CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-9796 – Mozilla: Use-after-free with SMIL animation controller
https://notcve.org/view.php?id=CVE-2019-9796
A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a single registration is expected. When a registration is later freed with the removal of the animation controller element, the refresh driver incorrectly leaves a dangling pointer to the driver's observer array. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66. Una vulnerabilidad de uso después de liberación de memoria puede darse cuando el controlador de animación SMIL registra incorrectamente con el controlador de actualización dos veces cuando sólo se espera un único registro. Cuando se libera un registro con la eliminación del elemento de controlador de animación, el controlador de actualización deja incorrectamente un puntero pendiente en la matriz de observadores del controlador. • https://access.redhat.com/errata/RHSA-2019:0966 https://access.redhat.com/errata/RHSA-2019:1144 https://bugzilla.mozilla.org/show_bug.cgi?id=1531277 https://www.mozilla.org/security/advisories/mfsa2019-07 https://www.mozilla.org/security/advisories/mfsa2019-08 https://www.mozilla.org/security/advisories/mfsa2019-11 https://access.redhat.com/security/cve/CVE-2019-9796 https://bugzilla.redhat.com/show_bug.cgi?id=1690681 • CWE-416: Use After Free •
CVSS: 9.8EPSS: 22%CPEs: 11EXPL: 3CVE-2019-9791 – Spidermonkey - IonMonkey Type Inference is Incorrect for Constructors Entered via OSR
https://notcve.org/view.php?id=CVE-2019-9791
The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT) compiler and when the constructor function is entered through on-stack replacement (OSR). This allows for possible arbitrary reading and writing of objects during an exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66. El sistema de inferencia de tipos permite la recopilación de funciones que pueden generar confusiones de tipo entre objetos arbitrarios cuando se compilan por medio del compilador IonMonkey just-in-time (JIT) y cuando se ingresa a la función constructor mediante el reemplazo en la pila (OSR). Esto permite una posible lectura y escritura arbitrarias de objetos durante un bloqueo explotable. • https://www.exploit-db.com/exploits/46613 https://github.com/Sp0pielar/CVE-2019-9791 https://access.redhat.com/errata/RHSA-2019:0966 https://access.redhat.com/errata/RHSA-2019:1144 https://bugzilla.mozilla.org/show_bug.cgi?id=1530958 https://www.mozilla.org/security/advisories/mfsa2019-07 https://www.mozilla.org/security/advisories/mfsa2019-08 https://www.mozilla.org/security/advisories/mfsa2019-11 https://access.redhat.com/security/cve/CVE-2019-9791 https://bugzilla.redhat. • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2018-18499 – Mozilla: Same-origin policy violation using meta refresh and performance.getEntries to steal cross-origin URLs
https://notcve.org/view.php?id=CVE-2018-18499
A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1. Una violación de una política del mismo origen permite el robo de entradas URL Cross-Origin cuando utiliza meta http-equiv="refresh" en una página para provocar un redireccionamiento a otro sitio utilizando performance.getEntries(). Esta es una violación de la política del mismo origen y podría permitir el robo de datos. • https://bugzilla.mozilla.org/show_bug.cgi?id=1468523 https://www.mozilla.org/security/advisories/mfsa2018-20 https://www.mozilla.org/security/advisories/mfsa2018-21 https://www.mozilla.org/security/advisories/mfsa2018-25 https://access.redhat.com/security/cve/CVE-2018-18499 https://bugzilla.redhat.com/show_bug.cgi?id=1849971 • CWE-346: Origin Validation Error CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2018-12400
https://notcve.org/view.php?id=CVE-2018-12400
In private browsing mode on Firefox for Android, favicons are cached in the cache/icons folder as they are in non-private mode. This allows information leakage of sites visited during private browsing sessions. *Note: this issue only affects Firefox for Android. Desktop versions of Firefox are unaffected.*. This vulnerability affects Firefox < 63. • http://www.securityfocus.com/bid/105721 http://www.securitytracker.com/id/1041944 https://bugzilla.mozilla.org/show_bug.cgi?id=1448305 https://www.mozilla.org/security/advisories/mfsa2018-26 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-12401
https://notcve.org/view.php?id=CVE-2018-12401
Some special resource URIs will cause a non-exploitable crash if loaded with optional parameters following a '?' in the parsed string. This could lead to denial of service (DOS) attacks. This vulnerability affects Firefox < 63. Algunas URI de recurso especiales provocarán un cierre inesperado no explotable si se cargan con parámetros opcionales y son seguidos por "?" • http://www.securityfocus.com/bid/105721 http://www.securitytracker.com/id/1041944 https://bugzilla.mozilla.org/show_bug.cgi?id=1422456 https://usn.ubuntu.com/3801-1 https://www.mozilla.org/security/advisories/mfsa2018-26 • CWE-20: Improper Input Validation •