CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 1CVE-2017-7843 – Mozilla: Web worker in Private Browsing mode can write IndexedDB data
https://notcve.org/view.php?id=CVE-2017-7843
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1. Cuando se utiliza el modo Navegación Privada, es posible que un trabajador web escriba datos persistentes en IndexedDB y realice fingerprinting en un usuario de forma única. IndexedDB no debería estar disponible en modo Navegación Privada y estos datos almacenados persistirán en varias sesiones en modo Navegación Privada porque no se borran al cerrar. • http://www.securityfocus.com/bid/102039 http://www.securityfocus.com/bid/102112 http://www.securitytracker.com/id/1039954 https://access.redhat.com/errata/RHSA-2017:3382 https://bugzilla.mozilla.org/show_bug.cgi?id=1410106 https://lists.debian.org/debian-lts-announce/2017/12/msg00003.html https://www.debian.org/security/2017/dsa-4062 https://www.mozilla.org/security/advisories/mfsa2017-27 https://www.mozilla.org/security/advisories/mfsa2017-28 https://access.redhat.com/securit • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer •
CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 0CVE-2017-12173 – sssd: unsanitized input when searching in local cache database
https://notcve.org/view.php?id=CVE-2017-12173
It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it. Se ha encontrado que la función sysdb_search_user_by_upn_res() de sssd en versiones anteriores a la 1.16.0 no saneaba las peticiones al consultar su caché local y era vulnerable a inyecciones. En un entorno de inicio de sesión centralizado, si un hash de contraseña se almacenaba en la caché local de un usuario determinado, un atacante autenticado podía utilizar este error para recuperarlo. It was found that sssd's sysdb_search_user_by_upn_res() function did not sanitize requests when querying its local cache and was vulnerable to injection. • https://access.redhat.com/errata/RHSA-2017:3379 https://access.redhat.com/errata/RHSA-2018:1877 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12173 https://access.redhat.com/security/cve/CVE-2017-12173 https://bugzilla.redhat.com/show_bug.cgi?id=1498173 • CWE-20: Improper Input Validation CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 91%CPEs: 15EXPL: 0CVE-2017-15275 – samba: Server heap-memory disclosure
https://notcve.org/view.php?id=CVE-2017-15275
Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap memory. Las versiones anteriores a la 4.7.3 de Samba podrían permitir que atacantes remotos obtengan información sensible aprovechando el error del servidor para borrar la memoria dinámica (heap) asignada. A memory disclosure flaw was found in samba. An attacker could retrieve parts of server memory, which could contain potentially sensitive data, by sending specially-crafted requests to the samba server. • http://www.securityfocus.com/bid/101908 http://www.securitytracker.com/id/1039855 http://www.ubuntu.com/usn/USN-3486-1 http://www.ubuntu.com/usn/USN-3486-2 https://access.redhat.com/errata/RHSA-2017:3260 https://access.redhat.com/errata/RHSA-2017:3261 https://access.redhat.com/errata/RHSA-2017:3278 https://lists.debian.org/debian-lts-announce/2017/11/msg00029.html https://security.gentoo.org/glsa/201805-07 https://support.hpe.com/hpsc/doc/public/display?docLoc • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 77%CPEs: 16EXPL: 0CVE-2017-14746 – samba: Use-after-free in processing SMB1 requests
https://notcve.org/view.php?id=CVE-2017-14746
Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted SMB1 request. Vulnerabilidad de uso de memoria previamente liberada en las versiones 4.x de Samba anteriores a la 4.7.3 permiten que atacantes remotos ejecuten código arbitrario mediante una petición SMB1. A use-after-free flaw was found in the way samba servers handled certain SMB1 requests. An unauthenticated attacker could send specially-crafted SMB1 requests to cause the server to crash or execute arbitrary code. • http://www.securityfocus.com/bid/101907 http://www.securitytracker.com/id/1039856 http://www.ubuntu.com/usn/USN-3486-1 https://access.redhat.com/errata/RHSA-2017:3260 https://access.redhat.com/errata/RHSA-2017:3261 https://access.redhat.com/errata/RHSA-2017:3278 https://security.gentoo.org/glsa/201805-07 https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03817en_us https://www.debian.org/security/2017/dsa-4043 https://www.samba.or • CWE-416: Use After Free •
CVSS: 9.8EPSS: 0%CPEs: 15EXPL: 0CVE-2017-7828 – Mozilla: Use-after-free of PressShell while restyling layout (MFSA 2017-25)
https://notcve.org/view.php?id=CVE-2017-7828
A use-after-free vulnerability can occur when flushing and resizing layout because the "PressShell" object has been freed while still in use. This results in a potentially exploitable crash during these operations. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5. Puede ocurrir una vulnerabilidad de uso de memoria previamente liberada cuando se alinea y redimensiona la disposición porque el objeto "PressShell'" se ha liberado cuando se estaba utilizando. Esto resulta en un cierre inesperado potencialmente explotable durante estas operaciones. • http://www.securityfocus.com/bid/101832 http://www.securitytracker.com/id/1039803 https://access.redhat.com/errata/RHSA-2017:3247 https://access.redhat.com/errata/RHSA-2017:3372 https://bugzilla.mozilla.org/show_bug.cgi?id=1406750 https://bugzilla.mozilla.org/show_bug.cgi?id=1412252 https://lists.debian.org/debian-lts-announce/2017/11/msg00018.html https://lists.debian.org/debian-lts-announce/2017/12/msg00001.html https://www.debian.org/security/2017/dsa-4035 https:// • CWE-416: Use After Free •