csaf_redhat - rhsa-2019

rhsa-2019_3193

Vulnerability from csaf_redhat

Published

2019-10-24 21:33

Modified

2024-11-05 21:29

Summary

Red Hat Security Advisory: firefox security update

Notes

Topic

An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 68.2.0 ESR. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764) * Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757) * Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758) * Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759) * Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760) * Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761) * Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762) * Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for firefox is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 68.2.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764)\n\n* Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757)\n\n* Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758)\n\n* Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759)\n\n* Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760)\n\n* Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761)\n\n* Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762)\n\n* Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2019:3193",
        "url": "https://access.redhat.com/errata/RHSA-2019:3193"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "1764438",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764438"
      },
      {
        "category": "external",
        "summary": "1764439",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764439"
      },
      {
        "category": "external",
        "summary": "1764440",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764440"
      },
      {
        "category": "external",
        "summary": "1764441",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764441"
      },
      {
        "category": "external",
        "summary": "1764442",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764442"
      },
      {
        "category": "external",
        "summary": "1764443",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764443"
      },
      {
        "category": "external",
        "summary": "1764444",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764444"
      },
      {
        "category": "external",
        "summary": "1764446",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764446"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3193.json"
      }
    ],
    "title": "Red Hat Security Advisory: firefox security update",
    "tracking": {
      "current_release_date": "2024-11-05T21:29:51+00:00",
      "generator": {
        "date": "2024-11-05T21:29:51+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2019:3193",
      "initial_release_date": "2019-10-24T21:33:00+00:00",
      "revision_history": [
        {
          "date": "2019-10-24T21:33:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-10-24T21:33:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T21:29:51+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Client (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux Client (v. 7)",
                  "product_id": "7Client-7.7.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:7::client"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Client Optional (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux Client Optional (v. 7)",
                  "product_id": "7Client-optional-7.7.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:7::client"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server (v. 7)",
                  "product_id": "7Server-7.7.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:7::server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server Optional (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server Optional (v. 7)",
                  "product_id": "7Server-optional-7.7.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:7::server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Workstation (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux Workstation (v. 7)",
                  "product_id": "7Workstation-7.7.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Workstation Optional (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux Workstation Optional (v. 7)",
                  "product_id": "7Workstation-optional-7.7.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:68.2.0-1.el7_7.x86_64",
                "product": {
                  "name": "firefox-0:68.2.0-1.el7_7.x86_64",
                  "product_id": "firefox-0:68.2.0-1.el7_7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@68.2.0-1.el7_7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
                "product": {
                  "name": "firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
                  "product_id": "firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@68.2.0-1.el7_7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:68.2.0-1.el7_7.src",
                "product": {
                  "name": "firefox-0:68.2.0-1.el7_7.src",
                  "product_id": "firefox-0:68.2.0-1.el7_7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@68.2.0-1.el7_7?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:68.2.0-1.el7_7.i686",
                "product": {
                  "name": "firefox-0:68.2.0-1.el7_7.i686",
                  "product_id": "firefox-0:68.2.0-1.el7_7.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@68.2.0-1.el7_7?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:68.2.0-1.el7_7.i686",
                "product": {
                  "name": "firefox-debuginfo-0:68.2.0-1.el7_7.i686",
                  "product_id": "firefox-debuginfo-0:68.2.0-1.el7_7.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@68.2.0-1.el7_7?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:68.2.0-1.el7_7.s390x",
                "product": {
                  "name": "firefox-0:68.2.0-1.el7_7.s390x",
                  "product_id": "firefox-0:68.2.0-1.el7_7.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@68.2.0-1.el7_7?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
                "product": {
                  "name": "firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
                  "product_id": "firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@68.2.0-1.el7_7?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:68.2.0-1.el7_7.ppc64",
                "product": {
                  "name": "firefox-0:68.2.0-1.el7_7.ppc64",
                  "product_id": "firefox-0:68.2.0-1.el7_7.ppc64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@68.2.0-1.el7_7?arch=ppc64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
                "product": {
                  "name": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
                  "product_id": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@68.2.0-1.el7_7?arch=ppc64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:68.2.0-1.el7_7.ppc64le",
                "product": {
                  "name": "firefox-0:68.2.0-1.el7_7.ppc64le",
                  "product_id": "firefox-0:68.2.0-1.el7_7.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@68.2.0-1.el7_7?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
                "product": {
                  "name": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
                  "product_id": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@68.2.0-1.el7_7?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.i686 as a component of Red Hat Enterprise Linux Client (v. 7)",
          "product_id": "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.i686",
        "relates_to_product_reference": "7Client-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)",
          "product_id": "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.ppc64",
        "relates_to_product_reference": "7Client-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)",
          "product_id": "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.ppc64le",
        "relates_to_product_reference": "7Client-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)",
          "product_id": "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.s390x",
        "relates_to_product_reference": "7Client-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.src as a component of Red Hat Enterprise Linux Client (v. 7)",
          "product_id": "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.src",
        "relates_to_product_reference": "7Client-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
          "product_id": "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.x86_64",
        "relates_to_product_reference": "7Client-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.i686 as a component of Red Hat Enterprise Linux Client (v. 7)",
          "product_id": "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.i686",
        "relates_to_product_reference": "7Client-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)",
          "product_id": "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
        "relates_to_product_reference": "7Client-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)",
          "product_id": "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
        "relates_to_product_reference": "7Client-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)",
          "product_id": "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
        "relates_to_product_reference": "7Client-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
          "product_id": "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
        "relates_to_product_reference": "7Client-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.i686",
        "relates_to_product_reference": "7Client-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.ppc64",
        "relates_to_product_reference": "7Client-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.ppc64le",
        "relates_to_product_reference": "7Client-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.s390x",
        "relates_to_product_reference": "7Client-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.src as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.src",
        "relates_to_product_reference": "7Client-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.x86_64",
        "relates_to_product_reference": "7Client-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.i686",
        "relates_to_product_reference": "7Client-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
        "relates_to_product_reference": "7Client-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
        "relates_to_product_reference": "7Client-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
        "relates_to_product_reference": "7Client-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
          "product_id": "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
        "relates_to_product_reference": "7Client-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.i686 as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.i686",
        "relates_to_product_reference": "7Server-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.ppc64",
        "relates_to_product_reference": "7Server-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.ppc64le",
        "relates_to_product_reference": "7Server-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.s390x",
        "relates_to_product_reference": "7Server-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.src as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.src",
        "relates_to_product_reference": "7Server-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.x86_64",
        "relates_to_product_reference": "7Server-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.i686 as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.i686",
        "relates_to_product_reference": "7Server-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
        "relates_to_product_reference": "7Server-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
        "relates_to_product_reference": "7Server-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
        "relates_to_product_reference": "7Server-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
        "relates_to_product_reference": "7Server-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
          "product_id": "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.i686",
        "relates_to_product_reference": "7Server-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
          "product_id": "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.ppc64",
        "relates_to_product_reference": "7Server-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
          "product_id": "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.ppc64le",
        "relates_to_product_reference": "7Server-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
          "product_id": "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.s390x",
        "relates_to_product_reference": "7Server-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
          "product_id": "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.src",
        "relates_to_product_reference": "7Server-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
          "product_id": "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.x86_64",
        "relates_to_product_reference": "7Server-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
          "product_id": "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.i686",
        "relates_to_product_reference": "7Server-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
          "product_id": "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
        "relates_to_product_reference": "7Server-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
          "product_id": "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
        "relates_to_product_reference": "7Server-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
          "product_id": "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
        "relates_to_product_reference": "7Server-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
          "product_id": "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
        "relates_to_product_reference": "7Server-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.i686",
        "relates_to_product_reference": "7Workstation-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.ppc64",
        "relates_to_product_reference": "7Workstation-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.ppc64le",
        "relates_to_product_reference": "7Workstation-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.s390x",
        "relates_to_product_reference": "7Workstation-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.src as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.src",
        "relates_to_product_reference": "7Workstation-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.x86_64",
        "relates_to_product_reference": "7Workstation-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.i686",
        "relates_to_product_reference": "7Workstation-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
        "relates_to_product_reference": "7Workstation-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
        "relates_to_product_reference": "7Workstation-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
        "relates_to_product_reference": "7Workstation-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
        "relates_to_product_reference": "7Workstation-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
          "product_id": "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.i686",
        "relates_to_product_reference": "7Workstation-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
          "product_id": "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.ppc64",
        "relates_to_product_reference": "7Workstation-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
          "product_id": "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.ppc64le",
        "relates_to_product_reference": "7Workstation-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
          "product_id": "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.s390x",
        "relates_to_product_reference": "7Workstation-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
          "product_id": "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.src",
        "relates_to_product_reference": "7Workstation-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:68.2.0-1.el7_7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
          "product_id": "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64"
        },
        "product_reference": "firefox-0:68.2.0-1.el7_7.x86_64",
        "relates_to_product_reference": "7Workstation-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
          "product_id": "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.i686",
        "relates_to_product_reference": "7Workstation-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
          "product_id": "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
        "relates_to_product_reference": "7Workstation-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
          "product_id": "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
        "relates_to_product_reference": "7Workstation-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
          "product_id": "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
        "relates_to_product_reference": "7Workstation-optional-7.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:68.2.0-1.el7_7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
          "product_id": "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
        },
        "product_reference": "firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
        "relates_to_product_reference": "7Workstation-optional-7.7.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "the Mozilla project"
          ]
        },
        {
          "names": [
            "Zhanjia Song"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2019-11757",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2019-10-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1764438"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A use-after-free flaw was found in Mozilla Firefox and Thunderbird. When following a value\u0027s prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. An attacker could use this flaw to execute code that was stored in the referenced memory or crash the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Mozilla: Use-after-free when creating index updates in IndexedDB",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-11757"
        },
        {
          "category": "external",
          "summary": "RHBZ#1764438",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764438"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11757",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-11757"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11757",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11757"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11757",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11757"
        }
      ],
      "release_date": "2019-10-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-24T21:33:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
          "product_ids": [
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3193"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Mozilla: Use-after-free when creating index updates in IndexedDB"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "the Mozilla project"
          ]
        },
        {
          "names": [
            "Mozilla developers and community"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2019-11758",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "discovery_date": "2019-10-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1764439"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the 360 Total Security code in Firefox and Thunderbird. Memory corruption is possible in the accessibility engine that could lead to an exploit to run arbitrary code. This vulnerability could be exploited over a network connection and would affect confidentiality and integrity of information as well as availability of the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Mozilla: Potentially exploitable crash due to 360 Total Security",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-11758"
        },
        {
          "category": "external",
          "summary": "RHBZ#1764439",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764439"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11758",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-11758"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11758",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11758"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11758",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11758"
        }
      ],
      "release_date": "2019-10-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-24T21:33:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
          "product_ids": [
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3193"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Mozilla: Potentially exploitable crash due to 360 Total Security"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "the Mozilla project"
          ]
        },
        {
          "names": [
            "Guido Vranken"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2019-11759",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2019-10-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1764440"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in both Firefox and Thunderbird where 4 bytes of a HMAC output could be written past the end of a buffer stored on the memory stack. This could allow an attacker to execute arbitrary code or lead to a crash. This flaw can be exploited over the network.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Mozilla: Stack buffer overflow in HKDF output",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-11759"
        },
        {
          "category": "external",
          "summary": "RHBZ#1764440",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764440"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11759",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-11759"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11759",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11759"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11759",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11759"
        }
      ],
      "release_date": "2019-10-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-24T21:33:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
          "product_ids": [
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3193"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Mozilla: Stack buffer overflow in HKDF output"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "the Mozilla project"
          ]
        },
        {
          "names": [
            "Nils"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2019-11760",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2019-10-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1764441"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in Mozilla Firefox and Thunderbird where a fixed-stack buffer overflow could occur during WebRTC signalling. The vulnerability could lead to an exploitable crash or leak data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Mozilla: Stack buffer overflow in WebRTC networking",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-11760"
        },
        {
          "category": "external",
          "summary": "RHBZ#1764441",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764441"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11760",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-11760"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11760",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11760"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11760",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11760"
        }
      ],
      "release_date": "2019-10-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-24T21:33:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
          "product_ids": [
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3193"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Mozilla: Stack buffer overflow in WebRTC networking"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "the Mozilla project"
          ]
        },
        {
          "names": [
            "Cody Crews"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2019-11761",
      "cwe": {
        "id": "CWE-749",
        "name": "Exposed Dangerous Method or Function"
      },
      "discovery_date": "2019-10-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1764442"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Mozilla Firefox and Thunderbird. Privileged JSONView objects that have been cloned into content can be accessed using a form with a data URI. This flaw bypasses existing defense-in-depth mechanisms and can be exploited over the network.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Mozilla: Unintended access to a privileged JSONView object",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-11761"
        },
        {
          "category": "external",
          "summary": "RHBZ#1764442",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764442"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11761",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-11761"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11761",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11761"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11761",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11761"
        }
      ],
      "release_date": "2019-10-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-24T21:33:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
          "product_ids": [
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3193"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Mozilla: Unintended access to a privileged JSONView object"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "the Mozilla project"
          ]
        },
        {
          "names": [
            "Kris Maglione"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2019-11762",
      "cwe": {
        "id": "CWE-829",
        "name": "Inclusion of Functionality from Untrusted Control Sphere"
      },
      "discovery_date": "2019-10-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1764443"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Mozilla\u0027s firefox and thunderbird where if two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin window. This could cause an interaction between two different sites on two different windows running under the same application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Mozilla: document.domain-based origin isolation has same-origin-property violation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-11762"
        },
        {
          "category": "external",
          "summary": "RHBZ#1764443",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764443"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11762",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-11762"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11762",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11762"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11762",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11762"
        }
      ],
      "release_date": "2019-10-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-24T21:33:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
          "product_ids": [
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3193"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Mozilla: document.domain-based origin isolation has same-origin-property violation"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "the Mozilla project"
          ]
        },
        {
          "names": [
            "Gareth Heyes"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2019-11763",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2019-10-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1764444"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Mozilla Firefox and Thunderbird where null bytes were incorrectly parsed in HTML entities. This could lead to HTML comments being treated as code which could lead to XSS in a web application or HTML entities being masked from filters.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Mozilla: Incorrect HTML parsing results in XSS bypass technique",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-11763"
        },
        {
          "category": "external",
          "summary": "RHBZ#1764444",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764444"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11763",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-11763"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11763",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11763"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11763",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11763"
        }
      ],
      "release_date": "2019-10-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-24T21:33:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
          "product_ids": [
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3193"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Mozilla: Incorrect HTML parsing results in XSS bypass technique"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "the Mozilla project"
          ]
        },
        {
          "names": [
            "Aaron Klotz",
            "Jason Kratzer",
            "Steve Fink",
            "Tyson Smith",
            "Bob Clary",
            "Byron Campen",
            "Christian Holler",
            "Cristian Brindusan",
            "Honza Bambas",
            "Iain Ireland"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2019-11764",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2019-10-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1764446"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could be exploited to run arbitrary code. This vulnerability affects Firefox \u003c 70, Thunderbird \u003c 68.2, and Firefox ESR \u003c 68.2.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-11764"
        },
        {
          "category": "external",
          "summary": "RHBZ#1764446",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764446"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11764",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-11764"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11764",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11764"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11764",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11764"
        }
      ],
      "release_date": "2019-10-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-24T21:33:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
          "product_ids": [
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3193"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2"
    },
    {
      "cve": "CVE-2019-15903",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2019-09-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1752592"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "expat: heap-based buffer over-read via crafted XML input",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
          "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
          "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-15903"
        },
        {
          "category": "external",
          "summary": "RHBZ#1752592",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752592"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-15903",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-15903"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-15903",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15903"
        }
      ],
      "release_date": "2019-09-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-24T21:33:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
          "product_ids": [
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3193"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Client-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Client-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Server-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Server-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.src",
            "7Workstation-optional-7.7.Z:firefox-0:68.2.0-1.el7_7.x86_64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.i686",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.ppc64le",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.s390x",
            "7Workstation-optional-7.7.Z:firefox-debuginfo-0:68.2.0-1.el7_7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "expat: heap-based buffer over-read via crafted XML input"
    }
  ]
}

