CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-5427
https://notcve.org/view.php?id=CVE-2017-5427
A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. If a malicious user with local access puts chrome.manifest and other referenced files in this directory, they will be loaded and activated during startup. This could result in malicious software being added without consent or modification of referenced installed files. This vulnerability affects Firefox < 52. Un archivo chrome.manifest inexistente intentará cargarse durante el arranque desde el directorio de instalación primario. • http://www.securityfocus.com/bid/96692 http://www.securitytracker.com/id/1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1295542 https://www.mozilla.org/security/advisories/mfsa2017-05 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 1CVE-2017-5418
https://notcve.org/view.php?id=CVE-2017-5418
An out of bounds read error occurs when parsing some HTTP digest authorization responses, resulting in information leakage through the reading of random memory containing matches to specifically set patterns. This vulnerability affects Firefox < 52 and Thunderbird < 52. Ocurre un error de lectura fuera de límites al analizar algunas respuestas HTTP de autorización digest, lo que resulta en una fuga de información mediante la lectura de memoria aleatoria que contiene coincidencias a patrones establecidos específicamente. La vulnerabilidad afecta a Firefox en versiones anteriores a la 52 y Thunderbird en versiones anteriores a la 52. • http://www.securityfocus.com/bid/96692 http://www.securitytracker.com/id/1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1338876 https://www.mozilla.org/security/advisories/mfsa2017-05 https://www.mozilla.org/security/advisories/mfsa2017-09 • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-5414
https://notcve.org/view.php?id=CVE-2017-5414
The file picker dialog can choose and display the wrong local default directory when instantiated. On some operating systems, this can lead to information disclosure, such as the operating system or the local account name. This vulnerability affects Firefox < 52 and Thunderbird < 52. El diálogo file picker puede elegir y mostrar el directorio local por defecto equivocado cuando se instancia. En algunos sistemas operativos, esto puede conducir a una divulgación de información, como el sistema operativo o el nombre de la cuenta local. • http://www.securityfocus.com/bid/96692 http://www.securitytracker.com/id/1037966 https://bugzilla.mozilla.org/show_bug.cgi?id=1319370 https://www.mozilla.org/security/advisories/mfsa2017-05 https://www.mozilla.org/security/advisories/mfsa2017-09 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-5381
https://notcve.org/view.php?id=CVE-2017-5381
The "export" function in the Certificate Viewer can force local filesystem navigation when the "common name" in a certificate contains slashes, allowing certificate content to be saved in unsafe locations with an arbitrary filename. This vulnerability affects Firefox < 51. La función "export" en el visor de certificados puede forzar la navegación por el sistema de archivos local cuando el "common name" en un certificado contiene barras diagonales, lo que permite guardar el contenido de los certificados en ubicaciones inseguras con un nombre de archivo arbitrario. La vulnerabilidad afecta a Firefox en versiones anteriores a la 51. • http://www.securityfocus.com/bid/95763 http://www.securitytracker.com/id/1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1017616 https://www.mozilla.org/security/advisories/mfsa2017-01 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-5393
https://notcve.org/view.php?id=CVE-2017-5393
The "mozAddonManager" allows for the installation of extensions from the CDN for addons.mozilla.org, a publicly accessible site. This could allow malicious extensions to install additional extensions from the CDN in combination with an XSS attack on Mozilla AMO sites. This vulnerability affects Firefox < 51. "mozAddonManager" permite la instalación de extensiones del CDN para addons.mozilla.org, un sitio accesible de forma pública. Esto podría permitir que extensiones maliciosas instalen extensiones adicionales del CDN en combinación con un ataque de Cross-Site Scripting (XSS) en sitios Mozilla AMO. • http://www.securityfocus.com/bid/95763 http://www.securitytracker.com/id/1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1309282 https://www.mozilla.org/security/advisories/mfsa2017-01 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •