MozillaFirefox-branding-SLE (SUSE:Linux Enterprise Server 12 SP1-LTSS) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Server 12 SP1-LTSS package MozillaFirefox-branding-SLE, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (101)

• CVE-2018-18505 — CVSS 10.0 (critical): An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC…
• CVE-2017-5429 — CVSS 9.8 (critical): Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of…
• CVE-2017-5430 — CVSS 9.8 (critical): Memory safety bugs were reported in Firefox 52, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption…
• CVE-2017-5432 — CVSS 9.8 (critical): A use-after-free vulnerability occurs during certain text input selection resulting in a potentially exploitable crash. This vulnerability…
• CVE-2017-5433 — CVSS 9.8 (critical): A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the…
• CVE-2017-5434 — CVSS 9.8 (critical): A use-after-free vulnerability occurs when redirecting focus handling which results in a potentially exploitable crash. This vulnerability…
• CVE-2017-5435 — CVSS 9.8 (critical): A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions. This results in a…
• CVE-2017-5456 — CVSS 9.8 (critical): A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This…
• CVE-2017-5438 — CVSS 9.8 (critical): A use-after-free vulnerability during XSLT processing due to the result handler being held by a freed handler during handling. This results…
• CVE-2017-5439 — CVSS 9.8 (critical): A use-after-free vulnerability during XSLT processing due to poor handling of template parameters. This results in a potentially…
• CVE-2017-5440 — CVSS 9.8 (critical): A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating…
• CVE-2017-5441 — CVSS 9.8 (critical): A use-after-free vulnerability when holding a selection during scroll events. This results in a potentially exploitable crash. This…
• CVE-2017-5442 — CVSS 9.8 (critical): A use-after-free vulnerability during changes in style when manipulating DOM elements. This results in a potentially exploitable crash…
• CVE-2017-5443 — CVSS 9.8 (critical): An out-of-bounds write vulnerability while decoding improperly formed BinHex format archives. This vulnerability affects Thunderbird <…
• CVE-2017-5446 — CVSS 9.8 (critical): An out-of-bounds read when an HTTP/2 connection to a servers sends "DATA" frames with incorrect data content. This leads to a potentially…
• CVE-2017-5459 — CVSS 9.8 (critical): A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird…
• CVE-2017-5460 — CVSS 9.8 (critical): A use-after-free vulnerability in frame selection triggered by a combination of malicious script content and key presses by a user. This…
• CVE-2017-5461 — CVSS 9.8 (critical): Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1…
• CVE-2017-5464 — CVSS 9.8 (critical): During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading…
• CVE-2017-5469 — CVSS 9.8 (critical): Fixed potential buffer overflows in generated Firefox code due to CVE-2016-6354 issue in Flex. This vulnerability affects Thunderbird <…
• CVE-2017-5470 — CVSS 9.8 (critical): Memory safety bugs were reported in Firefox 53 and Firefox ESR 52.1. Some of these bugs showed evidence of memory corruption and we presume…
• CVE-2017-5472 — CVSS 9.8 (critical): A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS layout when attempting to use a node…
• CVE-2017-7749 — CVSS 9.8 (critical): A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This results in a potentially exploitable…
• CVE-2017-7750 — CVSS 9.8 (critical): A use-after-free vulnerability during video control operations when a "<track>" element holds a reference to an older window if that window…
• CVE-2017-7751 — CVSS 9.8 (critical): A use-after-free vulnerability with content viewer listeners that results in a potentially exploitable crash. This vulnerability affects…
• CVE-2017-7756 — CVSS 9.8 (critical): A use-after-free and use-after-scope vulnerability when logging errors from headers for XML HTTP Requests (XHR). This could result in a…
• CVE-2017-7757 — CVSS 9.8 (critical): A use-after-free vulnerability in IndexedDB when one of its objects is destroyed in memory while a method on it is still being executed…
• CVE-2017-7778 — CVSS 9.8 (critical): A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use…
• CVE-2018-12376 — CVSS 9.8 (critical): Memory safety bugs present in Firefox 61 and Firefox ESR 60.1. Some of these bugs showed evidence of memory corruption and we presume that…
• CVE-2018-12377 — CVSS 9.8 (critical): A use-after-free vulnerability can occur when refresh driver timers are refreshed in some circumstances during shutdown when the timer is…
• CVE-2018-12378 — CVSS 9.8 (critical): A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload…
• CVE-2018-18500 — CVSS 9.8 (critical): A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream…
• CVE-2018-18501 — CVSS 9.8 (critical): Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4. Some of these bugs showed…
• CVE-2019-11709 — CVSS 9.8 (critical): Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed…
• CVE-2019-11710 — CVSS 9.8 (critical): Mozilla developers and community members reported memory safety bugs present in Firefox 67. Some of these bugs showed evidence of memory…
• CVE-2019-11713 — CVSS 9.8 (critical): A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially…
• CVE-2019-11714 — CVSS 9.8 (critical): Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in some instances. This…
• CVE-2019-11733 — CVSS 9.8 (critical): When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It…
• CVE-2019-9812 — CVSS 9.3 (critical): Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading…
• CVE-2017-7758 — CVSS 9.1 (critical): An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while the encoder is in…
• CVE-2017-5447 — CVSS 9.1 (critical): An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitable crash and could…
• CVE-2017-5465 — CVSS 9.1 (critical): An out-of-bounds read while processing SVG content in "ConvolvePixel". This results in a crash and also allows for otherwise inaccessible…
• CVE-2018-12387 — CVSS 9.1 (critical): A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer…
• CVE-2019-11735 — CVSS 8.8 (high): Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68. Some of these bugs showed…
• CVE-2019-11751 — CVSS 8.8 (high): Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks…
• CVE-2019-11740 — CVSS 8.8 (high): Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8. Some of these…
