Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-16979 State: PUBLISHED Published: 2019-10-21T14:15:09 Last Updated: 2024-08-05T01:24:48.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to v4.5.7, the file app\contacts\contact_urls.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/a76d9637e31a70060ecc38786246a8b1c9178322 - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-12/
CVE ID: CVE-2019-16980 State: PUBLISHED Published: 2019-10-21T14:10:02 Last Updated: 2024-08-05T01:24:48.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to v4.5.7, the file app\call_broadcast\call_broadcast_edit.php uses an unsanitized "id" variable coming from the URL in an unparameterized SQL query, leading to SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/6fe372b3d4bb7ff07778d152886edcecc045c7ec - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-sqli-1/
CVE ID: CVE-2019-16981 State: PUBLISHED Published: 2019-10-21T15:16:15 Last Updated: 2024-08-05T01:24:48.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to v4.5.7, the file app\conference_profiles\conference_profile_params.php uses an unsanitized "id" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/021ff8f8e51cd1254d19e88e7aedc4b795067f8d - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-13/
CVE ID: CVE-2019-16982 State: PUBLISHED Published: 2019-10-21T15:11:57 Last Updated: 2024-08-05T01:24:48.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to v4.5.7, the file app\access_controls\access_control_nodes.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/c9f87dc16def2135930ebbfd667651cc3f6de2ff - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-14/
CVE ID: CVE-2019-16983 State: PUBLISHED Published: 2019-10-21T15:20:03 Last Updated: 2024-08-05T01:24:48.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to v4.5.7, the file resources\paging.php has a paging function (called by several pages of the interface), which uses an unsanitized "param" variable constructed partially from the URL args and reflected in HTML, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/23581e56e9a4d1685ddf1c7d67137417d654e134 - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-15/
CVE ID: CVE-2019-16984 State: PUBLISHED Published: 2019-10-21T15:23:34 Last Updated: 2024-08-05T01:24:48.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to v4.5.7, the file app\recordings\recording_play.php uses an unsanitized "filename" variable coming from the URL, which is base64 decoded and reflected in HTML, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/11f2dd2254dbeb1c41bf19b8c38e8fa9bc948efb - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-16/
CVE ID: CVE-2019-16985 State: PUBLISHED Published: 2019-10-21T15:27:06 Last Updated: 2024-08-05T01:24:48.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to v4.5.7, the file app\xml_cdr\xml_cdr_delete.php uses an unsanitized "rec" variable coming from the URL, which is base64 decoded and allows deletion of any file of the system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/284b0a91968f126fd6be0a486a84e065926905ca - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-path-traversal-1/
CVE ID: CVE-2019-16986 State: PUBLISHED Published: 2019-10-21T15:38:00 Last Updated: 2024-08-05T01:24:48.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. (resources\secure_download.php is also affected.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/9c61191049c949e01f99ea1fbab1feb44709e108 - https://github.com/fusionpbx/fusionpbx/commit/9482d9ee0e4287df21339be4276125e38e048951 - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-path-traversal-2
ommit/9482d9ee0e4287df21339be4276125e38e048951 - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-path-traversal-2/
CVE ID: CVE-2019-16987 State: PUBLISHED Published: 2019-10-21T15:33:32 Last Updated: 2024-08-05T01:24:48.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to v4.5.7, the file app\contacts\contact_import.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/ccdb27536d3549b5c0c317e3665fff231631ec77 - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-17/
CVE ID: CVE-2019-16988 State: PUBLISHED Published: 2019-10-21T15:49:28 Last Updated: 2024-08-05T01:24:48.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to v4.5.7, the file app\basic_operator_panel\resources\content.php uses an unsanitized "eavesdrop_dest" variable coming from the URL, which is reflected on 3 occasions in HTML, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/7fec1014ff0d08e36be6a3f7664edb3a9df7b4ac - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-18/
CVE ID: CVE-2019-16989 State: PUBLISHED Published: 2019-10-21T15:41:32 Last Updated: 2024-08-05T01:24:48.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to v4.5.7, the file app\conferences_active\conference_interactive.php uses an unsanitized "c" variable coming from the URL, which is reflected in HTML, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/83123e314a2e4c2dd0815446f89bcad97278d98d - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-19/
CVE ID: CVE-2019-16990 State: PUBLISHED Published: 2019-10-21T14:20:53 Last Updated: 2024-08-05T01:24:48.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to v4.5.7, the file app/music_on_hold/music_on_hold.php uses an unsanitized "file" variable coming from the URL, which takes any pathname (base64 encoded) and allows a download of it. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/95ed18aa9d781f232f5686a9027bb6f677c9b8da - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-path-traversal-3/
CVE ID: CVE-2019-16991 State: PUBLISHED Published: 2019-10-21T15:45:12 Last Updated: 2024-08-05T01:24:48.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FusionPBX up to v4.5.7, the file app\edit\filedelete.php uses an unsanitized "file" variable coming from the URL, which is reflected in HTML, leading to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/cd4632b46c62855f7e1c1c93d20ffd64edcb476e - https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-20/
CVE ID: CVE-2019-16992 State: PUBLISHED Published: 2019-09-29T23:52:58 Last Updated: 2024-08-05T01:24:48.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Keybase app 2.13.2 for iOS provides potentially insufficient notice that it is employing a user's private key to sign a certain cryptocurrency attestation (that an address at keybase.io can be used for Stellar payments to the user), which might be incompatible with a user's personal position on the semantics of an attestation. Additional Analyst Notes: - CVE Program Container: References: - https://sneak.berlin/20190929/keybase-backdoor/ - https://github.com/keybase/keybase-issues/issues/3583
CVE ID: CVE-2019-16993 State: PUBLISHED Published: 2019-09-30T11:30:40 Last Updated: 2024-08-05T01:24:48.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpbb.com/community/viewtopic.php?t=2352606 - https://www.phpbb.com/support/documents.php?mode=changelog&version=3#v317 - https://github.com/phpbb/phpb
hp?t=2352606 - https://www.phpbb.com/support/documents.php?mode=changelog&version=3#v317 - https://github.com/phpbb/phpbb/commit/18abef716ecf42a35416444f3f84f5459d573789 - https://lists.debian.org/debian-lts-announce/2019/09/msg00036.html - https://lists.debian.org/debian-lts-announce/2019/10/msg00006.html
CVE ID: CVE-2019-16994 State: PUBLISHED Published: 2019-09-30T12:03:39 Last Updated: 2024-08-05T01:24:48.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 5.0, a memory leak exists in sit_init_net() in net/ipv6/sit.c when register_netdev() fails to register sitn->fb_tunnel_dev, which may cause denial of service, aka CID-07f12b26e21a. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/07f12b26e21ab359261bf75cfcb424fdc7daeb6d - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=07f12b26e21ab359261bf75cfcb424fdc7daeb6d - https://security.netapp.com/advisory/ntap-20191031-0005/
linux.git/commit/?id=07f12b26e21ab359261bf75cfcb424fdc7daeb6d - https://security.netapp.com/advisory/ntap-20191031-0005/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html
CVE ID: CVE-2019-16995 State: PUBLISHED Published: 2019-09-30T12:03:53 Last Updated: 2024-08-05T01:24:48.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 5.0.3, a memory leak exits in hsr_dev_finalize() in net/hsr/hsr_device.c if hsr_add_port fails to add a port, which may cause denial of service, aka CID-6caabe7f197d. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/6caabe7f197d3466d238f70915d65301f1716626 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6caabe7f197d3466d238f70915d65301f1716626 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.3 - https:/
it/?id=6caabe7f197d3466d238f70915d65301f1716626 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.3 - https://security.netapp.com/advisory/ntap-20191031-0005/ - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00010.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00035.html
CVE ID: CVE-2019-16996 State: PUBLISHED Published: 2019-09-30T12:44:06 Last Updated: 2024-08-05T01:24:48.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/XiaOkuoAi/XiaOkuoAi.github.io/issues/1
CVE ID: CVE-2019-16997 State: PUBLISHED Published: 2019-09-30T12:44:23 Last Updated: 2024-08-05T01:24:48.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExportPack appno parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/XiaOkuoAi/XiaOkuoAi.github.io/issues/2
CVE ID: CVE-2019-16999 State: PUBLISHED Published: 2019-09-30T12:35:39 Last Updated: 2024-08-05T01:24:48.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: CloudBoot through 2019-03-08 allows SQL Injection via a crafted Status field in JSON data to the api/osinstall/v1/device/getNumByStatus URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/idcos/Cloudboot/issues/22
CVE ID: CVE-2019-17000 State: PUBLISHED Published: 2020-01-08T20:04:33 Last Updated: 2024-08-05T01:24:48.682Z Vendors: Mozilla Products: Firefox Problem Types: CSP bypass using object tag with data: URI Description: An object tag with a data URI did not correctly inherit the document's Content Security Policy. This allowed a CSP bypass in a cross-origin frame if the document's policy explicitly allowed data: URIs. This vulnerability affects Firefox < 70. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1441468 - https://www.mozilla.org/security/advisories/mfsa2019-34/
CVE ID: CVE-2019-17001 State: PUBLISHED Published: 2020-01-08T21:41:25 Last Updated: 2024-08-05T01:24:48.679Z Vendors: Mozilla Products: Firefox Problem Types: CSP bypass using object tag when script-src 'none' is specified Description: A Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in the protected document (cross-site scripting). This is a separate bypass from CVE-2019-17000.*Note: This flaw only affected Firefox 69 and was not present in earlier versions.*. This vulnerability affects Firefox < 70. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1587976 - https:/
nal Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1587976 - https://www.mozilla.org/security/advisories/mfsa2019-34/
CVE ID: CVE-2019-17002 State: PUBLISHED Published: 2020-01-08T21:13:48 Last Updated: 2024-08-05T01:24:48.808Z Vendors: Mozilla Products: Firefox Problem Types: upgrade-insecure-requests was not being honored for links dragged and dropped Description: If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was not upgraded to https. This vulnerability affects Firefox < 70. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1561056 - https://www.mozilla.org/security/advisories/mfsa2019-34/
CVE ID: CVE-2019-17003 State: PUBLISHED Published: 2023-02-16T00:00:00.000Z Last Updated: 2025-03-19T15:25:08.225Z Vendors: Mozilla Products: Firefox for iOS Problem Types: Improper parsing of QR codes in address bar could lead to XSS Description: Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2019-17003
CVE ID: CVE-2019-17005 State: PUBLISHED Published: 2020-01-08T21:14:57 Last Updated: 2024-08-05T01:24:48.626Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Buffer overflow in plain text serializer Description: The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1584170 - https://www.mozilla.org/securi
E Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1584170 - https://www.mozilla.org/security/advisories/mfsa2019-36/ - https://www.mozilla.org/security/advisories/mfsa2019-38/ - https://www.mozilla.org/security/advisories/mfsa2019-37/ - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html - https://usn.ubuntu.com/4241-1/ - https://access.redhat.com/errata/RHSA-2020:0292 - https://access.redhat.com/errata/RHSA-2020:0295 - https://security.gentoo.org/glsa/202003-02 - https://security.gentoo.org/glsa/202003-10 - https://usn.ubuntu.com/4335-1/
CVE ID: CVE-2019-17006 State: PUBLISHED Published: 2020-10-22T20:24:25 Last Updated: 2024-08-05T01:24:48.804Z Vendors: Mozilla Products: NSS Problem Types: missing length checks for cryptographic primitives Description: In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes - https://bugzilla.mozilla.org/show_bug.cgi?id=1539788 - https://security
cs/Mozilla/Projects/NSS/NSS_3.46_release_notes - https://bugzilla.mozilla.org/show_bug.cgi?id=1539788 - https://security.netapp.com/advisory/ntap-20210129-0001/ - https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04
CVE ID: CVE-2019-17007 State: PUBLISHED Published: 2020-10-22T20:28:17 Last Updated: 2024-08-05T01:24:48.580Z Vendors: Mozilla Products: NSS Problem Types: CERT_DecodeCertPackage() crash with Netscape Certificate Sequences Description: In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44_release_notes - https://bugzilla.mozilla.org/show_bug.cgi?id=1533216 - https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-04
16 - https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04
CVE ID: CVE-2019-17008 State: PUBLISHED Published: 2020-01-08T21:17:04 Last Updated: 2024-08-05T01:24:48.697Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Use-after-free in worker destruction Description: When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1546331 - https://www.mozilla.org/security/advisories/mfsa2019-36/ - https://www.mozilla.org/security/advisories/mfsa2019-38/ - https://
//www.mozilla.org/security/advisories/mfsa2019-36/ - https://www.mozilla.org/security/advisories/mfsa2019-38/ - https://www.mozilla.org/security/advisories/mfsa2019-37/ - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html - https://usn.ubuntu.com/4241-1/ - https://access.redhat.com/errata/RHSA-2020:0292 - https://access.redhat.com/errata/RHSA-2020:0295 - https://security.gentoo.org/glsa/202003-02 - https://security.gentoo.org/glsa/202003-10 - https://usn.ubuntu.com/4335-1/
CVE ID: CVE-2019-17009 State: PUBLISHED Published: 2020-01-08T21:22:53 Last Updated: 2024-08-05T01:24:48.744Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Updater temporary files accessible to unprivileged processes Description: When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.*. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Additional Analyst Note
affected.*. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1510494 - https://www.mozilla.org/security/advisories/mfsa2019-36/ - https://www.mozilla.org/security/advisories/mfsa2019-38/ - https://www.mozilla.org/security/advisories/mfsa2019-37/ - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html
CVE ID: CVE-2019-17010 State: PUBLISHED Published: 2020-01-08T21:23:23 Last Updated: 2024-08-05T01:24:48.864Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Use-after-free when performing device orientation checks Description: Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1581084 - https://www.mozilla.org/security/adviso
Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1581084 - https://www.mozilla.org/security/advisories/mfsa2019-36/ - https://www.mozilla.org/security/advisories/mfsa2019-38/ - https://www.mozilla.org/security/advisories/mfsa2019-37/ - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html - https://usn.ubuntu.com/4241-1/ - https://access.redhat.com/errata/RHSA-2020:0292 - https://access.redhat.com/errata/RHSA-2020:0295 - https://security.gentoo.org/glsa/202003-02 - https://security.gentoo.org/glsa/202003-10 - https://usn.ubuntu.com/4335-1/
CVE ID: CVE-2019-17011 State: PUBLISHED Published: 2020-01-08T21:23:58 Last Updated: 2024-08-05T01:24:48.683Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Use-after-free when retrieving a document in antitracking Description: Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1591334 - https://www.mozilla.org/security/advisories/mfsa20
References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1591334 - https://www.mozilla.org/security/advisories/mfsa2019-36/ - https://www.mozilla.org/security/advisories/mfsa2019-38/ - https://www.mozilla.org/security/advisories/mfsa2019-37/ - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html - https://usn.ubuntu.com/4241-1/ - https://access.redhat.com/errata/RHSA-2020:0292 - https://access.redhat.com/errata/RHSA-2020:0295 - https://security.gentoo.org/glsa/202003-02 - https://security.gentoo.org/glsa/202003-10 - https://usn.ubuntu.com/4335-1/