Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information disclosure, cross-site scripting or denial of service.

Debian follows the extended support releases (ESR) of Firefox. Support for the 60.x series has ended, so starting with this update we're now following the 68.x releases.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has thunderbird packages installed that are affected by multiple vulnerabilities:

  - In libexpat before 2.2.8, crafted XML input could fool     the parser into changing from DTD parsing to document     parsing too early; a consecutive call to     XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber)     then resulted in a heap-based buffer over-read.
    (CVE-2019-15903)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:3193 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 68.2.0 ESR.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764)

    * Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757)

    * Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758)

    * Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759)

    * Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760)

    * Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761)

    * Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762)

    * Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:3237 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 68.2.0.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764)

    * Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757)

    * Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758)

    * Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759)

    * Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760)

    * Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761)

    * Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762)

    * Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763)

    * expat: heap-based buffer over-read via crafted XML input (CVE-2019-15903)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for MozillaFirefox, MozillaFirefox-branding-SLE fixes the following issues :

Changes in MozillaFirefox :

Security issues fixed :

CVE-2019-15903: Fixed a heap overflow in the expat library (bsc#1149429).

CVE-2019-11757: Fixed a use-after-free when creating index updates in IndexedDB (bsc#1154738).

CVE-2019-11758: Fixed a potentially exploitable crash due to 360 Total Security (bsc#1154738).

CVE-2019-11759: Fixed a stack-based buffer overflow in HKDF output (bsc#1154738).

CVE-2019-11760: Fixed a stack-based buffer overflow in WebRTC networking (bsc#1154738).

CVE-2019-11761: Fixed an unintended access to a privileged JSONView object (bsc#1154738).

CVE-2019-11762: Fixed a same-origin-property violation (bsc#1154738).

CVE-2019-11763: Fixed an XSS bypass (bsc#1154738).

CVE-2019-11764: Fixed several memory safety bugs (bsc#1154738).

Non-security issues fixed: Added Provides-line for translations-common (bsc#1153423) .

Moved some settings from branding-package here (bsc#1153869).

Disabled DoH by default.

Changes in MozillaFirefox-branding-SLE: Moved extensions preferences to core package (bsc#1153869).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for firefox is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 68.2.0 ESR.

Security Fix(es) :

* Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764)

* Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757)

* Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758)

* Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759)

* Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760)

* Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761)

* Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762)

* Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update upgrades Thunderbird to version 68.2.0.

Security Fix(es) :

  - Mozilla: Memory safety bugs fixed in Firefox 70 and     Firefox ESR 68.2 (CVE-2019-11764)

  - Mozilla: Use-after-free when creating index updates in     IndexedDB (CVE-2019-11757)

  - Mozilla: Potentially exploitable crash due to 360 Total     Security (CVE-2019-11758)

  - Mozilla: Stack buffer overflow in HKDF output     (CVE-2019-11759)

  - Mozilla: Stack buffer overflow in WebRTC networking     (CVE-2019-11760)

  - Mozilla: Unintended access to a privileged JSONView     object (CVE-2019-11761)

  - Mozilla: document.domain-based origin isolation has     same-origin-property violation (CVE-2019-11762)

  - Mozilla: Incorrect HTML parsing results in XSS bypass     technique (CVE-2019-11763)

  - expat: heap-based buffer over-read via crafted XML input     (CVE-2019-15903)

This update for MozillaThunderbird to version 68.2.1 provides the following fixes :

  - Security issues fixed (bsc#1154738) :

  - CVE-2019-15903: Fixed a heap overflow in the expat     library (bsc#1149429).

  - CVE-2019-11757: Fixed a use-after-free when creating     index updates in IndexedDB (bsc#1154738).

  - CVE-2019-11758: Fixed a potentially exploitable crash     due to 360 Total Security (bsc#1154738).

  - CVE-2019-11759: Fixed a stack-based buffer overflow in     HKDF output (bsc#1154738).

  - CVE-2019-11760: Fixed a stack-based buffer overflow in     WebRTC networking (bsc#1154738).

  - CVE-2019-11761: Fixed an unintended access to a     privileged JSONView object (bsc#1154738).

  - CVE-2019-11762: Fixed a same-origin-property violation     (bsc#1154738).

  - CVE-2019-11763: Fixed an XSS bypass (bsc#1154738).

  - CVE-2019-11764: Fixed several memory safety bugs     (bsc#1154738).

Other fixes (bsc#1153879) :

  - Some attachments couldn't be opened in messages     originating from MS Outlook 2016.

  - Address book import from CSV.

  - Performance problem in message body search.

  - Ctrl+Enter to send a message would open an attachment if     the attachment pane had focus.

  - Calendar: Issues with 'Today Pane' start-up.

  - Calendar: Glitches with custom repeat and reminder     number input.

  - Calendar: Problems with WCAP provider.

  - A language for the user interface can now be chosen in     the advanced settings 

  - Fixed an issue with Google authentication (OAuth2)

  - Fixed an issue where selected or unread messages were     not shown in the correct color in the thread pane under     some circumstances

  - Fixed an issue where when using a language pack, names     of standard folders were not localized (bsc#1149126)

  - Fixed an issue where the address book default startup     directory in preferences panel not persisted

  - Fixed various visual glitches

  - Fixed issues with the chat

  - Fixed building with rust >= 1.38.

  - Fixrd LTO build without PGO.

  - Removed kde.js since disabling instantApply breaks     extensions and is now obsolete with the move to HTML     views for preferences. (bsc#1151186)

  - Updated create-tar.sh. (bsc#1152778)

  - Deactivated the crashreporter for the last remaining     arch.

This update was imported from the SUSE:SLE-15:Update update project.

Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code or denial of service.

Debian follows the Thunderbird upstream releases. Support for the 60.x series has ended, so starting with this update we're now following the 68.x releases.

For Debian 8 'Jessie', these problems have been fixed in version 1:68.2.2-1~deb8u1.

We recommend that you upgrade your thunderbird packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
130288	Debian DSA-4549-1 : firefox-esr - security update	Nessus	Debian Local Security Checks	10/28/2019	4/16/2024	high
131405	NewStart CGSL CORE 5.04 / MAIN 5.04 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0215)	Nessus	NewStart CGSL Local Security Checks	12/2/2019	4/9/2024	high
130190	RHEL 7 : firefox (RHSA-2019:3193)	Nessus	Red Hat Local Security Checks	10/24/2019	11/7/2024	high
130382	RHEL 8 : thunderbird (RHSA-2019:3237)	Nessus	Red Hat Local Security Checks	10/30/2019	11/6/2024	high
130449	SUSE SLED15 / SLES15 Security Update : MozillaFirefox, MozillaFirefox-branding-SLE (SUSE-SU-2019:2871-1)	Nessus	SuSE Local Security Checks	11/1/2019	4/16/2024	high
130472	CentOS 6 : firefox (CESA-2019:3281)	Nessus	CentOS Local Security Checks	11/4/2019	4/16/2024	high
130750	Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20191106)	Nessus	Scientific Linux Local Security Checks	11/8/2019	4/12/2024	high
130937	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-2464)	Nessus	SuSE Local Security Checks	11/13/2019	4/11/2024	high
131136	Debian DLA-1997-1 : thunderbird security update	Nessus	Debian Local Security Checks	11/20/2019	4/11/2024	high
147407	NewStart CGSL MAIN 4.06 : firefox Multiple Vulnerabilities (NS-SA-2021-0004)	Nessus	NewStart CGSL Local Security Checks	3/10/2021	4/25/2023	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

critical