CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-6868 – Gentoo Linux Security Advisory 202401-10
https://notcve.org/view.php?id=CVE-2023-6868
19 Dec 2023 — In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one. This could allow empty messages to be sent from unauthorized parties. *This bug only affects Firefox on Android.* This vulnerability affects Firefox < 121. En algunos casos, el agente de usuario permitiría solicitudes de inserción que carecían de un VAPID válido aunque la suscripción del administrador de inserción definiera uno. Esto podría permitir que se envíen mens... • https://bugzilla.mozilla.org/show_bug.cgi?id=1865488 •
CVSS: 6.4EPSS: 0%CPEs: 5EXPL: 0CVE-2023-6867 – Mozilla: Clickjacking permission prompts using the popup transition
https://notcve.org/view.php?id=CVE-2023-6867
19 Dec 2023 — The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121. El timing en el que se hace clic en un botón que provoca la desaparición de una ventana emergente era aproximadamente de la misma duración que el retraso anti-clickj... • https://bugzilla.mozilla.org/show_bug.cgi?id=1863863 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6866 – Gentoo Linux Security Advisory 202401-10
https://notcve.org/view.php?id=CVE-2023-6866
19 Dec 2023 — TypedArrays can be fallible and lacked proper exception handling. This could lead to abuse in other APIs which expect TypedArrays to always succeed. This vulnerability affects Firefox < 121. TypedArrays puede ser falible y carecer de un manejo de excepciones adecuado. Esto podría dar lugar a abusos en otras API que esperan que TypedArrays siempre tenga éxito. • https://bugzilla.mozilla.org/show_bug.cgi?id=1849037 • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2023-6865 – Mozilla: Potential exposure of uninitialized data in <code>EncryptingOutputStream</code>
https://notcve.org/view.php?id=CVE-2023-6865
19 Dec 2023 — `EncryptingOutputStream` was susceptible to exposing uninitialized data. This issue could only be abused in order to write data to a local disk which may have implications for private browsing mode. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121. `EncryptingOutputStream` era susceptible de exponer datos no inicializados. Sólo se puede abusar de este problema para escribir datos en un disco local, lo que puede tener implicaciones para el modo de navegación privada. • https://bugzilla.mozilla.org/show_bug.cgi?id=1864123 • CWE-908: Use of Uninitialized Resource •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6135 – nss: vulnerable to Minerva side-channel information leak
https://notcve.org/view.php?id=CVE-2023-6135
19 Dec 2023 — Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox < 121. Múltiples curvas NSS NIST fueron susceptibles a un ataque de canal lateral conocido como "Minerva". Este ataque podría permitir potencialmente que un atacante recupere la clave privada. • https://bugzilla.mozilla.org/show_bug.cgi?id=1853908 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy •
CVSS: 10.0EPSS: 0%CPEs: 6EXPL: 0CVE-2023-6864 – Mozilla: Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6
https://notcve.org/view.php?id=CVE-2023-6864
19 Dec 2023 — Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. Errores de seguridad de la memoria presentes en Firefox 120, Firefox ESR 115.5 y Thunderbird 115.5. Algunos de estos errores mostraron evidencia de corrupción de memoria y suponemos... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1736385%2C1810805%2C1846328%2C1856090%2C1858033%2C1858509%2C1862089%2C1862777%2C1864015 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 10.0EPSS: 0%CPEs: 6EXPL: 0CVE-2023-6863 – Mozilla: Undefined behavior in <code>ShutdownObserver()</code>
https://notcve.org/view.php?id=CVE-2023-6863
19 Dec 2023 — The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destructor. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. El `ShutdownObserver()` era susceptible a un comportamiento potencialmente indefinido debido a su dependencia de un tipo dinámico que carecía de un destructor virtual. Esta vulnerabilidad afecta a Firefox ESR <115.6, Thunderbird <115.6 y Firefox <121. The Mozilla Foun... • https://bugzilla.mozilla.org/show_bug.cgi?id=1868901 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 0%CPEs: 6EXPL: 0CVE-2023-6861 – Mozilla: Heap buffer overflow affected <code>nsWindow::PickerOpen(void)</code> in headless mode
https://notcve.org/view.php?id=CVE-2023-6861
19 Dec 2023 — The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. El método `nsWindow::PickerOpen(void)` era susceptible a un desbordamiento de búfer de almacenamiento dinámico cuando se ejecutaba en modo headless. Esta vulnerabilidad afecta a Firefox ESR <115.6, Thunderbird <115.6 y Firefox <121. The Mozilla Foundation Security Advisory describes this flaw as: The ... • https://bugzilla.mozilla.org/show_bug.cgi?id=1864118 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-6860 – Mozilla: Potential sandbox escape due to <code>VideoBridge</code> lack of texture validation
https://notcve.org/view.php?id=CVE-2023-6860
19 Dec 2023 — The `VideoBridge` allowed any content process to use textures produced by remote decoders. This could be abused to escape the sandbox. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. El "VideoBridge" permitía que cualquier proceso de contenido utilizara texturas producidas por decodificadores remotos. Se podría abusar de esto para escapar de la sandbox. • https://bugzilla.mozilla.org/show_bug.cgi?id=1854669 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 0%CPEs: 6EXPL: 0CVE-2023-6859 – Mozilla: Use-after-free in PR_GetIdentitiesLayer
https://notcve.org/view.php?id=CVE-2023-6859
19 Dec 2023 — A use-after-free condition affected TLS socket creation when under memory pressure. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. Una condición de use after free afectó la creación de sockets TLS cuando estaba bajo presión de memoria. Esta vulnerabilidad afecta a Firefox ESR <115.6, Thunderbird <115.6 y Firefox <121. The Mozilla Foundation Security Advisory describes this flaw as: A use-after-free condition affected TLS socket creation when under memory pre... • https://bugzilla.mozilla.org/show_bug.cgi?id=1840144 • CWE-416: Use After Free •