CVSS: 3.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4579
https://notcve.org/view.php?id=CVE-2023-4579
Search queries in the default search engine could appear to have been the currently navigated URL if the search query itself was a well formed URL. This could have led to a site spoofing another if it had been maliciously set as the default search engine. This vulnerability affects Firefox < 117. Las consultas de búsqueda en el motor de búsqueda predeterminado podrían parecer haber sido la URL navegada actualmente si la consulta de búsqueda en sí fuera una URL bien formada. Esto podría haber llevado a que un sitio suplantara a otro si se hubiera configurado maliciosamente como motor de búsqueda predeterminado. • https://bugzilla.mozilla.org/show_bug.cgi?id=1842766 https://security.gentoo.org/glsa/202401-10 https://www.mozilla.org/security/advisories/mfsa2023-34 •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-4584 – Mozilla: Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
https://notcve.org/view.php?id=CVE-2023-4584
Memory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Errores de seguridad de la memoria presentes en Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14 y Thunderbird 115.1. Algunos de estos errores mostraron evidencia de corrupción de memoria y suponemos que con suficiente esfuerzo algunos de ellos podrían haberse aprovechado para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1843968%2C1845205%2C1846080%2C1846526%2C1847529 https://www.mozilla.org/security/advisories/mfsa2023-34 https://www.mozilla.org/security/advisories/mfsa2023-35 https://www.mozilla.org/security/advisories/mfsa2023-36 https://www.mozilla.org/security/advisories/mfsa2023-37 https://www.mozilla.org/security/advisories/mfsa2023-38 https://access.redhat.com/security/cve/CVE-2023-4584 https://bugzilla.redhat.com/show_bug.cgi?id=2236084 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-4577 – Mozilla: Memory corruption in JIT UpdateRegExpStatics
https://notcve.org/view.php?id=CVE-2023-4577
When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Cuando `UpdateRegExpStatics` intentó acceder a `initialStringHeap`, es posible que ya se haya recolectado basura antes de ingresar a la función, lo que podría haber provocado un bloqueo explotable. Esta vulnerabilidad afecta a Firefox < 117, Firefox ESR < 115.2 y Thunderbird < 115.2. The Mozilla Foundation Security Advisory describes this flaw as: When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash. • https://bugzilla.mozilla.org/show_bug.cgi?id=1847397 https://www.mozilla.org/security/advisories/mfsa2023-34 https://www.mozilla.org/security/advisories/mfsa2023-36 https://www.mozilla.org/security/advisories/mfsa2023-38 https://access.redhat.com/security/cve/CVE-2023-4577 https://bugzilla.redhat.com/show_bug.cgi?id=2236075 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-4578 – Mozilla: Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
https://notcve.org/view.php?id=CVE-2023-4578
When calling `JS::CheckRegExpSyntax` a Syntax Error could have been set which would end in calling `convertToRuntimeErrorAndClear`. A path in the function could attempt to allocate memory when none is available which would have caused a newly created Out of Memory exception to be mishandled as a Syntax Error. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Al llamar a `JS::CheckRegExpSyntax`, se podría haber establecido un error de sintaxis que terminaría llamando a `convertToRuntimeErrorAndClear`. Una ruta en la función podría intentar asignar memoria cuando no hay ninguna disponible, lo que habría provocado que una excepción de Falta de Memoria recién creada se manejara incorrectamente como un Error de Sintaxis. • https://bugzilla.mozilla.org/show_bug.cgi?id=1839007 https://www.mozilla.org/security/advisories/mfsa2023-34 https://www.mozilla.org/security/advisories/mfsa2023-36 https://www.mozilla.org/security/advisories/mfsa2023-38 https://access.redhat.com/security/cve/CVE-2023-4578 https://bugzilla.redhat.com/show_bug.cgi?id=2236077 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-4580 – Mozilla: Push notifications saved to disk unencrypted
https://notcve.org/view.php?id=CVE-2023-4580
Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Las notificaciones push almacenadas en el disco en modo de navegación privada no estaban cifradas, lo que potencialmente permitía la filtración de información confidencial. Esta vulnerabilidad afecta a Firefox < 117, Firefox ESR < 115.2 y Thunderbird < 115.2. The Mozilla Foundation Security Advisory describes this flaw as: Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information. • https://bugzilla.mozilla.org/show_bug.cgi?id=1843046 https://www.mozilla.org/security/advisories/mfsa2023-34 https://www.mozilla.org/security/advisories/mfsa2023-36 https://www.mozilla.org/security/advisories/mfsa2023-38 https://access.redhat.com/security/cve/CVE-2023-4580 https://bugzilla.redhat.com/show_bug.cgi?id=2236079 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-311: Missing Encryption of Sensitive Data •