CVSS: 8.8EPSS: 52%CPEs: 6EXPL: 0CVE-2020-6806 – Mozilla: BodyStream:: OnInputStreamReady was missing protections against state confusion
https://notcve.org/view.php?id=CVE-2020-6806
By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. Al diseñar cuidadosamente las resoluciones de promesas, fue posible causar una lectura fuera de límites al final de una matriz redimensionada durante la ejecución del script. Esto podría haber conllevado a daños en la memoria y a un bloqueo potencialmente explotable. • http://packetstormsecurity.com/files/157524/Firefox-js-ReadableStreamCloseInternal-Out-Of-Bounds-Access.html https://bugzilla.mozilla.org/show_bug.cgi?id=1612308 https://usn.ubuntu.com/4328-1 https://usn.ubuntu.com/4335-1 https://www.mozilla.org/security/advisories/mfsa2020-08 https://www.mozilla.org/security/advisories/mfsa2020-09 https://www.mozilla.org/security/advisories/mfsa2020-10 https://access.redhat.com/security/cve/CVE-2020-6806 https://bugzilla.redhat.com/show_bug.cgi?id=1812 • CWE-125: Out-of-bounds Read •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2020-6807 – Mozilla: Use-after-free in cubeb during stream destruction
https://notcve.org/view.php?id=CVE-2020-6807
When a device was changed while a stream was about to be destroyed, the <code>stream-reinit</code> task may have been executed after the stream was destroyed, causing a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. Cuando un dispositivo fue cambiado mientras una secuencia estaba a punto de ser destruida, la tarea <code>stream-reinit</code> pudo haberse ejecutado después de que la secuencia fue destruida, causando un uso de la memoria previamente liberada y un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Thunderbird versiones anteriores a 68.6, Firefox versiones anteriores a 74, Firefox versiones anteriores a ESR68.6 y Firefox ESR versiones anteriores a 68.6. The Mozilla Foundation Security Advisory describes this flaw as: When a device was changed while a stream was about to be destroyed, the `stream-reinit` task may have been executed after the stream was destroyed, causing a use-after-free and a potentially exploitable crash. • https://bugzilla.mozilla.org/show_bug.cgi?id=1614971 https://usn.ubuntu.com/4328-1 https://usn.ubuntu.com/4335-1 https://www.mozilla.org/security/advisories/mfsa2020-08 https://www.mozilla.org/security/advisories/mfsa2020-09 https://www.mozilla.org/security/advisories/mfsa2020-10 https://access.redhat.com/security/cve/CVE-2020-6807 https://bugzilla.redhat.com/show_bug.cgi?id=1812201 • CWE-416: Use After Free •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2020-6814 – Mozilla: Memory safety bugs fixed in Firefox 74 and Firefox ESR 68.6
https://notcve.org/view.php?id=CVE-2020-6814
Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. Los desarrolladores de Mozilla reportaron bugs de seguridad de la memoria presentes en Firefox y Thunderbird versión 68.5. Algunos de estos bugs mostraron evidencia de corrupción de la memoria y presumimos que con un esfuerzo suficiente algunos de estos podrían haber sido explotados para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1592078%2C1604847%2C1608256%2C1612636%2C1614339 https://usn.ubuntu.com/4328-1 https://usn.ubuntu.com/4335-1 https://www.mozilla.org/security/advisories/mfsa2020-08 https://www.mozilla.org/security/advisories/mfsa2020-09 https://www.mozilla.org/security/advisories/mfsa2020-10 https://access.redhat.com/security/cve/CVE-2020-6814 https://bugzilla.redhat.com/show_bug.cgi?id=1812205 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6808
https://notcve.org/view.php?id=CVE-2020-6808
When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML document, which is then presented. Previously, this document's URL (as reported by the document.location property, for example) was the originating javascript: URL which could lead to spoofing attacks; it is now correctly the URL of the originating document. This vulnerability affects Firefox < 74. Cuando una JavaScript URL (javascript:) es evaluada y el resultado es una cadena, esta cadena es analizada para crear un documento HTML, que luego es presentado. Anteriormente, la URL de este documento (según lo reportado por la propiedad document.location, por ejemplo) era el URL javascript: de origen que podría conllevar a ataques de suplantación de identidad; ahora es correctamente la URL del documento de origen. • https://bugzilla.mozilla.org/show_bug.cgi?id=1247968 https://www.mozilla.org/security/advisories/mfsa2020-08 • CWE-290: Authentication Bypass by Spoofing •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6809
https://notcve.org/view.php?id=CVE-2020-6809
When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was possible for the Web Extension to read local files. This vulnerability affects Firefox < 74. Cuando una Web Extension tenía el permiso de todas las direcciones URL y realizaba una petición de extracción con un modo establecido en "same-origin", era posible que la Web Extension lea archivos locales. Esta vulnerabilidad afecta a Firefox versiones anteriores a 74. • https://bugzilla.mozilla.org/show_bug.cgi?id=1420296 https://www.mozilla.org/security/advisories/mfsa2020-08 •