CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-45420 – Mozilla: Iframe contents could be rendered outside the iframe
https://notcve.org/view.php?id=CVE-2022-45420
Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Al utilizar tablas dentro de un iframe, un atacante podría haber provocado que el contenido del iframe se representara fuera de los límites del iframe, lo que provocaría una posible confusión del usuario o ataques de suplantación de identidad. Esta vulnerabilidad afecta a Firefox ESR < 102,5, Thunderbird < 102.5 y Firefox < 107. The Mozilla Foundation Security Advisory describes this flaw as: Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks. • https://bugzilla.mozilla.org/show_bug.cgi?id=1792643 https://www.mozilla.org/security/advisories/mfsa2022-47 https://www.mozilla.org/security/advisories/mfsa2022-48 https://www.mozilla.org/security/advisories/mfsa2022-49 https://access.redhat.com/security/cve/CVE-2022-45420 https://bugzilla.redhat.com/show_bug.cgi?id=2143242 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-45421 – Mozilla: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5
https://notcve.org/view.php?id=CVE-2022-45421
Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. The Mozilla Foundation Security Advisory describes this flaw as: Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Firefox 106 and Firefox ESR 102.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1767920%2C1789808%2C1794061 https://www.mozilla.org/security/advisories/mfsa2022-47 https://www.mozilla.org/security/advisories/mfsa2022-48 https://www.mozilla.org/security/advisories/mfsa2022-49 https://access.redhat.com/security/cve/CVE-2022-45421 https://bugzilla.redhat.com/show_bug.cgi?id=2143243 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-3266
https://notcve.org/view.php?id=CVE-2022-3266
An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. Puede ocurrir una lectura fuera de los límites al decodificar video H264. Esto da como resultado un bloqueo potencialmente explotable. • https://bugzilla.mozilla.org/show_bug.cgi?id=1767360 https://www.mozilla.org/security/advisories/mfsa2022-40 https://www.mozilla.org/security/advisories/mfsa2022-41 https://www.mozilla.org/security/advisories/mfsa2022-42 • CWE-125: Out-of-bounds Read •
CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2022-42927 – Mozilla: Same-origin policy violation could have leaked cross-origin URLs
https://notcve.org/view.php?id=CVE-2022-42927
A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. Una infracción de la política del mismo origen podría haber permitido el robo de entradas de URL de origen cruzado, filtrando el resultado de una redirección, a través de 'performance.getEntries()'. Esta vulnerabilidad afecta a Firefox < 106, Firefox ESR < 102.4 y Thunderbird < 102.4. A flaw was found in Mozilla. • https://bugzilla.mozilla.org/show_bug.cgi?id=1789128 https://www.mozilla.org/security/advisories/mfsa2022-44 https://www.mozilla.org/security/advisories/mfsa2022-45 https://www.mozilla.org/security/advisories/mfsa2022-46 https://access.redhat.com/security/cve/CVE-2022-42927 https://bugzilla.redhat.com/show_bug.cgi?id=2136156 • CWE-346: Origin Validation Error CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-42928 – Mozilla: Memory Corruption in JS Engine
https://notcve.org/view.php?id=CVE-2022-42928
Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. A ciertos tipos de asignaciones les faltaban anotaciones que, si el recolector de elementos no utilizados estaba en un estado específico, podrían haber provocado daños en la memoria y un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Firefox < 106, Firefox ESR < 102.4 y Thunderbird < 102.4. A flaw was found in Mozilla. • https://bugzilla.mozilla.org/show_bug.cgi?id=1791520 https://www.mozilla.org/security/advisories/mfsa2022-44 https://www.mozilla.org/security/advisories/mfsa2022-45 https://www.mozilla.org/security/advisories/mfsa2022-46 https://access.redhat.com/security/cve/CVE-2022-42928 https://bugzilla.redhat.com/show_bug.cgi?id=2136157 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-476: NULL Pointer Dereference •