CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-4583 – Mozilla: Browsing Context potentially not cleared when closing Private Window
https://notcve.org/view.php?id=CVE-2023-4583
When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Al comprobar si el contexto de navegación se había descartado en `HttpBaseChannel`, si el grupo de carga no estaba disponible, se suponía que ya se había descartado, lo que no siempre era el caso para los canales privados después de que finalizaba la sesión privada. Esta vulnerabilidad afecta a Firefox < 117, Firefox ESR < 115.2 y Thunderbird < 115.2. The Mozilla Foundation Security Advisory describes this flaw as: When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. • https://bugzilla.mozilla.org/show_bug.cgi?id=1842030 https://www.mozilla.org/security/advisories/mfsa2023-34 https://www.mozilla.org/security/advisories/mfsa2023-36 https://www.mozilla.org/security/advisories/mfsa2023-38 https://access.redhat.com/security/cve/CVE-2023-4583 https://bugzilla.redhat.com/show_bug.cgi?id=2236082 • CWE-179: Incorrect Behavior Order: Early Validation CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-4584 – Mozilla: Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
https://notcve.org/view.php?id=CVE-2023-4584
Memory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Errores de seguridad de la memoria presentes en Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14 y Thunderbird 115.1. Algunos de estos errores mostraron evidencia de corrupción de memoria y suponemos que con suficiente esfuerzo algunos de ellos podrían haberse aprovechado para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1843968%2C1845205%2C1846080%2C1846526%2C1847529 https://www.mozilla.org/security/advisories/mfsa2023-34 https://www.mozilla.org/security/advisories/mfsa2023-35 https://www.mozilla.org/security/advisories/mfsa2023-36 https://www.mozilla.org/security/advisories/mfsa2023-37 https://www.mozilla.org/security/advisories/mfsa2023-38 https://access.redhat.com/security/cve/CVE-2023-4584 https://bugzilla.redhat.com/show_bug.cgi?id=2236084 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-4585 – Mozilla: Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2
https://notcve.org/view.php?id=CVE-2023-4585
Memory safety bugs present in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Errores de seguridad de la memoria presentes en Firefox 116, Firefox ESR 115.1 y Thunderbird 115.1. Algunos de estos errores mostraron evidencia de corrupción de memoria y suponemos que con suficiente esfuerzo algunos de ellos podrían haberse aprovechado para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1751583%2C1841082%2C1847904%2C1848999 https://www.mozilla.org/security/advisories/mfsa2023-34 https://www.mozilla.org/security/advisories/mfsa2023-36 https://www.mozilla.org/security/advisories/mfsa2023-38 https://access.redhat.com/security/cve/CVE-2023-4585 https://bugzilla.redhat.com/show_bug.cgi?id=2236086 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-4580 – Mozilla: Push notifications saved to disk unencrypted
https://notcve.org/view.php?id=CVE-2023-4580
Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Las notificaciones push almacenadas en el disco en modo de navegación privada no estaban cifradas, lo que potencialmente permitía la filtración de información confidencial. Esta vulnerabilidad afecta a Firefox < 117, Firefox ESR < 115.2 y Thunderbird < 115.2. The Mozilla Foundation Security Advisory describes this flaw as: Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information. • https://bugzilla.mozilla.org/show_bug.cgi?id=1843046 https://www.mozilla.org/security/advisories/mfsa2023-34 https://www.mozilla.org/security/advisories/mfsa2023-36 https://www.mozilla.org/security/advisories/mfsa2023-38 https://access.redhat.com/security/cve/CVE-2023-4580 https://bugzilla.redhat.com/show_bug.cgi?id=2236079 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-311: Missing Encryption of Sensitive Data •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-4577 – Mozilla: Memory corruption in JIT UpdateRegExpStatics
https://notcve.org/view.php?id=CVE-2023-4577
When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Cuando `UpdateRegExpStatics` intentó acceder a `initialStringHeap`, es posible que ya se haya recolectado basura antes de ingresar a la función, lo que podría haber provocado un bloqueo explotable. Esta vulnerabilidad afecta a Firefox < 117, Firefox ESR < 115.2 y Thunderbird < 115.2. The Mozilla Foundation Security Advisory describes this flaw as: When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash. • https://bugzilla.mozilla.org/show_bug.cgi?id=1847397 https://www.mozilla.org/security/advisories/mfsa2023-34 https://www.mozilla.org/security/advisories/mfsa2023-36 https://www.mozilla.org/security/advisories/mfsa2023-38 https://access.redhat.com/security/cve/CVE-2023-4577 https://bugzilla.redhat.com/show_bug.cgi?id=2236075 • CWE-400: Uncontrolled Resource Consumption •