CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2019-17018
https://notcve.org/view.php?id=CVE-2019-17018
When in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to improve the accuracy of the keyboard. This vulnerability affects Firefox < 72. Cuando se encuentra en Private Browsing Mode en Windows 10, el teclado de Windows puede retener sugerencias de palabras para mejorar la precisión del teclado. Esta vulnerabilidad afecta a Firefox versiones anteriores a la versión 72. • https://bugzilla.mozilla.org/show_bug.cgi?id=1549394 https://www.mozilla.org/security/advisories/mfsa2020-01 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 17EXPL: 0CVE-2019-17017 – Mozilla: Type Confusion in XPCVariant.cpp
https://notcve.org/view.php?id=CVE-2019-17017
Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. Debido a una falta de tipos de objetos del manejo de casos, podría ocurrir una vulnerabilidad de confusión de tipos, resultando en un bloqueo. Suponemos que con el esfuerzo suficiente podría ser explotado para ejecutar código arbitrario. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html https://access.redhat.com/errata/RHSA-2020:0085 https://access.redhat.com/errata/RHSA-2020:0086 https://access.redhat.com/errata/RHSA-2020:0111 https://access.redhat.com/errata/RHSA-2020:0120 https://access.redhat.com/errata/RHSA-2020:0123 https: • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 6.1EPSS: 0%CPEs: 17EXPL: 0CVE-2019-17016 – Mozilla: Bypass of @namespace CSS sanitization during pasting
https://notcve.org/view.php?id=CVE-2019-17016
When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. Al pegar un <style> etiqueta del portapapeles en un editor de texto enriquecido, el saneador CSS reescribe incorrectamente una regla @namespace. Esto podría permitir una inyección en ciertos tipos de sitios web resultando en la filtración de datos. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html https://access.redhat.com/errata/RHSA-2020:0085 https://access.redhat.com/errata/RHSA-2020:0086 https://access.redhat.com/errata/RHSA-2020:0111 https://access.redhat.com/errata/RHSA-2020:0120 https://access.redhat.com/errata/RHSA-2020:0123 https: • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2019-17015
https://notcve.org/view.php?id=CVE-2019-17015
During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. Durante la inicialización de un nuevo proceso de contenido, un desplazamiento del puntero puede ser manipulado lo que conlleva a una corrupción de memoria y un bloqueo explotable potencialmente en el proceso principal. * Nota: este problema solo ocurre en Windows. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html https://bugzilla.mozilla.org/show_bug.cgi?id=1599005 https://seclists.org/bugtraq/2020/Jan/18 https://www.mozilla.org/security/advisories/mfsa2020-01 https://www.mozilla.org/security/advisories/mfsa2020-02 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-17013
https://notcve.org/view.php?id=CVE-2019-17013
Mozilla developers reported memory safety bugs present in Firefox 70. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 71. Los desarrolladores de Mozilla reportaron bugs de seguridad de memoria presentes en Firefox versión 70. Algunos de estos errores mostraron evidencia de corrupción de memoria y suponemos que con un esfuerzo suficiente algunos de estos podrían haber sido explotados para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1298509%2C1472328%2C1577439%2C1577937%2C1580320%2C1584195%2C1585106%2C1586293%2C1593865%2C1594181 https://www.mozilla.org/security/advisories/mfsa2019-36 • CWE-416: Use After Free CWE-787: Out-of-bounds Write •