CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2017-5419 – Ubuntu Security Notice USN-3216-1
https://notcve.org/view.php?id=CVE-2017-5419
08 Mar 2017 — If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-responsive, requiring shutdown through the operating system. This is a denial of service (DOS) attack. This vulnerability affects Firefox < 52 and Thunderbird < 52. Si un sitio web malicioso desencadena repetidamente un mensaje de autenticación modal, la interfaz de usuario del navegador dejará de responder y será necesario cerrarlo a través del sistema operativo. Esto es un ataque de denegación ... • http://www.securityfocus.com/bid/96692 •
CVSS: 9.8EPSS: 1%CPEs: 21EXPL: 1CVE-2017-5410 – Mozilla: Memory corruption during JavaScript garbage collection incremental sweeping (MFSA 2017-06)
https://notcve.org/view.php?id=CVE-2017-5410
08 Mar 2017 — Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for memory cleanup. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Corrupción de memoria que resulta en un cierre inesperado potencialmente explotable durante la recolección de elementos JavaScript no utilizados debido a errores en la forma en la que se gestiona el rastreo incremental para la limpieza ... • http://rhn.redhat.com/errata/RHSA-2017-0459.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 21EXPL: 0CVE-2017-5402 – Mozilla: Use-after-free working with events in FontFace objects (MFSA 2017-06)
https://notcve.org/view.php?id=CVE-2017-5402
08 Mar 2017 — A use-after-free can occur when events are fired for a "FontFace" object after the object has been already been destroyed while working with fonts. This results in a potentially exploitable crash. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Puede ocurrir un uso de memoria previamente liberada cuando se lanzan eventos para un objeto "FontFace" una vez el objeto ha sido ya destruido mientras se trabaja con fuentes. Esto resulta en un cierre inesperado... • http://rhn.redhat.com/errata/RHSA-2017-0459.html • CWE-416: Use After Free •
CVSS: 5.3EPSS: 2%CPEs: 1EXPL: 3CVE-2017-5415 – Mozilla Firefox - Address Bar Spoofing
https://notcve.org/view.php?id=CVE-2017-5415
08 Mar 2017 — An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leading to user confusion and further spoofing attacks. This vulnerability affects Firefox < 52. Un atacante puede utilizar una URL y script blob para suplantar una URL arbitraria de la barra de direcciones precedida por "blob:" como protocolo, lo que conduce a una confusión de usuario y a más ataques de suplantación. La vulnerabilidad afecta a Firefox en versiones anteriores a la 52. USN-3216-1... • https://www.exploit-db.com/exploits/44266 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2017-5406 – Ubuntu Security Notice USN-3216-1
https://notcve.org/view.php?id=CVE-2017-5406
08 Mar 2017 — A segmentation fault can occur in the Skia graphics library during some canvas operations due to issues with mask/clip intersection and empty masks. This vulnerability affects Firefox < 52 and Thunderbird < 52. Puede ocurrir un fallo de segmentación en la biblioteca de gráficos Skia durante algunas operaciones canvas debido a problemas con la intersección de máscaras/clips y las máscaras vacías. La vulnerabilidad afecta a Firefox en versiones anteriores a la 52 y Thunderbird en versiones anteriores a la 52.... • http://www.securityfocus.com/bid/96692 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2017-5422 – Ubuntu Security Notice USN-3216-1
https://notcve.org/view.php?id=CVE-2017-5422
08 Mar 2017 — If a malicious site uses the "view-source:" protocol in a series within a single hyperlink, it can trigger a non-exploitable browser crash when the hyperlink is selected. This was fixed by no longer making "view-source:" linkable. This vulnerability affects Firefox < 52 and Thunderbird < 52. Si un sitio malicioso emplea el protocolo "view-source:" en una serie en un único hipervínculo, puede desencadenar un cierre inesperado no explotable del navegador cuando se selecciona el hipervínculo. Esto se solucionó... • http://www.securityfocus.com/bid/96692 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2017-5399 – Ubuntu Security Notice USN-3216-1
https://notcve.org/view.php?id=CVE-2017-5399
08 Mar 2017 — Memory safety bugs were reported in Firefox 51. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 52 and Thunderbird < 52. Se han reportado errores de seguridad de memoria en Firefox 51. Algunos de estos errores mostraron evidencias de corrupción de memoria y se entiende que, con el suficiente esfuerzo, algunos de estos podrían explotarse para ejecutar código arbitra... • http://www.securityfocus.com/bid/96692 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 1CVE-2017-5418 – Ubuntu Security Notice USN-3216-1
https://notcve.org/view.php?id=CVE-2017-5418
08 Mar 2017 — An out of bounds read error occurs when parsing some HTTP digest authorization responses, resulting in information leakage through the reading of random memory containing matches to specifically set patterns. This vulnerability affects Firefox < 52 and Thunderbird < 52. Ocurre un error de lectura fuera de límites al analizar algunas respuestas HTTP de autorización digest, lo que resulta en una fuga de información mediante la lectura de memoria aleatoria que contiene coincidencias a patrones establecidos esp... • http://www.securityfocus.com/bid/96692 • CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 0%CPEs: 18EXPL: 0CVE-2017-5400 – Mozilla: asm.js JIT-spray bypass of ASLR and DEP (MFSA 2017-06)
https://notcve.org/view.php?id=CVE-2017-5400
08 Mar 2017 — JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Un spray JIT que apunta a asm.js combinado con un heap spray permite la omisión de las protecciones ASLR y DEP, lo que conduce a ataques de corrupción de memoria. La vulnerabilidad afecta a Firefox en versiones anteriores a la 52, Firefox ESR en versiones ant... • http://rhn.redhat.com/errata/RHSA-2017-0459.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-5427 – Ubuntu Security Notice USN-3216-1
https://notcve.org/view.php?id=CVE-2017-5427
08 Mar 2017 — A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. If a malicious user with local access puts chrome.manifest and other referenced files in this directory, they will be loaded and activated during startup. This could result in malicious software being added without consent or modification of referenced installed files. This vulnerability affects Firefox < 52. Un archivo chrome.manifest inexistente intentará cargarse durante el arranque desde... • http://www.securityfocus.com/bid/96692 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •