CVSS: 5.3EPSS: 8%CPEs: 7EXPL: 1CVE-2023-51766 – Debian Security Advisory 5597-1
https://notcve.org/view.php?id=CVE-2023-51766
24 Dec 2023 — Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports <LF>.<CR><LF> but some other popular e-mail servers do not. Exim hasta 4.97 permite el contrabando SMTP en ciertas configuraciones. • http://www.openwall.com/lists/oss-security/2023/12/24/1 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-6931 – Out-of-bounds write in Linux kernel's Performance Events system component
https://notcve.org/view.php?id=CVE-2023-6931
19 Dec 2023 — A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b. Se puede aprovechar una vulnerabilidad de escritura fuera de los límites en la pila en el componente del sistema Performance Events del kernel de Linux para lograr una... • https://github.com/K0n9-log/CVE-2023-6931 • CWE-787: Out-of-bounds Write •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2023-6873 – Ubuntu Security Notice USN-6562-1
https://notcve.org/view.php?id=CVE-2023-6873
19 Dec 2023 — Memory safety bugs present in Firefox 120. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 121. Errores de seguridad de la memoria presentes en Firefox 120. Algunos de estos errores mostraron evidencia de corrupción de la memoria y suponemos que con suficiente esfuerzo algunos de ellos podrían haberse aprovechado para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1855327%2C1862089%2C1862723 • CWE-787: Out-of-bounds Write •
CVSS: 6.4EPSS: 0%CPEs: 5EXPL: 0CVE-2023-6867 – Mozilla: Clickjacking permission prompts using the popup transition
https://notcve.org/view.php?id=CVE-2023-6867
19 Dec 2023 — The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121. El timing en el que se hace clic en un botón que provoca la desaparición de una ventana emergente era aproximadamente de la misma duración que el retraso anti-clickj... • https://bugzilla.mozilla.org/show_bug.cgi?id=1863863 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2023-6865 – Mozilla: Potential exposure of uninitialized data in <code>EncryptingOutputStream</code>
https://notcve.org/view.php?id=CVE-2023-6865
19 Dec 2023 — `EncryptingOutputStream` was susceptible to exposing uninitialized data. This issue could only be abused in order to write data to a local disk which may have implications for private browsing mode. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121. `EncryptingOutputStream` era susceptible de exponer datos no inicializados. Sólo se puede abusar de este problema para escribir datos en un disco local, lo que puede tener implicaciones para el modo de navegación privada. • https://bugzilla.mozilla.org/show_bug.cgi?id=1864123 • CWE-908: Use of Uninitialized Resource •
CVSS: 10.0EPSS: 1%CPEs: 6EXPL: 0CVE-2023-6864 – Mozilla: Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6
https://notcve.org/view.php?id=CVE-2023-6864
19 Dec 2023 — Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. Errores de seguridad de la memoria presentes en Firefox 120, Firefox ESR 115.5 y Thunderbird 115.5. Algunos de estos errores mostraron evidencia de corrupción de memoria y suponemos... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1736385%2C1810805%2C1846328%2C1856090%2C1858033%2C1858509%2C1862089%2C1862777%2C1864015 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 10.0EPSS: 1%CPEs: 6EXPL: 0CVE-2023-6863 – Mozilla: Undefined behavior in <code>ShutdownObserver()</code>
https://notcve.org/view.php?id=CVE-2023-6863
19 Dec 2023 — The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destructor. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. El `ShutdownObserver()` era susceptible a un comportamiento potencialmente indefinido debido a su dependencia de un tipo dinámico que carecía de un destructor virtual. Esta vulnerabilidad afecta a Firefox ESR <115.6, Thunderbird <115.6 y Firefox <121. The Mozilla Foun... • https://bugzilla.mozilla.org/show_bug.cgi?id=1868901 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 1%CPEs: 5EXPL: 0CVE-2023-6862 – Mozilla: Use-after-free in <code>nsDNSService</code>
https://notcve.org/view.php?id=CVE-2023-6862
19 Dec 2023 — A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during start-up. This vulnerability affects Firefox ESR < 115.6 and Thunderbird < 115.6. Se identificó un use after free en `nsDNSService::Init`. Este problema parece manifestarse raramente durante el inicio. • https://bugzilla.mozilla.org/show_bug.cgi?id=1868042 • CWE-416: Use After Free •
CVSS: 10.0EPSS: 1%CPEs: 6EXPL: 0CVE-2023-6861 – Mozilla: Heap buffer overflow affected <code>nsWindow::PickerOpen(void)</code> in headless mode
https://notcve.org/view.php?id=CVE-2023-6861
19 Dec 2023 — The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. El método `nsWindow::PickerOpen(void)` era susceptible a un desbordamiento de búfer de almacenamiento dinámico cuando se ejecutaba en modo headless. Esta vulnerabilidad afecta a Firefox ESR <115.6, Thunderbird <115.6 y Firefox <121. The Mozilla Foundation Security Advisory describes this flaw as: The ... • https://bugzilla.mozilla.org/show_bug.cgi?id=1864118 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-6860 – Mozilla: Potential sandbox escape due to <code>VideoBridge</code> lack of texture validation
https://notcve.org/view.php?id=CVE-2023-6860
19 Dec 2023 — The `VideoBridge` allowed any content process to use textures produced by remote decoders. This could be abused to escape the sandbox. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. El "VideoBridge" permitía que cualquier proceso de contenido utilizara texturas producidas por decodificadores remotos. Se podría abusar de esto para escapar de la sandbox. • https://bugzilla.mozilla.org/show_bug.cgi?id=1854669 • CWE-20: Improper Input Validation •