CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2021-29957 – Mozilla: Partial protection of inline OpenPGP message not indicated
https://notcve.org/view.php?id=CVE-2021-29957
07 Jun 2021 — If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicate that only parts of the message are protected. This vulnerability affects Thunderbird < 78.10.2. Si un correo electrónico codificado con MIME contiene una parte del mensaje firmada o cifrada con OpenPGP en línea, pero también contiene una parte adicional no protegida, Thunderbird no indicaba que sólo algunas partes del mensaje estaban protegidas. ... • https://bugzilla.mozilla.org/show_bug.cgi?id=1673241 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2021-29956 – Mozilla: Thunderbird stored OpenPGP secret keys without master password protection
https://notcve.org/view.php?id=CVE-2021-29956
07 Jun 2021 — OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will automatically protect keys that had been imported using affected Thunderbird versions. This vulnerability affects Thunderbird < 78.10.2. Unas claves secretas OpenPGP que se importaban con la versión 78.8.1 de Thunderbird... • https://bugzilla.mozilla.org/show_bug.cgi?id=1710290 • CWE-312: Cleartext Storage of Sensitive Information CWE-522: Insufficiently Protected Credentials •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-29967 – Mozilla: Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
https://notcve.org/view.php?id=CVE-2021-29967
03 Jun 2021 — Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11. Los desarrolladores de Mozilla han reportado bugs de seguridad de memoria presentes en Firefox versión 88 y Firefox ESR versión 78.11. Algunos de estos bugs mostraban evidenci... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1602862%2C1703191%2C1703760%2C1704722%2C1706041 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 1CVE-2021-29951 – Mozilla Windows Maintenance Service Weak DACL
https://notcve.org/view.php?id=CVE-2021-29951
11 May 2021 — The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating (if an attacker spammed the 'Stop' command); but also exposed attack surface in the maintenance service. *Note: This issue only affected Windows operating systems older than Win 10 build 1709. Other operating systems are unaffected.*. This vulnerability affects Thunderb... • https://packetstorm.news/files/id/162522 • CWE-269: Improper Privilege Management •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-29950 – Mozilla: Logic issue potentially leaves key material unlocked
https://notcve.org/view.php?id=CVE-2021-29950
06 May 2021 — Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import task. If the task runs into a failure, the secret key may remain in memory in its unprotected state. This vulnerability affects Thunderbird < 78.8.1. Thunderbird desprotege una clave secreta OpenPGP antes de usarla para una tarea de descifrado, firma o importación de claves. Si la tarea ejecuta un fallo, la clave secreta puede permanecer en la memoria en su estado desprotegido. • https://bugzilla.mozilla.org/show_bug.cgi?id=1673239 • CWE-312: Cleartext Storage of Sensitive Information CWE-522: Insufficiently Protected Credentials •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-29949 – Mozilla: Thunderbird might execute an alternative OTR library
https://notcve.org/view.php?id=CVE-2021-29949
28 Apr 2021 — When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially attempt to open it using a filename that isn't distributed by Thunderbird. If a computer has already been infected with a malicious library of the alternative filename, and the malicious library has been copied to a directory that is contained in the search path for executable libraries, then Thunderbird will load the incorrect library. This vulnerability affects Thunderbird < 78.9.1. Cuando se carga la... • https://bugzilla.mozilla.org/show_bug.cgi?id=1682101 • CWE-426: Untrusted Search Path CWE-427: Uncontrolled Search Path Element •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-29946 – Mozilla: Port blocking could be bypassed
https://notcve.org/view.php?id=CVE-2021-29946
26 Apr 2021 — Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. Los puertos que se escribieron como un desbordamiento de enteros por encima de los límites de un entero de 16 bits podrían haber omitido las restricciones de bloqueo de puertos cuando se usaron en la cabecera Alt-Svc. Esta vulnerabilidad afecta a Firefox ESR ve... • https://bugzilla.mozilla.org/show_bug.cgi?id=1698503 • CWE-190: Integer Overflow or Wraparound •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-24002 – Mozilla: Arbitrary FTP command execution on FTP servers using an encoded URL
https://notcve.org/view.php?id=CVE-2021-24002
26 Apr 2021 — When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and allowed arbitrary commands to be sent to the FTP server. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. Cuando un usuario hacía clic en una URL de FTP conteniendo caracteres de nueva línea codificados (%0A y %0D), las nuevas líneas se interpretaban como tales y permitían que comandos arbitrarios fueran enviados al servidor FTP. Es... • https://bugzilla.mozilla.org/show_bug.cgi?id=1702374 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-23994 – Mozilla: Out of bound write due to lazy initialization
https://notcve.org/view.php?id=CVE-2021-23994
26 Apr 2021 — A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. Un framebuffer de WebGL no se inicializaba con suficiente antelación, resultando en una corrupción de memoria y una escritura fuera de límites. Esta vulnerabilidad afecta a Firefox ESR versiones anteriores a 78.10, Thunderbird versiones anteriores a 78.10 y Firefox versiones anteriores a 88 USN-4995-1 fixed vuln... • https://bugzilla.mozilla.org/show_bug.cgi?id=1699077 • CWE-787: Out-of-bounds Write CWE-909: Missing Initialization of Resource •
CVSS: 2.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-29948 – Mozilla: Race condition when reading from disk while verifying signatures
https://notcve.org/view.php?id=CVE-2021-29948
26 Apr 2021 — Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local process or user is replacing the file. This vulnerability affects Thunderbird < 78.10. Las firmas son escritas en el disco antes y se leen durante la verificación, lo que podría estar sujeto a una condición de carrera cuando un proceso local malicioso o un usuario está reemplazando el archivo. Esta vulnerabilidad afecta a Thunderbird versiones anteriores a 78.10 USN-4995-1 fi... • https://bugzilla.mozilla.org/show_bug.cgi?id=1692899 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •