008"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2020-01/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2020-02/"
        },
        {
          "name": "20200112 [slackware-security] mozilla-thunderbird (SSA:2020-010-01)",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/18"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html"
        },
        {
          "name": "openSUSE-SU-2020:0060",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html"
        },
        {
          "name": "openSUSE-SU-2020:0094",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2019-17021",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.4"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 72"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR \u003c 68.4 and Firefox \u003c 72."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Heap address disclosure in parent process during content process initialization on Windows"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1599008",
              "refsource": "MISC",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1599008"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2020-01/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2020-01/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2020-02/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2020-02/"
            },
            {
              "name": "20200112 [slackware-security] mozilla-thunderbird (SSA:2020-010-01)",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/18"
            },
            {
              "name": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html"
            },
            {
              "name": "openSUSE-SU-2020:0060",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html"
            },
            {
              "name": "openSUSE-SU-2020:0094",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2019-17021",
    "datePublished": "2020-01-08T21:29:40",
    "dateReserved": "2019-09-30T00:00:00",
    "dateUpdated": "2024-08-05T01:24:48.727Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-17022 (GCVE-0-2019-17022)

Vulnerability from cvelistv5

Published

2020-01-08 21:30

Modified

2024-08-05 01:24

Severity ?

CWE

CSS sanitization does not escape HTML tags

Summary

When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

References

►

URL

Tags

	https://bugzilla.mozilla.org/show_bug.cgi?id=1602843	x_refsource_MISC
	https://www.mozilla.org/security/advisories/mfsa2020-01/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2020-02/	x_refsource_CONFIRM
	https://seclists.org/bugtraq/2020/Jan/12	mailing-list, x_refsource_BUGTRAQ
	https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2020/dsa-4600	vendor-advisory, x_refsource_DEBIAN
	https://usn.ubuntu.com/4234-1/	vendor-advisory, x_refsource_UBUNTU
	https://seclists.org/bugtraq/2020/Jan/18	mailing-list, x_refsource_BUGTRAQ
	https://access.redhat.com/errata/RHSA-2020:0085	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0086	vendor-advisory, x_refsource_REDHAT
	http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html	x_refsource_MISC
	https://access.redhat.com/errata/RHSA-2020:0111	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html	vendor-advisory, x_refsource_SUSE
	https://access.redhat.com/errata/RHSA-2020:0120	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0123	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0127	vendor-advisory, x_refsource_REDHAT
	https://usn.ubuntu.com/4241-1/	vendor-advisory, x_refsource_UBUNTU
	https://www.debian.org/security/2020/dsa-4603	vendor-advisory, x_refsource_DEBIAN
	https://seclists.org/bugtraq/2020/Jan/26	mailing-list, x_refsource_BUGTRAQ
	https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html	vendor-advisory, x_refsource_SUSE
	https://access.redhat.com/errata/RHSA-2020:0292	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0295	vendor-advisory, x_refsource_REDHAT
	https://security.gentoo.org/glsa/202003-02	vendor-advisory, x_refsource_GENTOO
	https://usn.ubuntu.com/4335-1/	vendor-advisory, x_refsource_UBUNTU

Impacted products

Vendor

Product

Version

►

Mozilla

Firefox ESR

Version: before 68.4

Mozilla

Firefox

Version: before 72

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:24:48.712Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1602843"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2020-01/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2020-02/"
          },
          {
            "name": "20200109 [SECURITY] [DSA 4600-1] firefox-esr security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/12"
          },
          {
            "name": "[debian-lts-announce] 20200109 [SECURITY] [DLA 2061-1] firefox-esr security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html"
          },
          {
            "name": "DSA-4600",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4600"
          },
          {
            "name": "USN-4234-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4234-1/"
          },
          {
            "name": "20200112 [slackware-security] mozilla-thunderbird (SSA:2020-010-01)",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/18"
          },
          {
            "name": "RHSA-2020:0085",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0085"
          },
          {
            "name": "RHSA-2020:0086",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0086"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html"
          },
          {
            "name": "RHSA-2020:0111",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0111"
          },
          {
            "name": "openSUSE-SU-2020:0060",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html"
          },
          {
            "name": "RHSA-2020:0120",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0120"
          },
          {
            "name": "RHSA-2020:0123",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0123"
          },
          {
            "name": "RHSA-2020:0127",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0127"
          },
          {
            "name": "USN-4241-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4241-1/"
          },
          {
            "name": "DSA-4603",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4603"
          },
          {
            "name": "20200120 [SECURITY] [DSA 4603-1] thunderbird security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/26"
          },
          {
            "name": "[debian-lts-announce] 20200120 [SECURITY] [DLA 2071-1] thunderbird security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html"
          },
          {
            "name": "openSUSE-SU-2020:0094",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html"
          },
          {
            "name": "RHSA-2020:0292",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0292"
          },
          {
            "name": "RHSA-2020:0295",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0295"
          },
          {
            "name": "GLSA-202003-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-02"
          },
          {
            "name": "USN-4335-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4335-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.4"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 72"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When pasting a \u0026lt;style\u0026gt; tag from the clipboard into a rich text editor, the CSS sanitizer does not escape \u0026lt; and \u0026gt; characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node\u0027s innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist. This vulnerability affects Firefox ESR \u003c 68.4 and Firefox \u003c 72."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CSS sanitization does not escape HTML tags",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-29T02:07:03",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1602843"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2020-01/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2020-02/"
        },
        {
          "name": "20200109 [SECURITY] [DSA 4600-1] firefox-esr security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/12"
        },
        {
          "name": "[debian-lts-announce] 20200109 [SECURITY] [DLA 2061-1] firefox-esr security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html"
        },
        {
          "name": "DSA-4600",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4600"
        },
        {
          "name": "USN-4234-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4234-1/"
        },
        {
          "name": "20200112 [slackware-security] mozilla-thunderbird (SSA:2020-010-01)",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/18"
        },
        {
          "name": "RHSA-2020:0085",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0085"
        },
        {
          "name": "RHSA-2020:0086",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0086"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html"
        },
        {
          "name": "RHSA-2020:0111",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0111"
        },
        {
          "name": "openSUSE-SU-2020:0060",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html"
        },
        {
          "name": "RHSA-2020:0120",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0120"
        },
        {
          "name": "RHSA-2020:0123",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0123"
        },
        {
          "name": "RHSA-2020:0127",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0127"
        },
        {
          "name": "USN-4241-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4241-1/"
        },
        {
          "name": "DSA-4603",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4603"
        },
        {
          "name": "20200120 [SECURITY] [DSA 4603-1] thunderbird security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/26"
        },
        {
          "name": "[debian-lts-announce] 20200120 [SECURITY] [DLA 2071-1] thunderbird security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html"
        },
        {
          "name": "openSUSE-SU-2020:0094",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html"
        },
        {
          "name": "RHSA-2020:0292",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0292"
        },
        {
          "name": "RHSA-2020:0295",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0295"
        },
        {
          "name": "GLSA-202003-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-02"
        },
        {
          "name": "USN-4335-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4335-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2019-17022",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.4"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 72"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "When pasting a \u0026lt;style\u0026gt; tag from the clipboard into a rich text editor, the CSS sanitizer does not escape \u0026lt; and \u0026gt; characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node\u0027s innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist. This vulnerability affects Firefox ESR \u003c 68.4 and Firefox \u003c 72."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CSS sanitization does not escape HTML tags"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1602843",
              "refsource": "MISC",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1602843"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2020-01/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2020-01/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2020-02/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2020-02/"
            },
            {
              "name": "20200109 [SECURITY] [DSA 4600-1] firefox-esr security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/12"
            },
            {
              "name": "[debian-lts-announce] 20200109 [SECURITY] [DLA 2061-1] firefox-esr security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html"
            },
            {
              "name": "DSA-4600",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4600"
            },
            {
              "name": "USN-4234-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4234-1/"
            },
            {
              "name": "20200112 [slackware-security] mozilla-thunderbird (SSA:2020-010-01)",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/18"
            },
            {
              "name": "RHSA-2020:0085",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0085"
            },
            {
              "name": "RHSA-2020:0086",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0086"
            },
            {
              "name": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html"
            },
            {
              "name": "RHSA-2020:0111",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0111"
            },
            {
              "name": "openSUSE-SU-2020:0060",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html"
            },
            {
              "name": "RHSA-2020:0120",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0120"
            },
            {
              "name": "RHSA-2020:0123",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0123"
            },
            {
              "name": "RHSA-2020:0127",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0127"
            },
            {
              "name": "USN-4241-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4241-1/"
            },
            {
              "name": "DSA-4603",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4603"
            },
            {
              "name": "20200120 [SECURITY] [DSA 4603-1] thunderbird security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/26"
            },
            {
              "name": "[debian-lts-announce] 20200120 [SECURITY] [DLA 2071-1] thunderbird security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html"
            },
            {
              "name": "openSUSE-SU-2020:0094",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html"
            },
            {
              "name": "RHSA-2020:0292",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0292"
            },
            {
              "name": "RHSA-2020:0295",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0295"
            },
            {
              "name": "GLSA-202003-02",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-02"
            },
            {
              "name": "USN-4335-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4335-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2019-17022",
    "datePublished": "2020-01-08T21:30:09",
    "dateReserved": "2019-09-30T00:00:00",
    "dateUpdated": "2024-08-05T01:24:48.712Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-17015 (GCVE-0-2019-17015)

Vulnerability from cvelistv5

Published

2020-01-08 21:26

Modified

2024-08-05 01:24

Severity ?

CWE

Memory corruption in parent process during new content process initialization on Windows

Summary

During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

References

►

URL

Tags

	https://bugzilla.mozilla.org/show_bug.cgi?id=1599005	x_refsource_MISC
	https://www.mozilla.org/security/advisories/mfsa2020-01/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2020-02/	x_refsource_CONFIRM
	https://seclists.org/bugtraq/2020/Jan/18	mailing-list, x_refsource_BUGTRAQ
	http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html	vendor-advisory, x_refsource_SUSE

Impacted products

Vendor

Product

Version

►

Mozilla

Firefox ESR

Version: before 68.4

Mozilla

Firefox

Version: before 72

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:24:48.689Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1599005"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2020-01/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2020-02/"
          },
          {
            "name": "20200112 [slackware-security] mozilla-thunderbird (SSA:2020-010-01)",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/18"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html"
          },
          {
            "name": "openSUSE-SU-2020:0060",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html"
          },
          {
            "name": "openSUSE-SU-2020:0094",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.4"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 72"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR \u003c 68.4 and Firefox \u003c 72."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Memory corruption in parent process during new content process initialization on Windows",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-22T18:06:19",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1599005"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2020-01/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2020-02/"
        },
        {
          "name": "20200112 [slackware-security] mozilla-thunderbird (SSA:2020-010-01)",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/18"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html"
        },
        {
          "name": "openSUSE-SU-2020:0060",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html"
        },
        {
          "name": "openSUSE-SU-2020:0094",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2019-17015",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.4"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 72"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR \u003c 68.4 and Firefox \u003c 72."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Memory corruption in parent process during new content process initialization on Windows"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1599005",
              "refsource": "MISC",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1599005"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2020-01/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2020-01/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2020-02/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2020-02/"
            },
            {
              "name": "20200112 [slackware-security] mozilla-thunderbird (SSA:2020-010-01)",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/18"
            },
            {
              "name": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html"
            },
            {
              "name": "openSUSE-SU-2020:0060",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html"
            },
            {
              "name": "openSUSE-SU-2020:0094",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2019-17015",
    "datePublished": "2020-01-08T21:26:15",
    "dateReserved": "2019-09-30T00:00:00",
    "dateUpdated": "2024-08-05T01:24:48.689Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-17026 (GCVE-0-2019-17026)

Vulnerability from cvelistv5

Published

2020-03-02 04:05

Modified

2025-07-30 01:45

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

IonMonkey type confusion with StoreElementHole and FallibleStoreElement

Summary

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.

References

►

URL

Tags

	https://www.mozilla.org/security/advisories/mfsa2020-04/	x_refsource_MISC
	https://www.mozilla.org/security/advisories/mfsa2020-03/	x_refsource_MISC
	https://bugzilla.mozilla.org/show_bug.cgi?id=1607443	x_refsource_MISC
	https://security.gentoo.org/glsa/202003-02	vendor-advisory, x_refsource_GENTOO
	https://usn.ubuntu.com/4335-1/	vendor-advisory, x_refsource_UBUNTU
	http://packetstormsecurity.com/files/162568/Firefox-72-IonMonkey-JIT-Type-Confusion.html	x_refsource_MISC

Impacted products

Vendor

Product

Version

►

Mozilla

Firefox ESR

Version: unspecified < 68.4.1

	Mozilla	Thunderbird	Version: unspecified < 68.4.1
	Mozilla	Firefox	Version: unspecified < 72.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:24:48.586Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2020-04/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2020-03/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1607443"
          },
          {
            "name": "GLSA-202003-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-02"
          },
          {
            "name": "USN-4335-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4335-1/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/162568/Firefox-72-IonMonkey-JIT-Type-Confusion.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2019-17026",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-07T12:48:51.769583Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-17026"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-843",
                "description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-30T01:45:47.648Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00+00:00",
            "value": "CVE-2019-17026 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "68.4.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "68.4.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "72.0.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR \u003c 68.4.1, Thunderbird \u003c 68.4.1, and Firefox \u003c 72.0.1."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "IonMonkey type confusion with StoreElementHole and FallibleStoreElement",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-13T17:06:23.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2020-04/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2020-03/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1607443"
        },
        {
          "name": "GLSA-202003-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-02"
        },
        {
          "name": "USN-4335-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4335-1/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/162568/Firefox-72-IonMonkey-JIT-Type-Confusion.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2019-17026",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "68.4.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Thunderbird",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "68.4.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "72.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR \u003c 68.4.1, Thunderbird \u003c 68.4.1, and Firefox \u003c 72.0.1."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "IonMonkey type confusion with StoreElementHole and FallibleStoreElement"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2020-04/",
              "refsource": "MISC",
              "url": "https://www.mozilla.org/security/advisories/mfsa2020-04/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2020-03/",
              "refsource": "MISC",
              "url": "https://www.mozilla.org/security/advisories/mfsa2020-03/"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1607443",
              "refsource": "MISC",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1607443"
            },
            {
              "name": "GLSA-202003-02",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-02"
            },
            {
              "name": "USN-4335-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4335-1/"
            },
            {
              "name": "http://packetstormsecurity.com/files/162568/Firefox-72-IonMonkey-JIT-Type-Confusion.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/162568/Firefox-72-IonMonkey-JIT-Type-Confusion.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2019-17026",
    "datePublished": "2020-03-02T04:05:03.000Z",
    "dateReserved": "2019-09-30T00:00:00.000Z",
    "dateUpdated": "2025-07-30T01:45:47.648Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-17016 (GCVE-0-2019-17016)

Vulnerability from cvelistv5

Published

2020-01-08 21:27

Modified

2024-08-05 01:24

Severity ?

CWE

Bypass of @namespace CSS sanitization during pasting

Summary

When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

References

►

URL

Tags

	https://bugzilla.mozilla.org/show_bug.cgi?id=1599181	x_refsource_MISC
	https://www.mozilla.org/security/advisories/mfsa2020-01/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2020-02/	x_refsource_CONFIRM
	https://seclists.org/bugtraq/2020/Jan/12	mailing-list, x_refsource_BUGTRAQ
	https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2020/dsa-4600	vendor-advisory, x_refsource_DEBIAN
	https://usn.ubuntu.com/4234-1/	vendor-advisory, x_refsource_UBUNTU
	https://seclists.org/bugtraq/2020/Jan/18	mailing-list, x_refsource_BUGTRAQ
	https://access.redhat.com/errata/RHSA-2020:0085	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0086	vendor-advisory, x_refsource_REDHAT
	http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html	x_refsource_MISC
	https://access.redhat.com/errata/RHSA-2020:0111	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html	vendor-advisory, x_refsource_SUSE
	https://access.redhat.com/errata/RHSA-2020:0120	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0123	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0127	vendor-advisory, x_refsource_REDHAT
	https://usn.ubuntu.com/4241-1/	vendor-advisory, x_refsource_UBUNTU
	https://www.debian.org/security/2020/dsa-4603	vendor-advisory, x_refsource_DEBIAN
	https://seclists.org/bugtraq/2020/Jan/26	mailing-list, x_refsource_BUGTRAQ
	https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html	vendor-advisory, x_refsource_SUSE
	https://access.redhat.com/errata/RHSA-2020:0292	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0295	vendor-advisory, x_refsource_REDHAT
	https://security.gentoo.org/glsa/202003-02	vendor-advisory, x_refsource_GENTOO
	https://usn.ubuntu.com/4335-1/	vendor-advisory, x_refsource_UBUNTU

Impacted products

Vendor

Product

Version

►

Mozilla

Firefox ESR

Version: before 68.4

Mozilla

Firefox

Version: before 72

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:24:48.588Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1599181"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2020-01/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2020-02/"
          },
          {
            "name": "20200109 [SECURITY] [DSA 4600-1] firefox-esr security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/12"
          },
          {
            "name": "[debian-lts-announce] 20200109 [SECURITY] [DLA 2061-1] firefox-esr security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html"
          },
          {
            "name": "DSA-4600",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4600"
          },
          {
            "name": "USN-4234-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4234-1/"
          },
          {
            "name": "20200112 [slackware-security] mozilla-thunderbird (SSA:2020-010-01)",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/18"
          },
          {
            "name": "RHSA-2020:0085",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0085"
          },
          {
            "name": "RHSA-2020:0086",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0086"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html"
          },
          {
            "name": "RHSA-2020:0111",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0111"
          },
          {
            "name": "openSUSE-SU-2020:0060",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html"
          },
          {
            "name": "RHSA-2020:0120",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0120"
          },
          {
            "name": "RHSA-2020:0123",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0123"
          },
          {
            "name": "RHSA-2020:0127",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0127"
          },
          {
            "name": "USN-4241-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4241-1/"
          },
          {
            "name": "DSA-4603",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4603"
          },
          {
            "name": "20200120 [SECURITY] [DSA 4603-1] thunderbird security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/26"
          },
          {
            "name": "[debian-lts-announce] 20200120 [SECURITY] [DLA 2071-1] thunderbird security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html"
          },
          {
            "name": "openSUSE-SU-2020:0094",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html"
          },
          {
            "name": "RHSA-2020:0292",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0292"
          },
          {
            "name": "RHSA-2020:0295",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0295"
          },
          {
            "name": "GLSA-202003-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-02"
          },
          {
            "name": "USN-4335-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4335-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.4"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 72"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When pasting a \u0026lt;style\u0026gt; tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR \u003c 68.4 and Firefox \u003c 72."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Bypass of @namespace CSS sanitization during pasting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-29T02:06:52",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1599181"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2020-01/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2020-02/"
        },
        {
          "name": "20200109 [SECURITY] [DSA 4600-1] firefox-esr security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/12"
        },
        {
          "name": "[debian-lts-announce] 20200109 [SECURITY] [DLA 2061-1] firefox-esr security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html"
        },
        {
          "name": "DSA-4600",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4600"
        },
        {
          "name": "USN-4234-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4234-1/"
        },
        {
          "name": "20200112 [slackware-security] mozilla-thunderbird (SSA:2020-010-01)",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/18"
        },
        {
          "name": "RHSA-2020:0085",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0085"
        },
        {
          "name": "RHSA-2020:0086",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0086"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html"
        },
        {
          "name": "RHSA-2020:0111",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0111"
        },
        {
          "name": "openSUSE-SU-2020:0060",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html"
        },
        {
          "name": "RHSA-2020:0120",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0120"
        },
        {
          "name": "RHSA-2020:0123",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0123"
        },
        {
          "name": "RHSA-2020:0127",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0127"
        },
        {
          "name": "USN-4241-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4241-1/"
        },
        {
          "name": "DSA-4603",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4603"
        },
        {
          "name": "20200120 [SECURITY] [DSA 4603-1] thunderbird security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/26"
        },
        {
          "name": "[debian-lts-announce] 20200120 [SECURITY] [DLA 2071-1] thunderbird security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html"
        },
        {
          "name": "openSUSE-SU-2020:0094",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html"
        },
        {
          "name": "RHSA-2020:0292",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0292"
        },
        {
          "name": "RHSA-2020:0295",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0295"
        },
        {
          "name": "GLSA-202003-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-02"
        },
        {
          "name": "USN-4335-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4335-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2019-17016",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.4"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 72"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "When pasting a \u0026lt;style\u0026gt; tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR \u003c 68.4 and Firefox \u003c 72."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Bypass of @namespace CSS sanitization during pasting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1599181",
              "refsource": "MISC",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1599181"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2020-01/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2020-01/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2020-02/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2020-02/"
            },
            {
              "name": "20200109 [SECURITY] [DSA 4600-1] firefox-esr security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/12"
            },
            {
              "name": "[debian-lts-announce] 20200109 [SECURITY] [DLA 2061-1] firefox-esr security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html"
            },
            {
              "name": "DSA-4600",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4600"
            },
            {
              "name": "USN-4234-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4234-1/"
            },
            {
              "name": "20200112 [slackware-security] mozilla-thunderbird (SSA:2020-010-01)",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/18"
            },
            {
              "name": "RHSA-2020:0085",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0085"
            },
            {
              "name": "RHSA-2020:0086",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0086"
            },
            {
              "name": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html"
            },
            {
              "name": "RHSA-2020:0111",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0111"
            },
            {
              "name": "openSUSE-SU-2020:0060",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html"
            },
            {
              "name": "RHSA-2020:0120",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0120"
            },
            {
              "name": "RHSA-2020:0123",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0123"
            },
            {
              "name": "RHSA-2020:0127",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0127"
            },
            {
              "name": "USN-4241-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4241-1/"
            },
            {
              "name": "DSA-4603",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4603"
            },
            {
              "name": "20200120 [SECURITY] [DSA 4603-1] thunderbird security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/26"
            },
            {
              "name": "[debian-lts-announce] 20200120 [SECURITY] [DLA 2071-1] thunderbird security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html"
            },
            {
              "name": "openSUSE-SU-2020:0094",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html"
            },
            {
              "name": "RHSA-2020:0292",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0292"
            },
            {
              "name": "RHSA-2020:0295",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0295"
            },
            {
              "name": "GLSA-202003-02",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-02"
            },
            {
              "name": "USN-4335-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4335-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2019-17016",
    "datePublished": "2020-01-08T21:27:03",
    "dateReserved": "2019-09-30T00:00:00",
    "dateUpdated": "2024-08-05T01:24:48.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-17017 (GCVE-0-2019-17017)

Vulnerability from cvelistv5

Published

2020-01-08 21:27

Modified

2024-08-05 01:24

Severity ?

CWE

Type Confusion in XPCVariant.cpp

Summary

Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

References

►

URL

Tags

	https://bugzilla.mozilla.org/show_bug.cgi?id=1603055	x_refsource_MISC
	https://www.mozilla.org/security/advisories/mfsa2020-01/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2020-02/	x_refsource_CONFIRM
	https://seclists.org/bugtraq/2020/Jan/12	mailing-list, x_refsource_BUGTRAQ
	https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2020/dsa-4600	vendor-advisory, x_refsource_DEBIAN
	https://usn.ubuntu.com/4234-1/	vendor-advisory, x_refsource_UBUNTU
	https://seclists.org/bugtraq/2020/Jan/18	mailing-list, x_refsource_BUGTRAQ
	https://access.redhat.com/errata/RHSA-2020:0085	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0086	vendor-advisory, x_refsource_REDHAT
	http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html	x_refsource_MISC
	https://access.redhat.com/errata/RHSA-2020:0111	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html	vendor-advisory, x_refsource_SUSE
	https://access.redhat.com/errata/RHSA-2020:0120	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0123	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0127	vendor-advisory, x_refsource_REDHAT
	https://usn.ubuntu.com/4241-1/	vendor-advisory, x_refsource_UBUNTU
	https://www.debian.org/security/2020/dsa-4603	vendor-advisory, x_refsource_DEBIAN
	https://seclists.org/bugtraq/2020/Jan/26	mailing-list, x_refsource_BUGTRAQ
	https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html	vendor-advisory, x_refsource_SUSE
	https://access.redhat.com/errata/RHSA-2020:0292	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0295	vendor-advisory, x_refsource_REDHAT
	https://security.gentoo.org/glsa/202003-02	vendor-advisory, x_refsource_GENTOO
	https://usn.ubuntu.com/4335-1/	vendor-advisory, x_refsource_UBUNTU

Impacted products

Vendor

Product

Version

►

Mozilla

Firefox ESR

Version: before 68.4

Mozilla

Firefox

Version: before 72

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:24:48.752Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1603055"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2020-01/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2020-02/"
          },
          {
            "name": "20200109 [SECURITY] [DSA 4600-1] firefox-esr security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/12"
          },
          {
            "name": "[debian-lts-announce] 20200109 [SECURITY] [DLA 2061-1] firefox-esr security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html"
          },
          {
            "name": "DSA-4600",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4600"
          },
          {
            "name": "USN-4234-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4234-1/"
          },
          {
            "name": "20200112 [slackware-security] mozilla-thunderbird (SSA:2020-010-01)",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/18"
          },
          {
            "name": "RHSA-2020:0085",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0085"
          },
          {
            "name": "RHSA-2020:0086",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0086"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html"
          },
          {
            "name": "RHSA-2020:0111",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0111"
          },
          {
            "name": "openSUSE-SU-2020:0060",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html"
          },
          {
            "name": "RHSA-2020:0120",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0120"
          },
          {
            "name": "RHSA-2020:0123",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0123"
          },
          {
            "name": "RHSA-2020:0127",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0127"
          },
          {
            "name": "USN-4241-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4241-1/"
          },
          {
            "name": "DSA-4603",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4603"
          },
          {
            "name": "20200120 [SECURITY] [DSA 4603-1] thunderbird security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/26"
          },
          {
            "name": "[debian-lts-announce] 20200120 [SECURITY] [DLA 2071-1] thunderbird security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html"
          },
          {
            "name": "openSUSE-SU-2020:0094",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html"
          },
          {
            "name": "RHSA-2020:0292",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0292"
          },
          {
            "name": "RHSA-2020:0295",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0295"
          },
          {
            "name": "GLSA-202003-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-02"
          },
          {
            "name": "USN-4335-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4335-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.4"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 72"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox ESR \u003c 68.4 and Firefox \u003c 72."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Type Confusion in XPCVariant.cpp",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-29T02:06:58",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1603055"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2020-01/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2020-02/"
        },
        {
          "name": "20200109 [SECURITY] [DSA 4600-1] firefox-esr security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/12"
        },
        {
          "name": "[debian-lts-announce] 20200109 [SECURITY] [DLA 2061-1] firefox-esr security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html"
        },
        {
          "name": "DSA-4600",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4600"
        },
        {
          "name": "USN-4234-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4234-1/"
        },
        {
          "name": "20200112 [slackware-security] mozilla-thunderbird (SSA:2020-010-01)",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/18"
        },
        {
          "name": "RHSA-2020:0085",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0085"
        },
        {
          "name": "RHSA-2020:0086",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0086"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html"
        },
        {
          "name": "RHSA-2020:0111",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0111"
        },
        {
          "name": "openSUSE-SU-2020:0060",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html"
        },
        {
          "name": "RHSA-2020:0120",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0120"
        },
        {
          "name": "RHSA-2020:0123",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0123"
        },
        {
          "name": "RHSA-2020:0127",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0127"
        },
        {
          "name": "USN-4241-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4241-1/"
        },
        {
          "name": "DSA-4603",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4603"
        },
        {
          "name": "20200120 [SECURITY] [DSA 4603-1] thunderbird security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/26"
        },
        {
          "name": "[debian-lts-announce] 20200120 [SECURITY] [DLA 2071-1] thunderbird security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html"
        },
        {
          "name": "openSUSE-SU-2020:0094",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html"
        },
        {
          "name": "RHSA-2020:0292",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0292"
        },
        {
          "name": "RHSA-2020:0295",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0295"
        },
        {
          "name": "GLSA-202003-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-02"
        },
        {
          "name": "USN-4335-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4335-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2019-17017",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.4"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 72"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox ESR \u003c 68.4 and Firefox \u003c 72."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Type Confusion in XPCVariant.cpp"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1603055",
              "refsource": "MISC",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1603055"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2020-01/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2020-01/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2020-02/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2020-02/"
            },
            {
              "name": "20200109 [SECURITY] [DSA 4600-1] firefox-esr security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/12"
            },
            {
              "name": "[debian-lts-announce] 20200109 [SECURITY] [DLA 2061-1] firefox-esr security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html"
            },
            {
              "name": "DSA-4600",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4600"
            },
            {
              "name": "USN-4234-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4234-1/"
            },
            {
              "name": "20200112 [slackware-security] mozilla-thunderbird (SSA:2020-010-01)",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/18"
            },
            {
              "name": "RHSA-2020:0085",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0085"
            },
            {
              "name": "RHSA-2020:0086",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0086"
            },
            {
              "name": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html"
            },
            {
              "name": "RHSA-2020:0111",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0111"
            },
            {
              "name": "openSUSE-SU-2020:0060",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html"
            },
            {
              "name": "RHSA-2020:0120",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0120"
            },
            {
              "name": "RHSA-2020:0123",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0123"
            },
            {
              "name": "RHSA-2020:0127",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0127"
            },
            {
              "name": "USN-4241-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4241-1/"
            },
            {
              "name": "DSA-4603",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4603"
            },
            {
              "name": "20200120 [SECURITY] [DSA 4603-1] thunderbird security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/26"
            },
            {
              "name": "[debian-lts-announce] 20200120 [SECURITY] [DLA 2071-1] thunderbird security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html"
            },
            {
              "name": "openSUSE-SU-2020:0094",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html"
            },
            {
              "name": "RHSA-2020:0292",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0292"
            },
            {
              "name": "RHSA-2020:0295",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0295"
            },
            {
              "name": "GLSA-202003-02",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-02"
            },
            {
              "name": "USN-4335-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4335-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2019-17017",
    "datePublished": "2020-01-08T21:27:36",
    "dateReserved": "2019-09-30T00:00:00",
    "dateUpdated": "2024-08-05T01:24:48.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

suse-su-2020:0078-1

Vulnerability from csaf_suse

CVE-2019-17024 (GCVE-0-2019-17024)

Vulnerability from cvelistv5

CVE-2019-17021 (GCVE-0-2019-17021)

Vulnerability from cvelistv5

CVE-2019-17022 (GCVE-0-2019-17022)

Vulnerability from cvelistv5

CVE-2019-17015 (GCVE-0-2019-17015)

Vulnerability from cvelistv5

CVE-2019-17026 (GCVE-0-2019-17026)

Vulnerability from cvelistv5

CVE-2019-17016 (GCVE-0-2019-17016)

Vulnerability from cvelistv5

CVE-2019-17017 (GCVE-0-2019-17017)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature