CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-12424 – Mozilla: WebRTC permission prompt could have been bypassed by a compromised content process
https://notcve.org/view.php?id=CVE-2020-12424
When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin that was previously granted permission; bypassing the prompt. This vulnerability affects Firefox < 78. Cuando se construye un aviso de permiso para WebRTC, se suministraba un URI desde el proceso de contenido. Este URI no era confiable, y podría haber sido el URI de un origen que previamente se le concediera permiso; omitiendo el aviso. • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html https://bugzilla.mozilla.org/show_bug.cgi?id=1562600 https://security.gentoo.org/glsa/202007-10 https://www.mozilla.org/security/advisories/mfsa2020-24 https://access.redhat.com/security/cve/CVE-2020-12424 https://bugzilla.redhat.com/show_bug.cgi?id=1872539 • CWE-276: Incorrect Default Permissions CWE-451: User Interface (UI) Misrepresentation of Critical Information •
CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 1CVE-2020-12426
https://notcve.org/view.php?id=CVE-2020-12426
Mozilla developers and community members reported memory safety bugs present in Firefox 77. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 78. Los desarrolladores de Mozilla y los miembros de la comunidad reportaron bugs de seguridad de la memoria presentes en Firefox versión 77. Algunos de estos errores mostraron evidencia de corrupción de la memoria y presumimos que con suficiente esfuerzo algunos de estos podrían haber sido explotados para ejecutar código arbitrario. • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html https://bugzilla.mozilla.org/buglist.cgi?bug_id=1608068%2C1609951%2C1631187%2C1637682 https://security.gentoo.org/glsa/202007-10 https://www.mozilla.org/security/advisories/mfsa2020-24 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-12415
https://notcve.org/view.php?id=CVE-2020-12415
When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a subdirectory. This could cause the appcache to be used to service requests for the top level directory. This vulnerability affects Firefox < 78. Cuando "%2F" estaba presente en una URL de manifiesto, el comportamiento de AppCache de Firefox puede haber sido confundido y permitir que sea servido un manifiesto desde un subdirectorio. Esto podría hacer que el appcache sea usado para atender peticiones para el directorio de nivel superior. • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html https://bugzilla.mozilla.org/show_bug.cgi?id=1586630 https://security.gentoo.org/glsa/202007-10 https://www.mozilla.org/security/advisories/mfsa2020-24 • CWE-276: Incorrect Default Permissions •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12409
https://notcve.org/view.php?id=CVE-2020-12409
When using certain blank characters in a URL, they where incorrectly rendered as spaces instead of an encoded URL. This vulnerability affects Firefox < 77. Cuando usan determinados caracteres en blanco en una URL, fueron incorrectamente renderizados como espacios en lugar de una URL codificada. Esta vulnerabilidad afecta a Firefox versiones anteriores a 77 • https://bugzilla.mozilla.org/show_bug.cgi?id=1629506 https://www.mozilla.org/security/advisories/mfsa2020-20 •
CVSS: 4.4EPSS: 0%CPEs: 4EXPL: 0CVE-2020-12399 – nss: Timing attack on DSA signature generation
https://notcve.org/view.php?id=CVE-2020-12399
NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. NSS ha mostrado diferencias de sincronización cuando se llevan a cabo firmas DSA, que fue explotable y eventualmente podría filtrar claves privadas. Esta vulnerabilidad afecta a Thunderbird versiones anteriores a 68.9.0, Firefox versiones anteriores a 77 y Firefox ESR versiones anteriores a 68.9 A flaw was found in the DSA signature generation function in nss. During the process of generating a DSA signature, the nonce value 'k' is not padded, exposing the bit length. • https://bugzilla.mozilla.org/show_bug.cgi?id=1631576 https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html https://security.gentoo.org/glsa/202007-49 https://usn.ubuntu.com/4421-1 https://www.debian.org/security/2020/dsa-4726 https://www.mozilla.org/security/advisories/mfsa2020-20 https://www.mozilla.org/security/advisories/mfsa2020-21 https://www.mozilla.org/security/advisories/mfsa2020-22 https://access.redhat.com/security/cve/CVE-2020-12399 https://bugzilla • CWE-203: Observable Discrepancy CWE-327: Use of a Broken or Risky Cryptographic Algorithm •