CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2022-38477 – Mozilla: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
https://notcve.org/view.php?id=CVE-2022-38477
25 Aug 2022 — Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103 and Firefox ESR 102.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.2, Thunderbird < 102.2, and Firefox < 104. La desarrolladora de Mozilla, Nika Layzell, y el equipo Mozilla Fuzzing informaron errores de seguridad de la memoria presentes en F... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1760611%2C1770219%2C1771159%2C1773363 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 0CVE-2022-38478 – Mozilla: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and Firefox ESR 91.13
https://notcve.org/view.php?id=CVE-2022-38478
25 Aug 2022 — Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102.1, and Firefox ESR 91.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104. Los miembros del equipo Mozilla Fuzzing informaron errores de seguridad de la memoria presentes e... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1770630%2C1776658 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-26382 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-26382
10 Aug 2022 — While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fonts. Side-channel attacks on the text by using specially crafted fonts could have lead to this text being inferred by the webpage. This vulnerability affects Firefox < 98. Si bien JavaScript no puede leer directamente el texto que se muestra en la información sobre herramientas de Autocompletar, el texto se representó utilizando fuentes de página. Los ataques de canal lateral al texto medi... • https://bugzilla.mozilla.org/show_bug.cgi?id=1741888 • CWE-203: Observable Discrepancy •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-26385 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-26385
10 Aug 2022 — In unusual circumstances, an individual thread may outlive the thread's manager during shutdown. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 98. En circunstancias inusuales, un subproceso individual puede sobrevivir al administrador del subproceso durante el cierre. Esto podría haber llevado a un use-after-free que provocó un bloqueo potencialmente explotable. • https://bugzilla.mozilla.org/show_bug.cgi?id=1747526 • CWE-416: Use After Free •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 1CVE-2021-4129 – Mozilla: Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4
https://notcve.org/view.php?id=CVE-2021-4129
10 Aug 2022 — Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported memory safety bugs present in Firefox 94. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 95, Firefox ESR < 91.4.0, and Thunderbird < 91.4.0. Los desarrolladores de Mozilla y miembros de la comunidad Julian Hector, Ra... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1393362%2C1736046%2C1736751%2C1737009%2C1739372%2C1739421 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2022-29910 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-29910
10 Aug 2022 — When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings.<br>*Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 100. Cuando se cerraba o se enviaba a segundo plano, Firefox para Android no registraba ni conservaba correctamente la configuración HSTS. • https://bugzilla.mozilla.org/show_bug.cgi?id=1757138 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29918 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-29918
10 Aug 2022 — Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 100. Los desarrolladores de Mozilla Gabriele Svelto, Randell Jesup y Mozilla Fuzzing Team informaron sobre errores de seguridad de la memoria presentes en Firefox 99. Algunos de estos err... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1744043%2C1747178%2C1753535%2C1754017%2C1755847%2C1756172%2C1757477%2C1758223%2C1760160%2C1761481%2C1761771 • CWE-787: Out-of-bounds Write •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36315 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-36315
10 Aug 2022 — When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata. This vulnerability affects Firefox < 103. Al cargar un script con Subresource Integrity, los atacantes con capacidad de inyección podrían desencadenar la reutilización de entradas previamente almacenadas en caché con metadatos de integridad incorrectos y diferentes. Esta vulnerabilidad afecta a Firefox < 103. Multiple v... • https://bugzilla.mozilla.org/show_bug.cgi?id=1762520 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36316 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-36316
10 Aug 2022 — When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus learn whether the target URL had been subject to a redirect. This vulnerability affects Firefox < 103. Al utilizar la API Performance, un atacante pudo notar diferencias sutiles entre PerformanceEntries y así saber si la URL de destino había sido objeto de una redirección. Esta vulnerabilidad afecta a Firefox < 103. Multiple vulnerabilities have been found in Mozilla Firefox, the worst of... • https://bugzilla.mozilla.org/show_bug.cgi?id=1768583 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36320 – Gentoo Linux Security Advisory 202208-08
https://notcve.org/view.php?id=CVE-2022-36320
10 Aug 2022 — Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 103. Los desarrolladores de Mozilla y el equipo Mozilla Fuzzing informaron errores de seguridad de la memoria presentes en Firefox 102. Algunos de estos errores mostraron evidencia de corrupción de la memoria y supone... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1759794%2C1760998 • CWE-787: Out-of-bounds Write •