CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-9073
https://notcve.org/view.php?id=CVE-2016-9073
WebExtensions can bypass security checks to load privileged URLs and potentially escape the WebExtension sandbox. This vulnerability affects Firefox < 50. WebExtensions puede omitir las comprobaciones de seguridad para cargar URL privilegiadas y escapar del sandbox de WebExtension. La vulnerabilidad afecta a Firefox en versiones anteriores a la 50. • http://www.securityfocus.com/bid/94337 http://www.securitytracker.com/id/1037298 https://bugzilla.mozilla.org/show_bug.cgi?id=1289273 https://www.mozilla.org/security/advisories/mfsa2016-89 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5289
https://notcve.org/view.php?id=CVE-2016-5289
Memory safety bugs were reported in Firefox 49. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50. Se han reportado errores de seguridad de memoria en Firefox 49. Algunos de estos errores mostraron evidencias de corrupción de memoria y se entiende que, con el suficiente esfuerzo, algunos de estos podrían explotarse para ejecutar código arbitrario. • http://www.securityfocus.com/bid/94337 http://www.securitytracker.com/id/1037298 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1296649%2C1298107%2C1300129%2C1305876%2C1314667%2C1301252%2C1277866%2C1307254%2C1252511%2C1264053 https://www.mozilla.org/security/advisories/mfsa2016-89 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2016-9071
https://notcve.org/view.php?id=CVE-2016-9071
Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious server to verify whether a known site is within a user's browser history. This vulnerability affects Firefox < 50. Content Security Policy, junto con la redirección HTTP a HTTPS, puede ser empleado por un servidor malicioso para verificar si un sitio conocido existe en el historial de navegación de un usuario. La vulnerabilidad afecta a Firefox en versiones anteriores a la 50. • http://www.securityfocus.com/bid/94337 http://www.securitytracker.com/id/1037298 https://bugzilla.mozilla.org/show_bug.cgi?id=1285003 https://www.mozilla.org/security/advisories/mfsa2016-89 • CWE-254: 7PK - Security Features •
CVSS: 9.8EPSS: 1%CPEs: 9EXPL: 0CVE-2016-9063
https://notcve.org/view.php?id=CVE-2016-9063
An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50. Desbordamiento de enteros durante el análisis de XML mediante la biblioteca Expat. La vulnerabilidad afecta a Firefox en versiones anteriores a la 50. • http://www.securityfocus.com/bid/94337 http://www.securitytracker.com/id/1037298 http://www.securitytracker.com/id/1039427 https://bugzilla.mozilla.org/show_bug.cgi?id=1274777 https://www.debian.org/security/2017/dsa-3898 https://www.mozilla.org/security/advisories/mfsa2016-89 • CWE-190: Integer Overflow or Wraparound •
CVSS: 5.9EPSS: 0%CPEs: 4EXPL: 0CVE-2016-9074
https://notcve.org/view.php?id=CVE-2016-9074
An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50. Una mitigación existente de los ataques de sincronización por canal lateral es insuficiente en determinadas circunstancias. Este problema se aborda en Network Security Services (NSS) 3.26.1. • http://www.securityfocus.com/bid/94341 http://www.securitytracker.com/id/1037298 https://bugzilla.mozilla.org/show_bug.cgi?id=1293334 https://security.gentoo.org/glsa/201701-15 https://security.gentoo.org/glsa/201701-46 https://www.debian.org/security/2016/dsa-3730 https://www.mozilla.org/security/advisories/mfsa2016-89 https://www.mozilla.org/security/advisories/mfsa2016-90 https://www.mozilla.org/security/advisories/mfsa2016-93 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •