CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-12375
https://notcve.org/view.php?id=CVE-2018-12375
Memory safety bugs present in Firefox 61. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 62. Hay errores de seguridad de memoria en Firefox 61. Algunos de estos errores mostraron evidencias de corrupción de memoria y se entiende que, con el suficiente esfuerzo, algunos de estos podrían explotarse para ejecutar código arbitrario. • http://www.securityfocus.com/bid/105276 http://www.securitytracker.com/id/1041610 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1478849%2C1433502%2C1480965%2C894215%2C1462693%2C1475431%2C1461027 https://usn.ubuntu.com/3761-1 https://www.mozilla.org/security/advisories/mfsa2018-20 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.5EPSS: 0%CPEs: 18EXPL: 1CVE-2018-12383 – Mozilla: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords
https://notcve.org/view.php?id=CVE-2018-12383
If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Firefox 58. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Firefox < 62, Firefox ESR < 60.2.1, and Thunderbird < 60.2.1. • http://www.securityfocus.com/bid/105276 http://www.securitytracker.com/id/1041610 http://www.securitytracker.com/id/1041701 https://access.redhat.com/errata/RHSA-2018:2834 https://access.redhat.com/errata/RHSA-2018:2835 https://access.redhat.com/errata/RHSA-2018:3403 https://access.redhat.com/errata/RHSA-2018:3458 https://bugzilla.mozilla.org/show_bug.cgi?id=1475775 https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html https://security.gentoo.org/glsa/201810- • CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer CWE-522: Insufficiently Protected Credentials •
CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 1CVE-2018-16646 – poppler: infinite recursion in Parser::getObj function in Parser.cc
https://notcve.org/view.php?id=CVE-2018-16646
In Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. En Poppler 0.68.0, la función Parser::getObj() en Parser.cc podría provocar una recursión infinita mediante un archivo manipulado. Un atacante remoto puede aprovecharse de esto para provocar un ataque de denegación de servicio (DoS). • https://access.redhat.com/errata/RHSA-2019:2022 https://bugzilla.redhat.com/show_bug.cgi?id=1622951 https://lists.debian.org/debian-lts-announce/2018/10/msg00024.html https://lists.debian.org/debian-lts-announce/2018/11/msg00040.html https://lists.debian.org/debian-lts-announce/2018/12/msg00004.html https://lists.debian.org/debian-lts-announce/2020/07/msg00018.html https://usn.ubuntu.com/3837-1 https://usn.ubuntu.com/3837-2 https://access.redhat.com/security/cve/CVE • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-16643 – ImageMagick: missing check for fputc function in multiple files
https://notcve.org/view.php?id=CVE-2018-16643
The functions ReadDCMImage in coders/dcm.c, ReadPWPImage in coders/pwp.c, ReadCALSImage in coders/cals.c, and ReadPICTImage in coders/pict.c in ImageMagick 7.0.8-4 do not check the return value of the fputc function, which allows remote attackers to cause a denial of service via a crafted image file. Las funciones ReadDCMImage en coders/dcm.c, ReadPWPImage en coders/pwp.c, ReadCALSImage en coders/cals.c y ReadPICTImage en coders/pict.c en ImageMagick 7.0.8-4 no comprueban el valor de retorno de la función fputc, lo que permite que los atacantes remotos provoquen una denegación de servicio (DoS) mediante un archivo de imagen manipulado. • https://github.com/ImageMagick/ImageMagick/commit/6b6bff054d569a77973f2140c0e86366e6168a6c https://github.com/ImageMagick/ImageMagick/issues/1199 https://lists.debian.org/debian-lts-announce/2018/10/msg00002.html https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html https://usn.ubuntu.com/3785-1 https://access.redhat.com/security/cve/CVE-2018-16643 https://bugzilla.redhat.com/show_bug.cgi?id=1626599 • CWE-20: Improper Input Validation CWE-252: Unchecked Return Value •
CVSS: 6.5EPSS: 2%CPEs: 6EXPL: 0CVE-2018-16645 – ImageMagick: Out-of-memory ReadBMPImage of coders/bmp.c and ReadDIBImage of codes/dib.c
https://notcve.org/view.php?id=CVE-2018-16645
There is an excessive memory allocation issue in the functions ReadBMPImage of coders/bmp.c and ReadDIBImage of coders/dib.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image file. Hay un problema de asignación de memoria excesiva en las funciones ReadBMPImage en coders/bmp.c y ReadDIBImage en coders/dib.c en ImageMagick 7.0.8-11, que permite que los atacantes remotos provoquen una denegación de servicio (DoS) mediante una imagen manipulada. • https://github.com/ImageMagick/ImageMagick/commit/ecb31dbad39ccdc65868d5d2a37f0f0521250832 https://github.com/ImageMagick/ImageMagick/issues/1268 https://lists.debian.org/debian-lts-announce/2018/10/msg00002.html https://usn.ubuntu.com/3785-1 https://usn.ubuntu.com/4034-1 https://www.debian.org/security/2018/dsa-4316 https://access.redhat.com/security/cve/CVE-2018-16645 https://bugzilla.redhat.com/show_bug.cgi?id=1626611 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •