suse/MozillaFirefox&distro=SUSE Linux Enterprise Server 11 SP4-LTSS

Vulnerabilities (311)

• CVE-2019-11715MedJul 23, 2019
  affected < 60.8.0esr-78.43.2fixed 60.8.0esr-78.43.2

  Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards on web sites in certain circumstances. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

• CVE-2019-11714CriJul 23, 2019
  affected < 68.2.0-78.51.4fixed 68.2.0-78.51.4

  Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in some instances. This vulnerability affects Firefox < 68.

• CVE-2019-11713CriJul 23, 2019
  affected < 60.8.0esr-78.43.2fixed 60.8.0esr-78.43.2

  A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

• CVE-2019-11712HigJul 23, 2019
  affected < 60.8.0esr-78.43.2fixed 60.8.0esr-78.43.2

  POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery (CSRF) attacks. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderb

• CVE-2019-11711HigJul 23, 2019
  affected < 60.8.0esr-78.43.2fixed 60.8.0esr-78.43.2

  When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, eve

• CVE-2019-11710CriJul 23, 2019
  affected < 68.2.0-78.51.4fixed 68.2.0-78.51.4

  Mozilla developers and community members reported memory safety bugs present in Firefox 67. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firef

• CVE-2019-11709CriJul 23, 2019
  affected < 60.8.0esr-78.43.2fixed 60.8.0esr-78.43.2

  Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulner

• CVE-2019-11708CriKEVJul 23, 2019
  affected < 60.8.0esr-78.43.2fixed 60.8.0esr-78.43.2

  Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result

• CVE-2019-11707HigKEVJul 23, 2019
  affected < 60.8.0esr-78.43.2fixed 60.8.0esr-78.43.2

  A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, an

• CVE-2018-20852MedJul 13, 2019
  affected < 68.2.0-78.51.4fixed 68.2.0-78.51.4

  http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has an

• CVE-2019-13173HigJul 2, 2019
  affected < 68.2.0-78.51.4fixed 68.2.0-78.51.4

  fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirW

• CVE-2019-10160CriJun 7, 2019
  affected < 68.2.0-78.51.4fixed 68.2.0-78.51.4

  A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password

• CVE-2019-5737HigMar 28, 2019
  affected < 68.2.0-78.51.4fixed 68.2.0-78.51.4

  In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection an

• CVE-2019-9947MedMar 23, 2019
  affected < 68.2.0-78.51.4fixed 68.2.0-78.51.4

  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path compone

• CVE-2019-9636CriMar 8, 2019
  affected < 68.2.0-78.51.4fixed 68.2.0-78.51.4

  Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The component

• CVE-2018-20406HigDec 23, 2018
  affected < 68.2.0-78.51.4fixed 68.2.0-78.51.4

  Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundr

• CVE-2018-12123MedNov 28, 2018
  affected < 68.2.0-78.51.4fixed 68.2.0-78.51.4

  Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g.

• CVE-2018-12122HigNov 28, 2018
  affected < 68.2.0-78.51.4fixed 68.2.0-78.51.4

  Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time.

• CVE-2018-12121HigNov 28, 2018
  affected < 68.2.0-78.51.4fixed 68.2.0-78.51.4

  Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to

• CVE-2018-12116HigNov 28, 2018
  affected < 68.2.0-78.51.4fixed 68.2.0-78.51.4

  Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-define