CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5160
https://notcve.org/view.php?id=CVE-2018-5160
WebRTC can use a "WrappedI420Buffer" pixel buffer but the owning image object can be freed while it is still in use. This can result in the WebRTC encoder using uninitialized memory, leading to a potentially exploitable crash. This vulnerability affects Firefox < 60. WebRTC puede utilizar un búfer de píxeles "WrappedI420Buffer", pero el objeto owning image puede liberarse mientras está en uso. Esto puede provocar que el codificador WebRTC utilice memoria no inicializada, lo que puede provocar un cierre inesperado potencialmente explotable. • http://www.securityfocus.com/bid/104139 http://www.securitytracker.com/id/1040896 https://bugzilla.mozilla.org/show_bug.cgi?id=1436117 https://usn.ubuntu.com/3645-1 https://www.mozilla.org/security/advisories/mfsa2018-11 • CWE-416: Use After Free CWE-908: Use of Uninitialized Resource •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5167
https://notcve.org/view.php?id=CVE-2018-5167
The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display "javascript:" links, which users could be tricked into clicking by malicious sites. This vulnerability affects Firefox < 60. • http://www.securityfocus.com/bid/104139 http://www.securitytracker.com/id/1040896 https://bugzilla.mozilla.org/show_bug.cgi?id=1447969 https://usn.ubuntu.com/3645-1 https://www.mozilla.org/security/advisories/mfsa2018-11 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5166
https://notcve.org/view.php?id=CVE-2018-5166
WebExtensions can use request redirection and a "filterReponseData" filter to bypass host permission settings to redirect network traffic and access content from a host for which they do not have explicit user permission. This vulnerability affects Firefox < 60. WebExtensions puede utilizar la redirección de peticiones y un filtro "filterReponseData" para eludir la configuración de permisos del host para redirigir el tráfico de red y acceder al contenido de un host para el que no tienen permiso explícito del usuario. Esta vulnerabilidad afecta a las versiones anteriores a la 60 de Firefox. • http://www.securityfocus.com/bid/104139 http://www.securitytracker.com/id/1040896 https://bugzilla.mozilla.org/show_bug.cgi?id=1437325 https://usn.ubuntu.com/3645-1 https://www.mozilla.org/security/advisories/mfsa2018-11 • CWE-269: Improper Privilege Management •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5182
https://notcve.org/view.php?id=CVE-2018-5182
If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specified local file will be opened. This is contrary to policy and is what would happen if the string were the equivalent "file:" URL. This vulnerability affects Firefox < 60. Si se arrastra una cadena de texto que resulta ser un nombre de archivo en el formato nativo del sistema operativo y se suelta en la barra de direcciones, se abrirá el archivo local especificado. Esto es contrario a la política establecida y es lo que pasaría si la cadena fuera la URL equivalente "file:". • http://www.securityfocus.com/bid/104139 http://www.securitytracker.com/id/1040896 https://bugzilla.mozilla.org/show_bug.cgi?id=1435908 https://usn.ubuntu.com/3645-1 https://www.mozilla.org/security/advisories/mfsa2018-11 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-5177
https://notcve.org/view.php?id=CVE-2018-5177
A vulnerability exists in XSLT during number formatting where a negative buffer size may be allocated in some instances, leading to a buffer overflow and crash if it occurs. This vulnerability affects Firefox < 60. Existe una vulnerabilidad en XSLT durante el formateo de números en la que se puede asignar un tamaño de búfer negativo en algunos casos, lo que provoca un desbordamiento de búfer y un cierre inesperado si ocurre. Esta vulnerabilidad afecta a las versiones anteriores a la 60 de Firefox. • http://www.securityfocus.com/bid/104139 http://www.securitytracker.com/id/1040896 https://bugzilla.mozilla.org/show_bug.cgi?id=1451908 https://usn.ubuntu.com/3645-1 https://www.mozilla.org/security/advisories/mfsa2018-11 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •