CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-22743 – Mozilla: Browser window spoof using fullscreen mode
https://notcve.org/view.php?id=CVE-2022-22743
13 Jan 2022 — When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. Al navegar desde dentro de un iframe mientras se solicita acceso a pantalla completa, una pestaña controlada por un atacante podría haber impedido que el navegador saliera del modo de pantalla completa. Esta vulnerabilidad afecta a Firefox ESR < 91.5, Firefox &l... • https://bugzilla.mozilla.org/show_bug.cgi?id=1739220 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 7.6EPSS: 0%CPEs: 3EXPL: 1CVE-2022-22737 – Mozilla: Race condition when playing audio files
https://notcve.org/view.php?id=CVE-2022-22737
13 Jan 2022 — Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. La construcción de receptores de audio podría haber provocado una condición de ejecución al reproducir archivos de audio y cerrar ventanas. Esto podría haber dado lugar a un use-after-free que provocaría un bloqueo potencialmente explotab... • https://bugzilla.mozilla.org/show_bug.cgi?id=1745874 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-22745 – Mozilla: Leaking cross-origin URLs through securitypolicyviolation event
https://notcve.org/view.php?id=CVE-2022-22745
13 Jan 2022 — Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. Los eventos de violación de la política de seguridad podrían haber filtrado información de origen cruzado sobre violaciones de los ancestros del frame. Esta vulnerabilidad afecta a Firefox ESR < 91.5, Firefox < 96 y Thunderbird < 91.5. A flaw was found in Mozilla. • https://bugzilla.mozilla.org/show_bug.cgi?id=1735856 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 8.8EPSS: 1%CPEs: 6EXPL: 0CVE-2021-43534 – Mozilla: Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
https://notcve.org/view.php?id=CVE-2021-43534
08 Dec 2021 — Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. Los desarrolladores y miembros de la comunidad de Mozilla informaron de bugs de seguridad de memoria presentes en Firefox 93 y Firefox ESR 91.2. Algunos de ... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1606864%2C1712671%2C1730048%2C1735152 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 1%CPEs: 6EXPL: 0CVE-2021-43535 – Mozilla: Use-after-free in HTTP2 Session object
https://notcve.org/view.php?id=CVE-2021-43535
08 Dec 2021 — A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 93, Thunderbird < 91.3, and Firefox ESR < 91.3. Podría haberse producido un uso de memoria previamente liberada cuando un objeto de sesión HTTP2 se liberaba en un hilo diferente, conllevando a una corrupción de memoria y un fallo potencialmente explotable. Esta vulnerabilidad afecta a Firefox versiones ante... • https://bugzilla.mozilla.org/show_bug.cgi?id=1667102 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2021-43541 – Mozilla: External protocol handler parameters were unescaped
https://notcve.org/view.php?id=CVE-2021-43541
08 Dec 2021 — When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. Cuando son invocados manejadores de protocolo para protocolos externos, una URL de parámetro suministrada que contenía espacios no se escapaba correctamente. Esta vulnerabilidad afecta a Thunderbird versiones anteriores a 91.4.0, Firefox ESR versiones anteriores a 91.4.0 y Firefox versiones anteri... • https://bugzilla.mozilla.org/show_bug.cgi?id=1696685 • CWE-428: Unquoted Search Path or Element •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2021-43538 – Mozilla: Missing fullscreen and pointer lock notification when requesting both
https://notcve.org/view.php?id=CVE-2021-43538
08 Dec 2021 — By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. Mediante el uso indebido de una carrera en nuestro código de notificación, un atacante podría haber ocultado a la fuerza la notificación de las páginas que habían recibido acceso a pantalla completa y bloqu... • https://bugzilla.mozilla.org/show_bug.cgi?id=1739091 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 0CVE-2021-43546 – Mozilla: Cursor spoofing could overlay user interface when native cursor is zoomed
https://notcve.org/view.php?id=CVE-2021-43546
08 Dec 2021 — It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. Se han podido recrear ataques anteriores de suplantación del cursor contra usuarios con un cursor nativo ampliado. Esta vulnerabilidad afecta a Thunderbird versiones anteriores a 91.4.0, Firefox ESR versiones anteriores a 91.4.0 y Firefox versiones anteriores a 95 Multiple security issues were discovered in Firefox. I... • https://bugzilla.mozilla.org/show_bug.cgi?id=1737751 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2021-43542 – Mozilla: XMLHttpRequest error codes could have leaked the existence of an external protocol handler
https://notcve.org/view.php?id=CVE-2021-43542
08 Dec 2021 — Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. Usando XMLHttpRequest, un atacante podría haber identificado aplicaciones instaladas sondeando los mensajes de error para cargar protocolos externos. Esta vulnerabilidad afecta a Thunderbird versiones anteriores a 91.4.0, Firefox ESR versiones anteriores a 91.4.0 y Firefox versiones an... • https://bugzilla.mozilla.org/show_bug.cgi?id=1723281 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-43537 – Mozilla: Heap buffer overflow when using structured clone
https://notcve.org/view.php?id=CVE-2021-43537
08 Dec 2021 — An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. Una conversión de tipo incorrecta de los tamaños de enteros de 64 bits a 32 bits permitía a un atacante corromper la memoria, conllevando a un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Thunderbird versiones anteriores a 91.4.0, Firefox ESR versiones an... • https://bugzilla.mozilla.org/show_bug.cgi?id=1738237 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-704: Incorrect Type Conversion or Cast •