October 2019 security updates are available!

We have released the October security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found in the Security Update Guide. As a reminder,...

October 2019 security updates are available!

We have released the October security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found in the Security Update Guide. As a reminder,...

October 3, 2019—KB4524157 (Monthly Rollup)

None None...

The vulnerabilities of Firefox and Firefox ESR browsers, as well as the Thunderbird email client, allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerabilities of Firefox and Firefox ESR browsers, as well as the Thunderbird email client, are caused by buffer overflows. Exploiting these vulnerabilities allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information during page renderin...

The vulnerability of the SwizzleData function in browsers like Firefox and Firefox ESR, as well as in the Thunderbird email client, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the SwizzleData function in browsers like Firefox and Firefox ESR, as well as in the Thunderbird email client, is caused by a numerical overflow condition. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of t...

The vulnerabilities of Firefox and Firefox ESR browsers, as well as the Thunderbird email client, are related to an unacceptable grid size during QCMS transformations. This allows attackers to disclose protected information.

The vulnerability of Firefox and Firefox ESR browsers, as well as the Thunderbird email client, is related to an unacceptable grid size during QCMS transformations. Exploiting this vulnerability allows a malicious actor to disclose sensitive information obtained by reading beyond the buffer limit...

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird, related to the storage of passwords in unencrypted form, allows attackers to gain unauthorized access to protected information.

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird relates to the storage of passwords in an unencrypted form. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Vulnerability in Firefox web browsers, Firefox ESR, and Thunderbird email client: This vulnerability arises from allowing operations beyond the buffer in memory, enabling attackers to execute arbitrary code.

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

DEBIAN-CVE-2019-11750

A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash. This vulnerability affects Firefox 69 and Firefox ESR 68.1...

CVE-2019-11733

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password ...

UBUNTU-CVE-2019-11736

The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged access. Additionally, there was a race condition during...

The vulnerability of the “Enable Adobe Flash protected mode” parameter in the Adobe Flash plugin for the Firefox ESR browser allows a hacker to bypass existing security restrictions.

The vulnerability of the “Enable Adobe Flash protected mode” parameter in the Adobe Flash plugin for the Firefox ESR browser is related to privilege management errors. Exploiting this vulnerability could allow a malicious actor to bypass existing security restrictions remotely...

The vulnerability of the cross-browser system used for developing WebExtensions extensions in the Firefox ESR browser allows a hacker to circumvent existing security restrictions.

The vulnerability of the cross-browser system used for developing WebExtensions extensions in Firefox ESR is related to privilege assignment errors. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remotely...

The vulnerability of Firefox ESR, related to privilege management errors, allows a hacker to elevate their privileges and execute arbitrary code.

The vulnerability of Firefox ESR is related to privilege management errors. Exploiting this vulnerability allows a remote attacker to increase their privileges and execute arbitrary code...

The vulnerability of the Content Security Policy component of the Firefox ESR browser allows attackers to execute cross-site scripting attacks.

The vulnerability of the Content Security Policy component in Firefox ESR is related to the lack of measures for sanitizing input data. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

The vulnerability of the PDF Viewer component in Firefox ESR and Firefox browsers allows attackers to escalate their privileges.

The vulnerability of the CaptureHandler component in Firefox ESR and Firefox exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...

KLA11873 ACE vulnerability in Microsoft Products (ESU)

A memory corruption vulnerability was found in Microsoft Products Extended Support Update. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2019-1367 Exploitation Public exploits exist for this vulnerability. Malware exists for this vulnerability...

Mozilla: Use-after-free while extracting a key value in IndexedDB

It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox 69, Thunderbird 68.1, Thunderbird 60.9, Firefox ESR 60.9, and Firefox ESR 68.1...

Mozilla: Use-after-free while extracting a key value in IndexedDB

It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox 69, Thunderbird 68.1, Thunderbird 60.9, Firefox ESR 60.9, and Firefox ESR 68.1...

Mozilla: Use-after-free while manipulating video

A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Firefox 69, Thunderbird 68.1, Thunderbird 60.9, Firefox ESR 60.9, and Firefox ESR 68.1...