Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/1677?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "type": "alpm", "namespace": "archlinux", "name": "firefox", "version": "68.0-1", "qualifiers": {}, "subpath": "", "is_vulnerable": false, "next_non_vulnerable_version": "69.0-1", "latest_non_vulnerable_version": "101.0-1", "affected_by_vulnerabilities": [], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1577?format=api", "vulnerability_id": "VCID-1btz-x11h-wbe3", "summary": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used.", "references": [ { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11729", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11729" }, { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22", "reference_id": "mfsa2019-22", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-23", "reference_id": "mfsa2019-23", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-23" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28", "reference_id": "mfsa2019-28", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-11729" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1btz-x11h-wbe3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1638?format=api", "vulnerability_id": "VCID-4w3a-v61n-jkcx", "summary": "The HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP ports of any host that the accessible to a user when web content is loaded.", "references": [ { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28", "reference_id": "mfsa2019-28", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-11728" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4w3a-v61n-jkcx" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1579?format=api", "vulnerability_id": "VCID-5yxj-ktrh-v3gf", "summary": "A vulnerability exists where the caret (\"^\") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes.", "references": [ { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11709", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11709" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11711", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11711" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11712", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11712" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11713", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11713" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11715", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11715" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11717", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11717" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11730", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11730" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9811", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9811" }, { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22", "reference_id": "mfsa2019-22", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-23", "reference_id": "mfsa2019-23", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-23" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28", "reference_id": "mfsa2019-28", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-11717" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5yxj-ktrh-v3gf" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1574?format=api", "vulnerability_id": "VCID-9pa6-vyv2-jug4", "summary": "When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did not use document.domain to relax their origin security.", "references": [ { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11709", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11709" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11711", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11711" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11712", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11712" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11713", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11713" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11715", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11715" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11717", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11717" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11730", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11730" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9811", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9811" }, { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22", "reference_id": "mfsa2019-22", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-23", "reference_id": "mfsa2019-23", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-23" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28", "reference_id": "mfsa2019-28", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-11711" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9pa6-vyv2-jug4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1580?format=api", "vulnerability_id": "VCID-9wkp-gr2p-kuda", "summary": "When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure.", "references": [ { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11719", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11719" }, { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22", "reference_id": "mfsa2019-22", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-23", "reference_id": "mfsa2019-23", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-23" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28", "reference_id": "mfsa2019-28", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-11719" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9wkp-gr2p-kuda" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1576?format=api", "vulnerability_id": "VCID-a3bk-967p-tbey", "summary": "A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially exploitable crash.", "references": [ { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11709", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11709" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11711", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11711" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11712", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11712" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11713", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11713" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11715", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11715" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11717", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11717" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11730", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11730" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9811", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9811" }, { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22", "reference_id": "mfsa2019-22", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-23", "reference_id": "mfsa2019-23", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-23" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28", "reference_id": "mfsa2019-28", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-11713" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-a3bk-967p-tbey" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1635?format=api", "vulnerability_id": "VCID-cfkw-sswh-fug7", "summary": "Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been retired and now redirects to another site. This additional permission is unnecessary and is a potential vector for malicious attacks.", "references": [ { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28", "reference_id": "mfsa2019-28", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-11724" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-cfkw-sswh-fug7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1639?format=api", "vulnerability_id": "VCID-cqss-xjk2-jqaa", "summary": "Mozilla developers and community members André Bargull, Christian Holler, Natalia Csoregi, Raul Gurzau, Daniel Varga, Jon Coppeard, Marcia Knous, Gary Kwong, Randell Jesup, David Bolter, Jeff Gilbert, and Deian Stefan reported memory safety bugs fixed in Firefox 68 and Thunderbird 68. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.", "references": [ { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28", "reference_id": "mfsa2019-28", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-11710" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-cqss-xjk2-jqaa" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1634?format=api", "vulnerability_id": "VCID-cy4e-wn65-5yek", "summary": "A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookies in private browsing mode or across different \"containers\" for people who use the Firefox Multi-Account Containers Web Extension.", "references": [ { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28", "reference_id": "mfsa2019-28", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-11723" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-cy4e-wn65-5yek" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1633?format=api", "vulnerability_id": "VCID-e6xc-18vy-zbgs", "summary": "The unicode latin 'kra' character can be used to spoof a standard 'k' character in the addressbar. This allows for domain spoofing attacks as do not display as punycode text, allowing for user confusion.", "references": [ { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28", "reference_id": "mfsa2019-28", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-11721" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-e6xc-18vy-zbgs" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1578?format=api", "vulnerability_id": "VCID-jqgr-fga1-1uh6", "summary": "Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards on web sites in certain circumstances.", "references": [ { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11709", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11709" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11711", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11711" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11712", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11712" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11713", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11713" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11715", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11715" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11717", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11717" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11730", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11730" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9811", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9811" }, { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22", "reference_id": "mfsa2019-22", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-23", "reference_id": "mfsa2019-23", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-23" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28", "reference_id": "mfsa2019-28", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-11715" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jqgr-fga1-1uh6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1632?format=api", "vulnerability_id": "VCID-mcak-bqyw-vygx", "summary": "Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This allows malicious code to then be processed, evading cross-site scripting (XSS) filtering.", "references": [ { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28", "reference_id": "mfsa2019-28", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-11720" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-mcak-bqyw-vygx" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1630?format=api", "vulnerability_id": "VCID-mrja-sepm-bkg9", "summary": "Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in some instances.", "references": [ { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28", "reference_id": "mfsa2019-28", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-11714" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-mrja-sepm-bkg9" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1636?format=api", "vulnerability_id": "VCID-ru48-fc55-3uas", "summary": "When a user navigates to site marked as unsafe by the Safebrowsing API, warning messages are displayed and navigation is interrupted but resources from the same site loaded through websockets are not blocked, leading to the loading of unsafe resources and bypassing safebrowsing protections.", "references": [ { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28", "reference_id": "mfsa2019-28", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-11725" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ru48-fc55-3uas" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1670?format=api", "vulnerability_id": "VCID-rx6n-n9kd-9ffx", "summary": "Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without sanitization, allowing for a potential access to other information available to the Activity Stream, such as browsing history, if the Snipper Service were compromised.", "references": [ { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-11718" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-rx6n-n9kd-9ffx" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1575?format=api", "vulnerability_id": "VCID-uebp-t2se-kyaq", "summary": "POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery (CSRF) attacks.", "references": [ { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11709", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11709" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11711", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11711" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11712", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11712" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11713", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11713" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11715", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11715" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11717", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11717" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11730", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11730" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9811", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9811" }, { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22", "reference_id": "mfsa2019-22", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-23", "reference_id": "mfsa2019-23", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-23" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28", "reference_id": "mfsa2019-28", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-11712" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-uebp-t2se-kyaq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1631?format=api", "vulnerability_id": "VCID-ufuu-gskv-e7ah", "summary": "Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropertyNames(window). Sites that deploy a sandboxing that depends on enumerating and freezing access to the window object may miss this, allowing their sandboxes to be bypassed.", "references": [ { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28", "reference_id": "mfsa2019-28", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-11716" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ufuu-gskv-e7ah" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1581?format=api", "vulnerability_id": "VCID-uyn9-fbsk-43ah", "summary": "A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and they may uploaded to a server. Luigi Gubello demonstrated that in combination with a popular Android messaging app, if a malicious HTML attachment is sent to a user and they opened that attachment in Firefox, due to that app's predictable pattern for locally-saved file names, it is possible to read attachments the victim received from other correspondents.", "references": [ { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11709", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11709" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11711", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11711" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11712", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11712" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11713", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11713" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11715", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11715" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11717", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11717" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11730", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11730" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9811", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9811" }, { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22", "reference_id": "mfsa2019-22", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-23", "reference_id": "mfsa2019-23", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-23" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28", "reference_id": "mfsa2019-28", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-11730" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-uyn9-fbsk-43ah" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1582?format=api", "vulnerability_id": "VCID-x19a-2343-jfce", "summary": "Mozilla developers and community members Andreea Pavel, Christian Holler, Honza Bambas, Jason Kratzer, and Jeff Gilbert reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.", "references": [ { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11709", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11709" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11711", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11711" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11712", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11712" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11713", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11713" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11715", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11715" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11717", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11717" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11730", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11730" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9811", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9811" }, { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22", "reference_id": "mfsa2019-22", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-23", "reference_id": "mfsa2019-23", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-23" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28", "reference_id": "mfsa2019-28", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-11709" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-x19a-2343-jfce" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1573?format=api", "vulnerability_id": "VCID-x7sq-a7f4-97gx", "summary": "As part of his winning Pwn2Own entry, Niklas Baumstark demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation.", "references": [ { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11709", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11709" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11711", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11711" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11712", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11712" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11713", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11713" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11715", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11715" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11717", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11717" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11730", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11730" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9811", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9811" }, { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22", "reference_id": "mfsa2019-22", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-23", "reference_id": "mfsa2019-23", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-23" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-9811" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-x7sq-a7f4-97gx" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1637?format=api", "vulnerability_id": "VCID-xavu-ygkk-u3fn", "summary": "A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages.", "references": [ { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11727", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11727" }, { "reference_url": "https://security.archlinux.org/ASA-201907-4", "reference_id": "ASA-201907-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201907-4" }, { "reference_url": "https://security.archlinux.org/AVG-1002", "reference_id": "AVG-1002", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1002" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21", "reference_id": "mfsa2019-21", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28", "reference_id": "mfsa2019-28", "reference_type": "", "scores": [ { "value": "critical", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-28" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1677?format=api", "purl": "pkg:alpm/archlinux/firefox@68.0-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" } ], "aliases": [ "CVE-2019-11727" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-xavu-ygkk-u3fn" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:alpm/archlinux/firefox@68.0-1" }