cve-2019-11764

Vulnerability from cvelistv5

Published

2020-01-08 20:02

Modified

2024-08-04 23:03

Severity ?

Summary

Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

References

▼	URL	Tags
	https://bugzilla.mozilla.org/buglist.cgi?bug_id=1558522%2C1577061%2C1548044%2C1571223%2C1573048%2C1578933%2C1575217%2C1583684%2C1586845%2C1581950%2C1583463%2C1586599	x_refsource_MISC
	https://www.mozilla.org/security/advisories/mfsa2019-35/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2019-33/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2019-34/	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202003-10	vendor-advisory, x_refsource_GENTOO
	https://usn.ubuntu.com/4335-1/	vendor-advisory, x_refsource_UBUNTU

Impacted products

▼	Vendor	Product
	Mozilla	Firefox
	Mozilla	Thunderbird
	Mozilla	Firefox ESR

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:03:32.792Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1558522%2C1577061%2C1548044%2C1571223%2C1573048%2C1578933%2C1575217%2C1583684%2C1586845%2C1581950%2C1583463%2C1586599"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
          },
          {
            "name": "GLSA-202003-10",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-10"
          },
          {
            "name": "USN-4335-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4335-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 70"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.2"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could be exploited to run arbitrary code. This vulnerability affects Firefox \u003c 70, Thunderbird \u003c 68.2, and Firefox ESR \u003c 68.2."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Memory safety bugs fixed in Thunderbird 68.2",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-29T02:06:52",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1558522%2C1577061%2C1548044%2C1571223%2C1573048%2C1578933%2C1575217%2C1583684%2C1586845%2C1581950%2C1583463%2C1586599"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
        },
        {
          "name": "GLSA-202003-10",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-10"
        },
        {
          "name": "USN-4335-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4335-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2019-11764",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 70"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Thunderbird",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could be exploited to run arbitrary code. This vulnerability affects Firefox \u003c 70, Thunderbird \u003c 68.2, and Firefox ESR \u003c 68.2."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Memory safety bugs fixed in Thunderbird 68.2"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1558522%2C1577061%2C1548044%2C1571223%2C1573048%2C1578933%2C1575217%2C1583684%2C1586845%2C1581950%2C1583463%2C1586599",
              "refsource": "MISC",
              "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1558522%2C1577061%2C1548044%2C1571223%2C1573048%2C1578933%2C1575217%2C1583684%2C1586845%2C1581950%2C1583463%2C1586599"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-35/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-33/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-34/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
            },
            {
              "name": "GLSA-202003-10",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-10"
            },
            {
              "name": "USN-4335-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4335-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2019-11764",
    "datePublished": "2020-01-08T20:02:22",
    "dateReserved": "2019-05-03T00:00:00",
    "dateUpdated": "2024-08-04T23:03:32.792Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2019-11761

Vulnerability from cvelistv5

Published

2020-01-08 19:52

Modified

2024-08-04 23:03

Severity ?

Summary

By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2019-35/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2019-33/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2019-34/	x_refsource_CONFIRM
	https://bugzilla.mozilla.org/show_bug.cgi?id=1561502	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202003-10	vendor-advisory, x_refsource_GENTOO
	https://usn.ubuntu.com/4335-1/	vendor-advisory, x_refsource_UBUNTU

Impacted products

▼	Vendor	Product
	Mozilla	Firefox
	Mozilla	Thunderbird
	Mozilla	Firefox ESR

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:03:32.758Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1561502"
          },
          {
            "name": "GLSA-202003-10",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-10"
          },
          {
            "name": "USN-4335-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4335-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 70"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.2"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox \u003c 70, Thunderbird \u003c 68.2, and Firefox ESR \u003c 68.2."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Unintended access to a privileged JSONView object",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-29T02:07:10",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1561502"
        },
        {
          "name": "GLSA-202003-10",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-10"
        },
        {
          "name": "USN-4335-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4335-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2019-11761",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 70"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Thunderbird",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox \u003c 70, Thunderbird \u003c 68.2, and Firefox ESR \u003c 68.2."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Unintended access to a privileged JSONView object"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-35/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-33/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-34/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1561502",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1561502"
            },
            {
              "name": "GLSA-202003-10",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-10"
            },
            {
              "name": "USN-4335-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4335-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2019-11761",
    "datePublished": "2020-01-08T19:52:08",
    "dateReserved": "2019-05-03T00:00:00",
    "dateUpdated": "2024-08-04T23:03:32.758Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2019-11758

Vulnerability from cvelistv5

Published

2020-01-08 19:28

Modified

2024-08-04 23:03

Severity ?

Summary

Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed evidence of memory corruption in the accessibility engine and we presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.2, and Firefox ESR < 68.2.

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2019-25/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2019-35/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2019-33/	x_refsource_CONFIRM
	https://bugzilla.mozilla.org/show_bug.cgi?id=1536227	x_refsource_CONFIRM
	https://usn.ubuntu.com/4335-1/	vendor-advisory, x_refsource_UBUNTU

Impacted products

▼	Vendor	Product
	Mozilla	Firefox
	Mozilla	Thunderbird
	Mozilla	Firefox ESR

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:03:32.870Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-25/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1536227"
          },
          {
            "name": "USN-4335-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4335-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 69"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.2"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed evidence of memory corruption in the accessibility engine and we presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox \u003c 69, Thunderbird \u003c 68.2, and Firefox ESR \u003c 68.2."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Potentially exploitable crash due to 360 Total Security",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-29T02:06:59",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-25/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1536227"
        },
        {
          "name": "USN-4335-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4335-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2019-11758",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 69"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Thunderbird",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed evidence of memory corruption in the accessibility engine and we presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox \u003c 69, Thunderbird \u003c 68.2, and Firefox ESR \u003c 68.2."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Potentially exploitable crash due to 360 Total Security"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-25/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-25/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-35/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-33/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1536227",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1536227"
            },
            {
              "name": "USN-4335-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4335-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2019-11758",
    "datePublished": "2020-01-08T19:28:31",
    "dateReserved": "2019-05-03T00:00:00",
    "dateUpdated": "2024-08-04T23:03:32.870Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2019-11757

Vulnerability from cvelistv5

Published

2020-01-08 19:26

Modified

2024-08-04 23:03

Severity ?

Summary

When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. This resulted in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2019-35/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2019-33/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2019-34/	x_refsource_CONFIRM
	https://bugzilla.mozilla.org/show_bug.cgi?id=1577107	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202003-10	vendor-advisory, x_refsource_GENTOO
	https://usn.ubuntu.com/4335-1/	vendor-advisory, x_refsource_UBUNTU

Impacted products

▼	Vendor	Product
	Mozilla	Firefox
	Mozilla	Thunderbird
	Mozilla	Firefox ESR

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:03:32.724Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1577107"
          },
          {
            "name": "GLSA-202003-10",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-10"
          },
          {
            "name": "USN-4335-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4335-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 70"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.2"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When following the value\u0027s prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. This resulted in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox \u003c 70, Thunderbird \u003c 68.2, and Firefox ESR \u003c 68.2."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Use-after-free when creating index updates in IndexedDB",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-29T02:07:08",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1577107"
        },
        {
          "name": "GLSA-202003-10",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-10"
        },
        {
          "name": "USN-4335-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4335-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2019-11757",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 70"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Thunderbird",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "When following the value\u0027s prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. This resulted in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox \u003c 70, Thunderbird \u003c 68.2, and Firefox ESR \u003c 68.2."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Use-after-free when creating index updates in IndexedDB"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-35/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-33/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-34/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1577107",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1577107"
            },
            {
              "name": "GLSA-202003-10",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-10"
            },
            {
              "name": "USN-4335-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4335-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2019-11757",
    "datePublished": "2020-01-08T19:26:23",
    "dateReserved": "2019-05-03T00:00:00",
    "dateUpdated": "2024-08-04T23:03:32.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2019-11763

Vulnerability from cvelistv5

Published

2020-01-08 19:59

Modified

2024-08-04 23:03

Severity ?

Summary

Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could have led to XSS in a web application under certain conditions. It could have also led to HTML entities being masked from filters - enabling the use of entities to mask the actual characters of interest from filters. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2019-35/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2019-33/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2019-34/	x_refsource_CONFIRM
	https://bugzilla.mozilla.org/show_bug.cgi?id=1584216	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202003-10	vendor-advisory, x_refsource_GENTOO
	https://usn.ubuntu.com/4335-1/	vendor-advisory, x_refsource_UBUNTU

Impacted products

▼	Vendor	Product
	Mozilla	Firefox
	Mozilla	Thunderbird
	Mozilla	Firefox ESR

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:03:32.794Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1584216"
          },
          {
            "name": "GLSA-202003-10",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-10"
          },
          {
            "name": "USN-4335-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4335-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 70"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.2"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could have led to XSS in a web application under certain conditions. It could have also led to HTML entities being masked from filters - enabling the use of entities to mask the actual characters of interest from filters. This vulnerability affects Firefox \u003c 70, Thunderbird \u003c 68.2, and Firefox ESR \u003c 68.2."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Incorrect HTML parsing results in XSS bypass technique",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-29T02:07:16",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1584216"
        },
        {
          "name": "GLSA-202003-10",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-10"
        },
        {
          "name": "USN-4335-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4335-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2019-11763",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 70"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Thunderbird",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could have led to XSS in a web application under certain conditions. It could have also led to HTML entities being masked from filters - enabling the use of entities to mask the actual characters of interest from filters. This vulnerability affects Firefox \u003c 70, Thunderbird \u003c 68.2, and Firefox ESR \u003c 68.2."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Incorrect HTML parsing results in XSS bypass technique"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-35/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-33/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-34/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1584216",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1584216"
            },
            {
              "name": "GLSA-202003-10",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-10"
            },
            {
              "name": "USN-4335-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4335-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2019-11763",
    "datePublished": "2020-01-08T19:59:44",
    "dateReserved": "2019-05-03T00:00:00",
    "dateUpdated": "2024-08-04T23:03:32.794Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2019-11760

Vulnerability from cvelistv5

Published

2020-01-08 19:51

Modified

2024-08-04 23:03

Severity ?

Summary

A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2019-35/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2019-33/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2019-34/	x_refsource_CONFIRM
	https://bugzilla.mozilla.org/show_bug.cgi?id=1577719	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202003-10	vendor-advisory, x_refsource_GENTOO
	https://usn.ubuntu.com/4335-1/	vendor-advisory, x_refsource_UBUNTU

Impacted products

▼	Vendor	Product
	Mozilla	Firefox
	Mozilla	Thunderbird
	Mozilla	Firefox ESR

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:03:32.760Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1577719"
          },
          {
            "name": "GLSA-202003-10",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-10"
          },
          {
            "name": "USN-4335-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4335-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 70"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.2"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances. This vulnerability affects Firefox \u003c 70, Thunderbird \u003c 68.2, and Firefox ESR \u003c 68.2."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Stack buffer overflow in WebRTC networking",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-29T02:07:06",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1577719"
        },
        {
          "name": "GLSA-202003-10",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-10"
        },
        {
          "name": "USN-4335-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4335-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2019-11760",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 70"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Thunderbird",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances. This vulnerability affects Firefox \u003c 70, Thunderbird \u003c 68.2, and Firefox ESR \u003c 68.2."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Stack buffer overflow in WebRTC networking"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-35/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-33/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-34/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1577719",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1577719"
            },
            {
              "name": "GLSA-202003-10",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-10"
            },
            {
              "name": "USN-4335-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4335-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2019-11760",
    "datePublished": "2020-01-08T19:51:19",
    "dateReserved": "2019-05-03T00:00:00",
    "dateUpdated": "2024-08-04T23:03:32.760Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2019-15903

Vulnerability from cvelistv5

Published

2019-09-04 05:59

Modified

2024-08-05 01:03

Severity ?

Summary

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.

References

▼	URL	Tags
	https://usn.ubuntu.com/4132-1/	vendor-advisory, x_refsource_UBUNTU
	https://seclists.org/bugtraq/2019/Sep/30	mailing-list, x_refsource_BUGTRAQ
	https://usn.ubuntu.com/4132-2/	vendor-advisory, x_refsource_UBUNTU
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BDUTI5TVQWIGGQXPEVI4T2ENHFSBMIBP/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2019/dsa-4530	vendor-advisory, x_refsource_DEBIAN
	https://seclists.org/bugtraq/2019/Sep/37	mailing-list, x_refsource_BUGTRAQ
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A4TZKPJFTURRLXIGLB34WVKQ5HGY6JJA/	vendor-advisory, x_refsource_FEDORA
	http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00081.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00080.html	vendor-advisory, x_refsource_SUSE
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S26LGXXQ7YF2BP3RGOWELBFKM6BHF6UG/	vendor-advisory, x_refsource_FEDORA
	https://seclists.org/bugtraq/2019/Oct/29	mailing-list, x_refsource_BUGTRAQ
	https://usn.ubuntu.com/4165-1/	vendor-advisory, x_refsource_UBUNTU
	https://www.debian.org/security/2019/dsa-4549	vendor-advisory, x_refsource_DEBIAN
	https://access.redhat.com/errata/RHSA-2019:3210	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2019:3237	vendor-advisory, x_refsource_REDHAT
	https://seclists.org/bugtraq/2019/Nov/1	mailing-list, x_refsource_BUGTRAQ
	http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00000.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00002.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00003.html	vendor-advisory, x_refsource_SUSE
	https://access.redhat.com/errata/RHSA-2019:3756	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00013.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00016.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00018.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00017.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00019.html	vendor-advisory, x_refsource_SUSE
	https://lists.debian.org/debian-lts-announce/2019/11/msg00006.html	mailing-list, x_refsource_MLIST
	https://seclists.org/bugtraq/2019/Nov/24	mailing-list, x_refsource_BUGTRAQ
	https://www.debian.org/security/2019/dsa-4571	vendor-advisory, x_refsource_DEBIAN
	https://lists.debian.org/debian-lts-announce/2019/11/msg00017.html	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/201911-08	vendor-advisory, x_refsource_GENTOO
	https://usn.ubuntu.com/4202-1/	vendor-advisory, x_refsource_UBUNTU
	https://seclists.org/bugtraq/2019/Dec/17	mailing-list, x_refsource_BUGTRAQ
	https://seclists.org/bugtraq/2019/Dec/21	mailing-list, x_refsource_BUGTRAQ
	https://seclists.org/bugtraq/2019/Dec/23	mailing-list, x_refsource_BUGTRAQ
	http://seclists.org/fulldisclosure/2019/Dec/23	mailing-list, x_refsource_FULLDISC
	http://seclists.org/fulldisclosure/2019/Dec/26	mailing-list, x_refsource_FULLDISC
	http://seclists.org/fulldisclosure/2019/Dec/30	mailing-list, x_refsource_FULLDISC
	http://seclists.org/fulldisclosure/2019/Dec/27	mailing-list, x_refsource_FULLDISC
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00008.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html	vendor-advisory, x_refsource_SUSE
	https://usn.ubuntu.com/4335-1/	vendor-advisory, x_refsource_UBUNTU
	https://www.oracle.com/security-alerts/cpuapr2020.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
	https://github.com/libexpat/libexpat/issues/317	x_refsource_MISC
	https://github.com/libexpat/libexpat/pull/318	x_refsource_MISC
	https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43	x_refsource_MISC
	https://github.com/libexpat/libexpat/issues/342	x_refsource_CONFIRM
	http://packetstormsecurity.com/files/154503/Slackware-Security-Advisory-expat-Updates.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20190926-0004/	x_refsource_CONFIRM
	http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html	x_refsource_MISC
	http://packetstormsecurity.com/files/154947/Slackware-Security-Advisory-mozilla-firefox-Updates.html	x_refsource_MISC
	https://support.apple.com/kb/HT210788	x_refsource_CONFIRM
	https://support.apple.com/kb/HT210790	x_refsource_CONFIRM
	https://support.apple.com/kb/HT210785	x_refsource_CONFIRM
	https://support.apple.com/kb/HT210789	x_refsource_CONFIRM
	https://support.apple.com/kb/HT210793	x_refsource_CONFIRM
	https://support.apple.com/kb/HT210795	x_refsource_CONFIRM
	https://support.apple.com/kb/HT210794	x_refsource_CONFIRM
	https://www.tenable.com/security/tns-2021-11	x_refsource_CONFIRM

