CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11765
https://notcve.org/view.php?id=CVE-2019-11765
A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown. However, due to lack of validation from the parent process, if the user accepted the permission request an attacker-controlled permission would be granted rather than the 'Click to Play' permission. This vulnerability affects Firefox < 70. Un proceso de contenido comprometido podría enviar un mensaje al proceso principal que causaría que la petición del permiso "Click to Play" sea mostrada . Sin embargo, debido a la falta de comprobación del proceso principal, si el usuario acepta la petición de permiso, un permiso controlado por el atacante sería otorgado en lugar del permiso "Click to Play". • https://bugzilla.mozilla.org/show_bug.cgi?id=1562582 https://www.mozilla.org/security/advisories/mfsa2019-34 • CWE-276: Incorrect Default Permissions •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-11760 – Mozilla: Stack buffer overflow in WebRTC networking
https://notcve.org/view.php?id=CVE-2019-11760
A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Un búfer de pila de tamaño fijo podría desbordarse en nrappkit cuando realiza la señalización de WebRTC. Esto resultó en un bloqueo explotable potencialmente en algunos casos. • https://bugzilla.mozilla.org/show_bug.cgi?id=1577719 https://security.gentoo.org/glsa/202003-10 https://usn.ubuntu.com/4335-1 https://www.mozilla.org/security/advisories/mfsa2019-33 https://www.mozilla.org/security/advisories/mfsa2019-34 https://www.mozilla.org/security/advisories/mfsa2019-35 https://access.redhat.com/security/cve/CVE-2019-11760 https://bugzilla.redhat.com/show_bug.cgi?id=1764441 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-11757 – Mozilla: Use-after-free when creating index updates in IndexedDB
https://notcve.org/view.php?id=CVE-2019-11757
When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. This resulted in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Siguiendo la cadena de prototipos de valor, era posible retener una referencia a una configuración regional, eliminarla y, posteriormente, hacer referencia a ella. Esto resultó en un uso de la memoria previamente liberada y un bloqueo explotable potencialmente. • https://bugzilla.mozilla.org/show_bug.cgi?id=1577107 https://security.gentoo.org/glsa/202003-10 https://usn.ubuntu.com/4335-1 https://www.mozilla.org/security/advisories/mfsa2019-33 https://www.mozilla.org/security/advisories/mfsa2019-34 https://www.mozilla.org/security/advisories/mfsa2019-35 https://access.redhat.com/security/cve/CVE-2019-11757 https://bugzilla.redhat.com/show_bug.cgi?id=1764438 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 4EXPL: 0CVE-2019-11759 – Mozilla: Stack buffer overflow in HKDF output
https://notcve.org/view.php?id=CVE-2019-11759
An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an attacker to execute arbitrary code or more likely lead to a crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Un atacante podría haber causado que 4 bytes de salida HMAC se escribieran más allá del final de un búfer almacenado en la pila. Esto podría ser usado por un atacante para ejecutar código arbitrario o, más probablemente, conllevar a un bloqueo. • https://bugzilla.mozilla.org/show_bug.cgi?id=1577953 https://security.gentoo.org/glsa/202003-10 https://usn.ubuntu.com/4335-1 https://www.mozilla.org/security/advisories/mfsa2019-33 https://www.mozilla.org/security/advisories/mfsa2019-34 https://www.mozilla.org/security/advisories/mfsa2019-35 https://access.redhat.com/security/cve/CVE-2019-11759 https://bugzilla.redhat.com/show_bug.cgi?id=1764440 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2019-11763 – Mozilla: Incorrect HTML parsing results in XSS bypass technique
https://notcve.org/view.php?id=CVE-2019-11763
Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could have led to XSS in a web application under certain conditions. It could have also led to HTML entities being masked from filters - enabling the use of entities to mask the actual characters of interest from filters. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Si no se manejan correctamente los bytes nulos cuando se procesan entidades HTML, Firefox analiza de manera incorrecta estas entidades. • https://bugzilla.mozilla.org/show_bug.cgi?id=1584216 https://security.gentoo.org/glsa/202003-10 https://usn.ubuntu.com/4335-1 https://www.mozilla.org/security/advisories/mfsa2019-33 https://www.mozilla.org/security/advisories/mfsa2019-34 https://www.mozilla.org/security/advisories/mfsa2019-35 https://access.redhat.com/security/cve/CVE-2019-11763 https://bugzilla.redhat.com/show_bug.cgi?id=1764444 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •