{"schemaVersion":3,"id":"SUSE-SU-2018:4235-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for MozillaFirefox, mozilla-nspr and mozilla-nss\n\nThis update for MozillaFirefox, mozilla-nss and mozilla-nspr fixes the following issues:\n\nIssues fixed in MozillaFirefox:\n\n- Update to Firefox ESR 60.4 (bsc#1119105)\n- CVE-2018-17466: Fixed a buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11\n- CVE-2018-18492: Fixed a use-after-free with select element\n- CVE-2018-18493: Fixed a buffer overflow in accelerated 2D canvas with Skia\n- CVE-2018-18494: Fixed a Same-origin policy violation using location attribute and performance.getEntries\n  to steal cross-origin URLs\n- CVE-2018-18498: Fixed a integer overflow when calculating buffer sizes for images\n- CVE-2018-12405: Fixed a few memory safety bugs\n\nIssues fixed in mozilla-nss:\n\n- Update to NSS 3.40.1 (bsc#1119105)\n- CVE-2018-12404: Fixed a cache side-channel variant of the Bleichenbacher attack (bsc#1119069)\n- CVE-2018-12384: Fixed an issue in the SSL handshake. NSS responded to an\n  SSLv2-compatible ClientHello with a ServerHello that had an all-zero random. (bsc#1106873)\n- CVE-2018-0495: Fixed a memory-cache side-channel attack with ECDSA signatures (bsc#1097410)\n- Fixed a decryption failure during FFDHE key exchange\n- Various security fixes in the ASN.1 code\n\nIssues fixed in mozilla-nspr:\n\n- Update mozilla-nspr to 4.20 (bsc#1119105)","dates":{"published":"2018-12-21T17:47:33.000Z","modified":"2026-02-04T04:35:50.433Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"mozilla-nspr&distro=SUSE Linux Enterprise Module for Basesystem 15","name":"mozilla-nspr","label":"mozilla-nspr&distro=SUSE Linux Enterprise Module for Basesystem 15","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/mozilla-nspr&distro=SUSE Linux Enterprise Module for Basesystem 15","purlType":"rpm","versions":[{"text":"< 4.20-3.3.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.20-3.3.2","eol":null,"hubHref":null},{"vendor":"suse","product":"mozilla-nss&distro=SUSE Linux Enterprise Module for Basesystem 15","name":"mozilla-nss","label":"mozilla-nss&distro=SUSE Linux Enterprise Module for Basesystem 15","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/mozilla-nss&distro=SUSE Linux Enterprise Module for Basesystem 15","purlType":"rpm","versions":[{"text":"< 3.40.1-3.7.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.40.1-3.7.2","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Module for Desktop Applications 15","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Module for Desktop Applications 15","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Module for Desktop Applications 15","purlType":"rpm","versions":[{"text":"< 60.4.0-3.21.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.4.0-3.21.1","eol":null,"hubHref":null}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20184235-1/","label":"www.suse.com/support/update/announcement/2018/suse-su-20184235-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1097410","label":"bugzilla.suse.com/1097410","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1106873","label":"bugzilla.suse.com/1106873","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1119069","label":"bugzilla.suse.com/1119069","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1119105","label":"bugzilla.suse.com/1119105","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0495","label":"www.suse.com/security/cve/CVE-2018-0495","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12384","label":"www.suse.com/security/cve/CVE-2018-12384","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12404","label":"www.suse.com/security/cve/CVE-2018-12404","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12405","label":"www.suse.com/security/cve/CVE-2018-12405","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17466","label":"www.suse.com/security/cve/CVE-2018-17466","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18492","label":"www.suse.com/security/cve/CVE-2018-18492","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18493","label":"www.suse.com/security/cve/CVE-2018-18493","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18494","label":"www.suse.com/security/cve/CVE-2018-18494","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18498","label":"www.suse.com/security/cve/CVE-2018-18498","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2018-0495","CVE-2018-12384","CVE-2018-12404","CVE-2018-12405","CVE-2018-17466","CVE-2018-18492","CVE-2018-18493","CVE-2018-18494","CVE-2018-18498"],"downstream":[],"duplicates":[],"related":["CVE-2018-0495","CVE-2018-12384","CVE-2018-12404","CVE-2018-12405","CVE-2018-17466","CVE-2018-18492","CVE-2018-18493","CVE-2018-18494","CVE-2018-18498"]},"timeline":[{"kind":"published","date":"2018-12-21T17:47:33.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-04T04:35:50.433Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T06:56:13.846Z","stale":false,"partial":false}}