CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-11691 – Mozilla: Use-after-free in XMLHttpRequest
https://notcve.org/view.php?id=CVE-2019-11691
A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Puede ocurrir una vulnerabilidad de uso después de liberarse cuando se trabaja con XMLHttpRequest (XHR) en un bucle de eventos, lo que hace que se llame al subproceso principal de XHR después de que se haya liberado. Esto da lugar a una caída potencialmente explotable. • https://bugzilla.mozilla.org/show_bug.cgi?id=1542465 https://www.mozilla.org/security/advisories/mfsa2019-13 https://www.mozilla.org/security/advisories/mfsa2019-14 https://www.mozilla.org/security/advisories/mfsa2019-15 https://access.redhat.com/security/cve/CVE-2019-11691 https://bugzilla.redhat.com/show_bug.cgi?id=1712617 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11697
https://notcve.org/view.php?id=CVE-2019-11697
If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that keeps the prompt visible in order for users to accept or decline the installation. A malicious web page could use this with spoofing on the page to trick users into installing a malicious extension. This vulnerability affects Firefox < 67. Si se presionan las teclas ALT y "a" cuando los usuarios reciben una solicitud de instalación de extensión, la extensión se instalará sin la demora de instalación que mantiene la solicitud visible para que los usuarios acepten o rechacen la instalación. Una página web maliciosa podría usar esto con la suplantación de identidad en la página para engañar a los usuarios para que instalen una extensión maliciosa. • https://bugzilla.mozilla.org/show_bug.cgi?id=1440079 https://www.mozilla.org/security/advisories/mfsa2019-13 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-9820 – Mozilla: Use-after-free of ChromeEventHandler by DocShell
https://notcve.org/view.php?id=CVE-2019-9820
A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Puede ocurrir una vulnerabilidad de uso de la memoria previamente liberada en el controlador de eventos de Chrome cuando se libera mientras aún está en uso. Esto resulta en un bloqueo potencialmente explotable. • https://bugzilla.mozilla.org/show_bug.cgi?id=1536405 https://www.mozilla.org/security/advisories/mfsa2019-13 https://www.mozilla.org/security/advisories/mfsa2019-14 https://www.mozilla.org/security/advisories/mfsa2019-15 https://access.redhat.com/security/cve/CVE-2019-9820 https://bugzilla.redhat.com/show_bug.cgi?id=1712629 • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-9806
https://notcve.org/view.php?id=CVE-2019-9806
A vulnerability exists during authorization prompting for FTP transaction where successive modal prompts are displayed and cannot be immediately dismissed. This allows for a denial of service (DOS) attack. This vulnerability affects Firefox < 66. Una vulnerabilidad existente durante la solicitud de una transacción FTP donde sucesivos mensajes modales son mostrados y no pueden ser inmediatamente rechazados. Esto permite un ataque de denegación de servicios (DoS). • https://bugzilla.mozilla.org/show_bug.cgi?id=1525267 https://www.mozilla.org/security/advisories/mfsa2019-07 • CWE-399: Resource Management Errors •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-9794
https://notcve.org/view.php?id=CVE-2019-9794
A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This could be used to retrieve and execute files whose location is supplied through these command line arguments if Firefox is configured as the default URI handler for a given URI scheme in third party applications and these applications insufficiently sanitize URL data. *Note: This issue only affects Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66. • https://bugzilla.mozilla.org/show_bug.cgi?id=1530103 https://www.mozilla.org/security/advisories/mfsa2019-07 https://www.mozilla.org/security/advisories/mfsa2019-08 https://www.mozilla.org/security/advisories/mfsa2019-11 • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •