CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2021-23968 – Mozilla: Content Security Policy violation report could have contained the destination of a redirect
https://notcve.org/view.php?id=CVE-2021-23968
If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. Si la Política de Seguridad de Contenido bloqueaba la navegación de tramas, el destino completo de un redireccionamiento servido en la trama se reportaba en el informe de infracción; a diferencia del URI de la trama original. Esto podría ser usado para filtrar información confidencial contenida en dichos URI. • https://bugzilla.mozilla.org/show_bug.cgi?id=1687342 https://lists.debian.org/debian-lts-announce/2021/03/msg00000.html https://security.gentoo.org/glsa/202104-09 https://security.gentoo.org/glsa/202104-10 https://www.debian.org/security/2021/dsa-4866 https://www.mozilla.org/security/advisories/mfsa2021-07 https://www.mozilla.org/security/advisories/mfsa2021-08 https://www.mozilla.org/security/advisories/mfsa2021-09 https://access.redhat.com/security/cve/CVE-2021-23968 https:&# • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2021-23969 – Mozilla: Content Security Policy violation report could have contained the destination of a redirect
https://notcve.org/view.php?id=CVE-2021-23969
As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. • https://bugzilla.mozilla.org/show_bug.cgi?id=1542194 https://lists.debian.org/debian-lts-announce/2021/03/msg00000.html https://security.gentoo.org/glsa/202104-09 https://security.gentoo.org/glsa/202104-10 https://www.debian.org/security/2021/dsa-4866 https://www.mozilla.org/security/advisories/mfsa2021-07 https://www.mozilla.org/security/advisories/mfsa2021-08 https://www.mozilla.org/security/advisories/mfsa2021-09 https://access.redhat.com/security/cve/CVE-2021-23969 https:&# • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2021-23978 – Mozilla: Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
https://notcve.org/view.php?id=CVE-2021-23978
Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. Los desarrolladores de Mozilla reportaron bugs de seguridad de la memoria presentes en Firefox versión 85 y Firefox ESR versión 78.7. Algunos de estos bugs mostraron evidencia de corrupción de la memoria y suponemos que con esfuerzo suficiente algunos de ellos podrían haber sido explotado para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=786797%2C1682928%2C1687391%2C1687597 https://lists.debian.org/debian-lts-announce/2021/03/msg00000.html https://security.gentoo.org/glsa/202104-09 https://security.gentoo.org/glsa/202104-10 https://www.debian.org/security/2021/dsa-4866 https://www.mozilla.org/security/advisories/mfsa2021-07 https://www.mozilla.org/security/advisories/mfsa2021-08 https://www.mozilla.org/security/advisories/mfsa2021-09 https://access.redhat.com/security/cve& • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2021-23973 – Mozilla: MediaError message property could have leaked information about cross-origin resources
https://notcve.org/view.php?id=CVE-2021-23973
When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed information about the resource. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. Cuando se intenta cargar un recurso de origen cruzado en un contexto de audio y video, puede haber resultado un error de decodificación, y el contenido de ese error puede haber divulgado información sobre el recurso. Esta vulnerabilidad afecta a Firefox versiones anteriores a 86, Thunderbird versiones anteriores a 78,8 y Firefox ESR versiones anteriores a 78,8 • https://bugzilla.mozilla.org/show_bug.cgi?id=1690976 https://lists.debian.org/debian-lts-announce/2021/03/msg00000.html https://security.gentoo.org/glsa/202104-09 https://security.gentoo.org/glsa/202104-10 https://www.debian.org/security/2021/dsa-4866 https://www.mozilla.org/security/advisories/mfsa2021-07 https://www.mozilla.org/security/advisories/mfsa2021-08 https://www.mozilla.org/security/advisories/mfsa2021-09 https://access.redhat.com/security/cve/CVE-2021-23973 https:&# • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 9.8EPSS: 1%CPEs: 7EXPL: 0CVE-2020-15683 – Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4
https://notcve.org/view.php?id=CVE-2020-15683
Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4, Firefox < 82, and Thunderbird < 78.4. Los desarrolladores de Mozilla y los miembros de la comunidad informaron bugs de seguridad de la memoria presentes en Firefox versión 81 y Firefox ESR versión 78.3. Algunos de estos bugs mostraron evidencia de corrupción de la memoria y suponemos que con suficiente esfuerzo algunos de ellos podrían haber sido explotados para ejecutar código arbitrario. • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00057.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00062.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00074.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00077.html https://bugzilla.mozilla.org/buglist.cgi?bug_id=1576843%2C1656987%2C1660954%2C1662760%2C1663439%2C1666140 https://lists.debian.org/debian-lts-announce/2020/10/msg00027.html https://security.gentoo.org/glsa/202010 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-416: Use After Free CWE-787: Out-of-bounds Write •