CVSS: 9.3EPSS: 0%CPEs: 6EXPL: 0CVE-2020-12410 – Mozilla: Memory safety bugs fixed in Firefox 77 and Firefox ESR 68.9
https://notcve.org/view.php?id=CVE-2020-12410
Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. Los desarrolladores de Mozilla reportaron bugs de seguridad de la memoria presentes en Firefox versión 76 y Firefox ESR versión 68.8. Algunos de estos bugs mostraron evidencia de corrupción de la memoria y presumimos que con suficiente esfuerzo algunos de estos podrían haber sido explotados para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1619305%2C1632717 https://usn.ubuntu.com/4421-1 https://www.mozilla.org/security/advisories/mfsa2020-20 https://www.mozilla.org/security/advisories/mfsa2020-21 https://www.mozilla.org/security/advisories/mfsa2020-22 https://access.redhat.com/security/cve/CVE-2020-12410 https://bugzilla.redhat.com/show_bug.cgi?id=1843030 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 10.0EPSS: 1%CPEs: 3EXPL: 0CVE-2020-12388 – Firefox Default Content Process DACL Sandbox Escape
https://notcve.org/view.php?id=CVE-2020-12388
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76. Los procesos de contenido de Firefox no bloquearon suficientemente el control de acceso, lo que podría resultar en un escape del sandbox. *Nota: este problema solo afecta a Firefox en los sistemas operativos Windows.*. • http://packetstormsecurity.com/files/157860/Firefox-Default-Content-Process-DACL-Sandbox-Escape.html https://bugzilla.mozilla.org/show_bug.cgi?id=1618911 https://www.mozilla.org/security/advisories/mfsa2020-16 https://www.mozilla.org/security/advisories/mfsa2020-17 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2020-12389
https://notcve.org/view.php?id=CVE-2020-12389
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76. Los procesos de contenido de Firefox no bloquearon suficientemente el control de acceso, lo que podría resultar en un escape del sandbox. *Nota: este problema solo afecta a Firefox en los sistemas operativos Windows.*. • https://bugzilla.mozilla.org/show_bug.cgi?id=1554110 https://www.mozilla.org/security/advisories/mfsa2020-16 https://www.mozilla.org/security/advisories/mfsa2020-17 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12390
https://notcve.org/view.php?id=CVE-2020-12390
Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks. This vulnerability affects Firefox < 76. Una serialización incorrecta del origen de las URL con direcciones IPv6 podría conllevar a comprobaciones de seguridad incorrectas. Esta vulnerabilidad afecta a Firefox versiones anteriores a 76. • https://bugzilla.mozilla.org/show_bug.cgi?id=1141959 https://www.mozilla.org/security/advisories/mfsa2020-16 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12391
https://notcve.org/view.php?id=CVE-2020-12391
Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should have been blocked, albeit with a unique opaque origin. This vulnerability affects Firefox < 76. Documentos formados usando datos: las URL en un elemento OBJECT presentaron un fallo al heredar el CSP del contexto de creación. Esto permitió la ejecución de scripts que debieron haber sido bloqueados, aunque con un origen opaco único. • https://bugzilla.mozilla.org/show_bug.cgi?id=1457100 https://www.mozilla.org/security/advisories/mfsa2020-16 • CWE-863: Incorrect Authorization •