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:03:32.547Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-4132-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4132-1/"
          },
          {
            "name": "20190917 [slackware-security] expat (SSA:2019-259-01)",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Sep/30"
          },
          {
            "name": "USN-4132-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4132-2/"
          },
          {
            "name": "FEDORA-2019-613edfe68b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BDUTI5TVQWIGGQXPEVI4T2ENHFSBMIBP/"
          },
          {
            "name": "DSA-4530",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4530"
          },
          {
            "name": "20190923 [SECURITY] [DSA 4530-1] expat security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Sep/37"
          },
          {
            "name": "FEDORA-2019-9505c6b555",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A4TZKPJFTURRLXIGLB34WVKQ5HGY6JJA/"
          },
          {
            "name": "openSUSE-SU-2019:2205",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00081.html"
          },
          {
            "name": "openSUSE-SU-2019:2204",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00080.html"
          },
          {
            "name": "FEDORA-2019-672ae0f060",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S26LGXXQ7YF2BP3RGOWELBFKM6BHF6UG/"
          },
          {
            "name": "20191021 [slackware-security] python (SSA:2019-293-01)",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Oct/29"
          },
          {
            "name": "USN-4165-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4165-1/"
          },
          {
            "name": "DSA-4549",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4549"
          },
          {
            "name": "RHSA-2019:3210",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3210"
          },
          {
            "name": "RHSA-2019:3237",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3237"
          },
          {
            "name": "20191101 [SECURITY] [DSA 4549-1] firefox-esr security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Nov/1"
          },
          {
            "name": "openSUSE-SU-2019:2420",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00000.html"
          },
          {
            "name": "openSUSE-SU-2019:2424",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00002.html"
          },
          {
            "name": "openSUSE-SU-2019:2425",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00003.html"
          },
          {
            "name": "RHSA-2019:3756",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3756"
          },
          {
            "name": "openSUSE-SU-2019:2447",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00013.html"
          },
          {
            "name": "openSUSE-SU-2019:2451",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00016.html"
          },
          {
            "name": "openSUSE-SU-2019:2452",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00018.html"
          },
          {
            "name": "openSUSE-SU-2019:2459",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00017.html"
          },
          {
            "name": "openSUSE-SU-2019:2464",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00019.html"
          },
          {
            "name": "[debian-lts-announce] 20191110 [SECURITY] [DLA 1987-1] firefox-esr security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00006.html"
          },
          {
            "name": "20191118 [SECURITY] [DSA 4571-1] thunderbird security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Nov/24"
          },
          {
            "name": "DSA-4571",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4571"
          },
          {
            "name": "[debian-lts-announce] 20191118 [SECURITY] [DLA 1997-1] thunderbird security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00017.html"
          },
          {
            "name": "GLSA-201911-08",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201911-08"
          },
          {
            "name": "USN-4202-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4202-1/"
          },
          {
            "name": "20191211 APPLE-SA-2019-12-10-8 watchOS 6.1.1",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Dec/17"
          },
          {
            "name": "20191211 APPLE-SA-2019-12-10-5 tvOS 13.3",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Dec/21"
          },
          {
            "name": "20191211 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Dec/23"
          },
          {
            "name": "20191213 APPLE-SA-2019-12-10-1 iOS 13.3 and iPadOS 13.3",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2019/Dec/23"
          },
          {
            "name": "20191213 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2019/Dec/26"
          },
          {
            "name": "20191213 APPLE-SA-2019-12-10-8 watchOS 6.1.1",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2019/Dec/30"
          },
          {
            "name": "20191213 APPLE-SA-2019-12-10-5 tvOS 13.3",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2019/Dec/27"
          },
          {
            "name": "openSUSE-SU-2020:0010",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00008.html"
          },
          {
            "name": "openSUSE-SU-2020:0086",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html"
          },
          {
            "name": "USN-4335-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4335-1/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/libexpat/libexpat/issues/317"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/libexpat/libexpat/pull/318"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/libexpat/libexpat/issues/342"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/154503/Slackware-Security-Advisory-expat-Updates.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190926-0004/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/154947/Slackware-Security-Advisory-mozilla-firefox-Updates.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT210788"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT210790"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT210785"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT210789"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT210793"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT210795"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT210794"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2021-11"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-15T22:06:15",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-4132-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4132-1/"
        },
        {
          "name": "20190917 [slackware-security] expat (SSA:2019-259-01)",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/Sep/30"
        },
        {
          "name": "USN-4132-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4132-2/"
        },
        {
          "name": "FEDORA-2019-613edfe68b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BDUTI5TVQWIGGQXPEVI4T2ENHFSBMIBP/"
        },
        {
          "name": "DSA-4530",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4530"
        },
        {
          "name": "20190923 [SECURITY] [DSA 4530-1] expat security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/Sep/37"
        },
        {
          "name": "FEDORA-2019-9505c6b555",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A4TZKPJFTURRLXIGLB34WVKQ5HGY6JJA/"
        },
        {
          "name": "openSUSE-SU-2019:2205",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00081.html"
        },
        {
          "name": "openSUSE-SU-2019:2204",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00080.html"
        },
        {
          "name": "FEDORA-2019-672ae0f060",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S26LGXXQ7YF2BP3RGOWELBFKM6BHF6UG/"
        },
        {
          "name": "20191021 [slackware-security] python (SSA:2019-293-01)",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/Oct/29"
        },
        {
          "name": "USN-4165-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4165-1/"
        },
        {
          "name": "DSA-4549",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4549"
        },
        {
          "name": "RHSA-2019:3210",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3210"
        },
        {
          "name": "RHSA-2019:3237",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3237"
        },
        {
          "name": "20191101 [SECURITY] [DSA 4549-1] firefox-esr security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/Nov/1"
        },
        {
          "name": "openSUSE-SU-2019:2420",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00000.html"
        },
        {
          "name": "openSUSE-SU-2019:2424",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00002.html"
        },
        {
          "name": "openSUSE-SU-2019:2425",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00003.html"
        },
        {
          "name": "RHSA-2019:3756",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3756"
        },
        {
          "name": "openSUSE-SU-2019:2447",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00013.html"
        },
        {
          "name": "openSUSE-SU-2019:2451",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00016.html"
        },
        {
          "name": "openSUSE-SU-2019:2452",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00018.html"
        },
        {
          "name": "openSUSE-SU-2019:2459",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00017.html"
        },
        {
          "name": "openSUSE-SU-2019:2464",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00019.html"
        },
        {
          "name": "[debian-lts-announce] 20191110 [SECURITY] [DLA 1987-1] firefox-esr security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00006.html"
        },
        {
          "name": "20191118 [SECURITY] [DSA 4571-1] thunderbird security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/Nov/24"
        },
        {
          "name": "DSA-4571",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4571"
        },
        {
          "name": "[debian-lts-announce] 20191118 [SECURITY] [DLA 1997-1] thunderbird security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00017.html"
        },
        {
          "name": "GLSA-201911-08",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201911-08"
        },
        {
          "name": "USN-4202-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4202-1/"
        },
        {
          "name": "20191211 APPLE-SA-2019-12-10-8 watchOS 6.1.1",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/Dec/17"
        },
        {
          "name": "20191211 APPLE-SA-2019-12-10-5 tvOS 13.3",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/Dec/21"
        },
        {
          "name": "20191211 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/Dec/23"
        },
        {
          "name": "20191213 APPLE-SA-2019-12-10-1 iOS 13.3 and iPadOS 13.3",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2019/Dec/23"
        },
        {
          "name": "20191213 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2019/Dec/26"
        },
        {
          "name": "20191213 APPLE-SA-2019-12-10-8 watchOS 6.1.1",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2019/Dec/30"
        },
        {
          "name": "20191213 APPLE-SA-2019-12-10-5 tvOS 13.3",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2019/Dec/27"
        },
        {
          "name": "openSUSE-SU-2020:0010",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00008.html"
        },
        {
          "name": "openSUSE-SU-2020:0086",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html"
        },
        {
          "name": "USN-4335-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4335-1/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/libexpat/libexpat/issues/317"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/libexpat/libexpat/pull/318"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/libexpat/libexpat/issues/342"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/154503/Slackware-Security-Advisory-expat-Updates.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190926-0004/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/154947/Slackware-Security-Advisory-mozilla-firefox-Updates.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.apple.com/kb/HT210788"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.apple.com/kb/HT210790"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.apple.com/kb/HT210785"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.apple.com/kb/HT210789"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.apple.com/kb/HT210793"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.apple.com/kb/HT210795"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.apple.com/kb/HT210794"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tenable.com/security/tns-2021-11"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-15903",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-4132-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4132-1/"
            },
            {
              "name": "20190917 [slackware-security] expat (SSA:2019-259-01)",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/Sep/30"
            },
            {
              "name": "USN-4132-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4132-2/"
            },
            {
              "name": "FEDORA-2019-613edfe68b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BDUTI5TVQWIGGQXPEVI4T2ENHFSBMIBP/"
            },
            {
              "name": "DSA-4530",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4530"
            },
            {
              "name": "20190923 [SECURITY] [DSA 4530-1] expat security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/Sep/37"
            },
            {
              "name": "FEDORA-2019-9505c6b555",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A4TZKPJFTURRLXIGLB34WVKQ5HGY6JJA/"
            },
            {
              "name": "openSUSE-SU-2019:2205",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00081.html"
            },
            {
              "name": "openSUSE-SU-2019:2204",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00080.html"
            },
            {
              "name": "FEDORA-2019-672ae0f060",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S26LGXXQ7YF2BP3RGOWELBFKM6BHF6UG/"
            },
            {
              "name": "20191021 [slackware-security] python (SSA:2019-293-01)",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/Oct/29"
            },
            {
              "name": "USN-4165-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4165-1/"
            },
            {
              "name": "DSA-4549",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4549"
            },
            {
              "name": "RHSA-2019:3210",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3210"
            },
            {
              "name": "RHSA-2019:3237",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3237"
            },
            {
              "name": "20191101 [SECURITY] [DSA 4549-1] firefox-esr security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/Nov/1"
            },
            {
              "name": "openSUSE-SU-2019:2420",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00000.html"
            },
            {
              "name": "openSUSE-SU-2019:2424",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00002.html"
            },
            {
              "name": "openSUSE-SU-2019:2425",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00003.html"
            },
            {
              "name": "RHSA-2019:3756",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3756"
            },
            {
              "name": "openSUSE-SU-2019:2447",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00013.html"
            },
            {
              "name": "openSUSE-SU-2019:2451",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00016.html"
            },
            {
              "name": "openSUSE-SU-2019:2452",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00018.html"
            },
            {
              "name": "openSUSE-SU-2019:2459",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00017.html"
            },
            {
              "name": "openSUSE-SU-2019:2464",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00019.html"
            },
            {
              "name": "[debian-lts-announce] 20191110 [SECURITY] [DLA 1987-1] firefox-esr security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00006.html"
            },
            {
              "name": "20191118 [SECURITY] [DSA 4571-1] thunderbird security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/Nov/24"
            },
            {
              "name": "DSA-4571",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4571"
            },
            {
              "name": "[debian-lts-announce] 20191118 [SECURITY] [DLA 1997-1] thunderbird security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00017.html"
            },
            {
              "name": "GLSA-201911-08",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201911-08"
            },
            {
              "name": "USN-4202-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4202-1/"
            },
            {
              "name": "20191211 APPLE-SA-2019-12-10-8 watchOS 6.1.1",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/Dec/17"
            },
            {
              "name": "20191211 APPLE-SA-2019-12-10-5 tvOS 13.3",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/Dec/21"
            },
            {
              "name": "20191211 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/Dec/23"
            },
            {
              "name": "20191213 APPLE-SA-2019-12-10-1 iOS 13.3 and iPadOS 13.3",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2019/Dec/23"
            },
            {
              "name": "20191213 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2019/Dec/26"
            },
            {
              "name": "20191213 APPLE-SA-2019-12-10-8 watchOS 6.1.1",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2019/Dec/30"
            },
            {
              "name": "20191213 APPLE-SA-2019-12-10-5 tvOS 13.3",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2019/Dec/27"
            },
            {
              "name": "openSUSE-SU-2020:0010",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00008.html"
            },
            {
              "name": "openSUSE-SU-2020:0086",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html"
            },
            {
              "name": "USN-4335-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4335-1/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://github.com/libexpat/libexpat/issues/317",
              "refsource": "MISC",
              "url": "https://github.com/libexpat/libexpat/issues/317"
            },
            {
              "name": "https://github.com/libexpat/libexpat/pull/318",
              "refsource": "MISC",
              "url": "https://github.com/libexpat/libexpat/pull/318"
            },
            {
              "name": "https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43",
              "refsource": "MISC",
              "url": "https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43"
            },
            {
              "name": "https://github.com/libexpat/libexpat/issues/342",
              "refsource": "CONFIRM",
              "url": "https://github.com/libexpat/libexpat/issues/342"
            },
            {
              "name": "http://packetstormsecurity.com/files/154503/Slackware-Security-Advisory-expat-Updates.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/154503/Slackware-Security-Advisory-expat-Updates.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190926-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190926-0004/"
            },
            {
              "name": "http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/154947/Slackware-Security-Advisory-mozilla-firefox-Updates.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/154947/Slackware-Security-Advisory-mozilla-firefox-Updates.html"
            },
            {
              "name": "https://support.apple.com/kb/HT210788",
              "refsource": "CONFIRM",
              "url": "https://support.apple.com/kb/HT210788"
            },
            {
              "name": "https://support.apple.com/kb/HT210790",
              "refsource": "CONFIRM",
              "url": "https://support.apple.com/kb/HT210790"
            },
            {
              "name": "https://support.apple.com/kb/HT210785",
              "refsource": "CONFIRM",
              "url": "https://support.apple.com/kb/HT210785"
            },
            {
              "name": "https://support.apple.com/kb/HT210789",
              "refsource": "CONFIRM",
              "url": "https://support.apple.com/kb/HT210789"
            },
            {
              "name": "https://support.apple.com/kb/HT210793",
              "refsource": "CONFIRM",
              "url": "https://support.apple.com/kb/HT210793"
            },
            {
              "name": "https://support.apple.com/kb/HT210795",
              "refsource": "CONFIRM",
              "url": "https://support.apple.com/kb/HT210795"
            },
            {
              "name": "https://support.apple.com/kb/HT210794",
              "refsource": "CONFIRM",
              "url": "https://support.apple.com/kb/HT210794"
            },
            {
              "name": "https://www.tenable.com/security/tns-2021-11",
              "refsource": "CONFIRM",
              "url": "https://www.tenable.com/security/tns-2021-11"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-15903",
    "datePublished": "2019-09-04T05:59:16",
    "dateReserved": "2019-09-04T00:00:00",
    "dateUpdated": "2024-08-05T01:03:32.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2019-11759

Vulnerability from cvelistv5

Published

2020-01-08 19:48

Modified

2024-08-04 23:03

Severity ?

Summary

An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an attacker to execute arbitrary code or more likely lead to a crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2019-35/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2019-33/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2019-34/	x_refsource_CONFIRM
	https://bugzilla.mozilla.org/show_bug.cgi?id=1577953	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202003-10	vendor-advisory, x_refsource_GENTOO
	https://usn.ubuntu.com/4335-1/	vendor-advisory, x_refsource_UBUNTU

Impacted products

▼	Vendor	Product
	Mozilla	Firefox
	Mozilla	Thunderbird
	Mozilla	Firefox ESR

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:03:32.865Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1577953"
          },
          {
            "name": "GLSA-202003-10",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-10"
          },
          {
            "name": "USN-4335-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4335-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 70"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.2"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an attacker to execute arbitrary code or more likely lead to a crash. This vulnerability affects Firefox \u003c 70, Thunderbird \u003c 68.2, and Firefox ESR \u003c 68.2."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Stack buffer overflow in HKDF output",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-29T02:06:48",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1577953"
        },
        {
          "name": "GLSA-202003-10",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-10"
        },
        {
          "name": "USN-4335-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4335-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2019-11759",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 70"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Thunderbird",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an attacker to execute arbitrary code or more likely lead to a crash. This vulnerability affects Firefox \u003c 70, Thunderbird \u003c 68.2, and Firefox ESR \u003c 68.2."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Stack buffer overflow in HKDF output"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-35/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-33/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-34/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1577953",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1577953"
            },
            {
              "name": "GLSA-202003-10",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-10"
            },
            {
              "name": "USN-4335-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4335-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2019-11759",
    "datePublished": "2020-01-08T19:48:07",
    "dateReserved": "2019-05-03T00:00:00",
    "dateUpdated": "2024-08-04T23:03:32.865Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2019-11762

Vulnerability from cvelistv5

Published

2020-01-08 19:53

Modified

2024-08-04 23:03

Severity ?

Summary

If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin window. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2019-35/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2019-33/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2019-34/	x_refsource_CONFIRM
	https://bugzilla.mozilla.org/show_bug.cgi?id=1582857	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202003-10	vendor-advisory, x_refsource_GENTOO
	https://usn.ubuntu.com/4335-1/	vendor-advisory, x_refsource_UBUNTU

Impacted products

▼	Vendor	Product
	Mozilla	Firefox
	Mozilla	Thunderbird
	Mozilla	Firefox ESR

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:03:32.719Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1582857"
          },
          {
            "name": "GLSA-202003-10",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-10"
          },
          {
            "name": "USN-4335-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4335-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 70"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.2"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin window. This vulnerability affects Firefox \u003c 70, Thunderbird \u003c 68.2, and Firefox ESR \u003c 68.2."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "document.domain-based origin isolation has same-origin-property violation",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-29T02:07:05",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1582857"
        },
        {
          "name": "GLSA-202003-10",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-10"
        },
        {
          "name": "USN-4335-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4335-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2019-11762",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 70"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Thunderbird",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin window. This vulnerability affects Firefox \u003c 70, Thunderbird \u003c 68.2, and Firefox ESR \u003c 68.2."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "document.domain-based origin isolation has same-origin-property violation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-35/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-35/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-33/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-33/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-34/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-34/"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1582857",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1582857"
            },
            {
              "name": "GLSA-202003-10",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-10"
            },
            {
              "name": "USN-4335-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4335-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2019-11762",
    "datePublished": "2020-01-08T19:53:09",
    "dateReserved": "2019-05-03T00:00:00",
    "dateUpdated": "2024-08-04T23:03:32.719Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_redhat

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature