This update for MozillaFirefox to 68.2.0 ESR fixes the following issues :

Mozilla Firefox was updated to version 68.2.0 ESR (bsc#1154738).

Security issues fixed :

CVE-2019-15903: Fixed a heap overflow in the expat library (bsc#1149429).

CVE-2019-11757: Fixed a use-after-free when creating index updates in IndexedDB (bsc#1154738).

CVE-2019-11758: Fixed a potentially exploitable crash due to 360 Total Security (bsc#1154738).

CVE-2019-11759: Fixed a stack-based buffer overflow in HKDF output (bsc#1154738).

CVE-2019-11760: Fixed a stack-based buffer overflow in WebRTC networking (bsc#1154738).

CVE-2019-11761: Fixed an unintended access to a privileged JSONView object (bsc#1154738).

CVE-2019-11762: Fixed a same-origin-property violation (bsc#1154738).

CVE-2019-11763: Fixed an XSS bypass (bsc#1154738).

CVE-2019-11764: Fixed several memory safety bugs (bsc#1154738).

Non-security issues fixed: Firefox 60.7 ESR changed the user interface language (bsc#1137990).

Wrong Firefox GUI Language (bsc#1120374).

Fixed an inadvertent crash report transmission without user opt-in (bsc#1074235).

Firefox hangs randomly when browsing and scrolling (bsc#1043008).

Firefox stops loading page until mouse is moved (bsc#1025108).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 52.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-13 advisory.

  - Mozilla developers backported selected changes in the Skia library. These changes correct memory     corruption issues including invalid buffer reads and writes during graphic operations. (CVE-2018-5183)

  - Using remote content in encrypted messages can lead to the disclosure of plaintext. (CVE-2018-5184)

  - A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip     paths. This results in a potentially exploitable crash. (CVE-2018-5154)

  - A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths.
    This results in a potentially exploitable crash. (CVE-2018-5155)

  - An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer     overflow checks, resulting in possible out-of-bounds writes. This could lead to a potentially exploitable     crash triggerable by web content. (CVE-2018-5159)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2018-3120:04 advisory.

    * Mozilla: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8 (CVE-2018-5150)
    * Mozilla: Backport critical security fixes in Skia (CVE-2018-5183)
    * Mozilla: Use-after-free with SVG animations and clip paths (CVE-2018-5154)
    * Mozilla: Use-after-free with SVG animations and text paths (CVE-2018-5155)
    * Mozilla: Integer overflow and out-of-bounds write in Skia (CVE-2018-5159)
    * Mozilla: Full plaintext recovery in S/MIME via chosen-ciphertext attack (CVE-2018-5184)
    * Mozilla: Hang via malformed headers (CVE-2018-5161)
    * Mozilla: Encrypted mail leaks plaintext through src attribute (CVE-2018-5162)
    * Mozilla: Lightweight themes can be installed without user interaction (CVE-2018-5168)
    * Mozilla: Filename spoofing for external attachments (CVE-2018-5170)
    * Mozilla: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension     (CVE-2018-5178)
    * Mozilla: Leaking plaintext through HTML forms (CVE-2018-5185)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2018-3109:05 advisory.

    * Mozilla: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8 (CVE-2018-5150)
    * Mozilla: Backport critical security fixes in Skia (CVE-2018-5183)
    * Mozilla: Use-after-free with SVG animations and clip paths (CVE-2018-5154)
    * Mozilla: Use-after-free with SVG animations and text paths (CVE-2018-5155)
    * Mozilla: Same-origin bypass of PDF Viewer to view protected PDF files (CVE-2018-5157)
    * Mozilla: Malicious PDF can inject JavaScript into PDF Viewer (CVE-2018-5158)
    * Mozilla: Integer overflow and out-of-bounds write in Skia (CVE-2018-5159)
    * Mozilla: Lightweight themes can be installed without user interaction (CVE-2018-5168)
    * Mozilla: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension     (CVE-2018-5178)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
130450	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2019:2872-1)	Nessus	SuSE Local Security Checks	2019/11/1	2024/4/16	critical
275624	Mozilla Thunderbird < 52.8	Nessus	MacOS X Local Security Checks	2025/11/18	2025/11/18	critical
288929	MiracleLinux 4 : thunderbird-52.8.0-2.AXS4 (AXSA:2018-3120:04)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
289301	MiracleLinux 4 : firefox-52.8.0-1.0.1.AXS4 (AXSA:2018-3109:05)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical

検出

プラグインの検索

critical

critical

critical

critical