CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-45420 – Mozilla: Iframe contents could be rendered outside the iframe
https://notcve.org/view.php?id=CVE-2022-45420
16 Nov 2022 — Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Al utilizar tablas dentro de un iframe, un atacante podría haber provocado que el contenido del iframe se representara fuera de los límites del iframe, lo que provocaría una posible confusión del usuario o ataques de suplantación de i... • https://bugzilla.mozilla.org/show_bug.cgi?id=1792643 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 6.4EPSS: 0%CPEs: 3EXPL: 0CVE-2022-45411 – Mozilla: Cross-Site Tracing was possible via non-standard override headers
https://notcve.org/view.php?id=CVE-2022-45411
16 Nov 2022 — Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript (such as cookies protected by HTTPOnly). To mitigate this attack, browsers placed limits on fetch() and XMLHttpRequest; however some webservers have implemented non-standard headers such as X-Http-Method-Override that override the HTTP method, and made this attack possible again. Thunderbird has appli... • https://bugzilla.mozilla.org/show_bug.cgi?id=1790311 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-45416 – Mozilla: Keystroke Side-Channel Leakage
https://notcve.org/view.php?id=CVE-2022-45416
16 Nov 2022 — Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as Prime+Probe could have possibly figured out which keys were being pressed. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Los eventos de teclado hacen referencia a cadenas como "KeyA" que estaban en direcciones fijas, conocidas y ampliamente distribuidas. Los ataques de sincronización basados en caché, como Prime+Probe, posiblemente... • https://bugzilla.mozilla.org/show_bug.cgi?id=1793676 • CWE-203: Observable Discrepancy •
CVSS: 10.0EPSS: 0%CPEs: 6EXPL: 0CVE-2022-45412 – Mozilla: Symlinks may resolve to partially uninitialized buffers
https://notcve.org/view.php?id=CVE-2022-45412
16 Nov 2022 — When resolving a symlink such as file:///proc/self/fd/1, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer.
*This bug only affects Thunderbird on Unix-based operated systems (Android, Linux, MacOS). Windows is unaffected.*. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Al resolver un enlace simbólico como file:///proc/self/fd/1, se puede producir un mensaje de error d... • https://bugzilla.mozilla.org/show_bug.cgi?id=1791029 • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2022-45406 – Mozilla: Use-after-free of a JavaScript Realm
https://notcve.org/view.php?id=CVE-2022-45406
16 Nov 2022 — If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. This could lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. The Mozilla Foundation Security Advisory describes this flaw as: If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references t... • https://bugzilla.mozilla.org/show_bug.cgi?id=1791975 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-45407 – Gentoo Linux Security Advisory 202211-06
https://notcve.org/view.php?id=CVE-2022-45407
16 Nov 2022 — If an attacker loaded a font using <code>FontFace()</code> on a background worker, a use-after-free could have occurred, leading to a potentially exploitable crash. This vulnerability affects Firefox < 107. Si un atacante cargó una fuente usando <code>FontFace()</code> en un trabajador en segundo plano, podría haberse producido un use after free, lo que habría provocado un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Firefox < 107. Multiple security issues were discovered in Firefox. • https://bugzilla.mozilla.org/show_bug.cgi?id=1793314 • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-3266 – Mozilla: Out of bounds read when decoding H264
https://notcve.org/view.php?id=CVE-2022-3266
12 Nov 2022 — An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. Puede ocurrir una lectura fuera de los límites al decodificar video H264. Esto da como resultado un bloqueo potencialmente explotable. • https://bugzilla.mozilla.org/show_bug.cgi?id=1767360 • CWE-125: Out-of-bounds Read •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-42930 – Gentoo Linux Security Advisory 202210-34
https://notcve.org/view.php?id=CVE-2022-42930
01 Nov 2022 — If two Workers were simultaneously initializing their CacheStorage, a data race could have occurred in the `ThirdPartyUtil` component. This vulnerability affects Firefox < 106. Si dos trabajadores inicializaran simultáneamente su CacheStorage, podría haberse producido una "carrera" de datos en el componente 'ThirdPartyUtil'. Esta vulnerabilidad afecta a Firefox < 106. Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in arbitrary code execution. • https://bugzilla.mozilla.org/show_bug.cgi?id=1789503 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-42931 – Ubuntu Security Notice USN-5709-1
https://notcve.org/view.php?id=CVE-2022-42931
01 Nov 2022 — Logins saved by Firefox should be managed by the Password Manager component which uses encryption to save files on-disk. Instead, the username (not password) was saved by the Form Manager to an unencrypted file on disk. This vulnerability affects Firefox < 106. Los inicios de sesión guardados por Firefox deben ser administrados por el componente Administrador de contraseñas, que utiliza cifrado para guardar archivos en el disco. En cambio, el Administrador de formularios guardó el nombre de usuario (no la c... • https://bugzilla.mozilla.org/show_bug.cgi?id=1780571 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2022-42928 – Mozilla: Memory Corruption in JS Engine
https://notcve.org/view.php?id=CVE-2022-42928
20 Oct 2022 — Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. A ciertos tipos de asignaciones les faltaban anotaciones que, si el recolector de elementos no utilizados estaba en un estado específico, podrían haber provocado daños en la memoria y un bloqueo potencialmente explotable. Esta vulnerabilida... • https://bugzilla.mozilla.org/show_bug.cgi?id=1791520 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-476: NULL Pointer Dereference •