• CVE-2017-7752 — CVSS 8.8 (high): A use-after-free vulnerability during specific user interactions with the input method editor (IME) in some languages due to how events are…
• CVE-2019-11746 — CVSS 8.8 (high): A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. This results in a…
• CVE-2017-5436 — CVSS 8.8 (high): An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially…
• CVE-2019-11712 — CVSS 8.8 (high): POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can…
• CVE-2019-11711 — CVSS 8.8 (high): When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different…
• CVE-2019-11752 — CVSS 8.8 (high): It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and…
• CVE-2017-5448 — CVSS 8.6 (high): An out-of-bounds write in "ClearKeyDecryptor" while decrypting some Clearkey-encrypted media content. The "ClearKeyDecryptor" code runs…
• CVE-2019-11716 — CVSS 8.3 (high): Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as…
• CVE-2019-9811 — CVSS 8.3 (high): As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a…
• CVE-2018-12386 — CVSS 8.1 (high): A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to…
• CVE-2018-12379 — CVSS 7.8 (high): When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading…
• CVE-2019-11753 — CVSS 7.8 (high): The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by…
• CVE-2017-7755 — CVSS 7.8 (high): The Firefox installer on Windows can be made to load malicious DLL files stored in the same directory as the installer when it is run. This…
• CVE-2017-7765 — CVSS 7.5 (high): The "Mark of the Web" was not correctly saved on Windows when files with very long names were downloaded from the Internet. Without the…
• CVE-2017-5467 — CVSS 7.5 (high): A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region. This…
• CVE-2017-5444 — CVSS 7.5 (high): A buffer overflow vulnerability while parsing "application/http-index-format" format content when the header contains improperly formatted…
• CVE-2019-11723 — CVSS 7.5 (high): A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context…
• CVE-2017-5449 — CVSS 7.5 (high): A possibly exploitable crash triggered during layout and manipulation of bidirectional unicode text in concert with CSS animations. This…
• CVE-2019-11719 — CVSS 7.5 (high): When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the…
• CVE-2016-10196 — CVSS 7.5 (high): Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause…
• CVE-2017-5455 — CVSS 7.5 (high): The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege if combined with…
• CVE-2017-7754 — CVSS 7.5 (high): An out-of-bounds read in WebGL with a maliciously crafted "ImageInfo" object during WebGL operations. This vulnerability affects Firefox <…
• CVE-2017-5454 — CVSS 7.5 (high): A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in…
• CVE-2019-11729 — CVSS 7.5 (high): Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into…
• CVE-2017-5445 — CVSS 7.5 (high): A vulnerability while parsing "application/http-index-format" format content where uninitialized values are used to create an array. This…
• CVE-2018-12385 — CVSS 7.0 (high): A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user…
• CVE-2019-11736 — CVSS 7.0 (high): The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the…
• CVE-2017-16541 — CVSS 6.5 (medium): Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP…
• CVE-2019-11742 — CVSS 6.5 (medium): A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a &lt;canvas&gt…
• CVE-2019-11747 — CVSS 6.5 (medium): The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a…
• CVE-2019-11748 — CVSS 6.5 (medium): WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party…
• CVE-2019-11750 — CVSS 6.5 (medium): A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash. This vulnerability affects Firefox < 69…
• CVE-2019-11721 — CVSS 6.5 (medium): The unicode latin 'kra' character can be used to spoof a standard 'k' character in the addressbar. This allows for domain spoofing attacks…
• CVE-2019-11725 — CVSS 6.5 (medium): When a user navigates to site marked as unsafe by the Safebrowsing API, warning messages are displayed and navigation is interrupted but…
• CVE-2019-11730 — CVSS 6.5 (medium): A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same…
• CVE-2019-11738 — CVSS 6.3 (medium): If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of…
• CVE-2019-11720 — CVSS 6.1 (medium): Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This…
• CVE-2019-11744 — CVSS 6.1 (medium): Some HTML elements, such as &lt;title&gt; and &lt;textarea&gt;, can contain literal angle brackets without treating them as markup. It is…
• CVE-2017-5466 — CVSS 6.1 (medium): If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will…
• CVE-2019-11724 — CVSS 6.1 (medium): Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been retired and now…
• CVE-2019-11715 — CVSS 6.1 (medium): Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards…
• CVE-2017-7768 — CVSS 5.5 (medium): The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by…
• CVE-2017-7761 — CVSS 5.5 (medium): The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users. When this is…
• CVE-2018-12383 — CVSS 5.5 (medium): If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still…
• CVE-2017-5462 — CVSS 5.3 (medium): A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry…
• CVE-2019-11717 — CVSS 5.3 (medium): A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator…
• CVE-2018-12381 — CVSS 5.3 (medium): Manually dragging and dropping an Outlook email message into the browser will trigger a page navigation when the message's mail columns are…
• CVE-2019-11727 — CVSS 5.3 (medium): A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures…
• CVE-2019-11718 — CVSS 5.3 (medium): Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream…
• CVE-2017-7764 — CVSS 5.3 (medium): Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of…
• CVE-2017-7763 — CVSS 5.3 (medium): Default fonts on OS X display some Tibetan characters as whitespace. When used in the addressbar as part of an IDN this can be used for…
• CVE-2019-11728 — CVSS 4.7 (medium): The HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP ports of any host that the accessible to a…
• CVE-2017-5451 — CVSS 4.3 (medium): A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event. The event could be used by…
• CVE-2019-11749 — CVSS 4.3 (medium): A vulnerability exists in WebRTC where malicious web content can use probing techniques on the getUserMedia API using constraints to reveal…
• CVE-2019-11743 — CVSS 3.7 (low): Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload…