CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2020-15657
https://notcve.org/view.php?id=CVE-2020-15657
10 Aug 2020 — Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker that is already capable of placing files in the installation directory. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1. • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html • CWE-427: Uncontrolled Search Path Element •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2020-15655 – Ubuntu Security Notice USN-4443-1
https://notcve.org/view.php?id=CVE-2020-15655
30 Jul 2020 — A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential disclosure of cross-origin information. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1. Una petición HTTP redireccionada que es observada o modificada por medio de una extensión web podría omitir las comprobaciones de CORS existentes, conllevando a una potencial divulgación de información de origen cruzado. Esta vulnerabilidad afecta a F... • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html •
CVSS: 9.3EPSS: 0%CPEs: 7EXPL: 0CVE-2020-15656 – Mozilla: Type confusion for special arguments in IonMonkey
https://notcve.org/view.php?id=CVE-2020-15656
30 Jul 2020 — JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the code, resulting in this bug rated at only moderate severity. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1. Las optimizaciones JIT que involucran el objeto de argumentos de Javascript podrían confundir optimizaciones posteriores. Este riesgo ya fue mitigado por varias precauciones en el código, resultando en este er... • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-15654 – Mozilla: Custom cursor can overlay user interface
https://notcve.org/view.php?id=CVE-2020-15654
30 Jul 2020 — When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1. Cuando en un bucle infinito, un sitio web que especifica un cursor personalizado usando CSS podría hacer que parezca que el usuario e... • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html • CWE-451: User Interface (UI) Misrepresentation of Critical Information CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-15653 – Mozilla: Bypassing iframe sandbox when allowing popups
https://notcve.org/view.php?id=CVE-2020-15653
30 Jul 2020 — An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1. Un elemento del sandbox de iframe con el flag allow-popups podría ser omitida cuando se usan enlaces noopener. Esto podría haber conllevado a problemas de seguridad para los sitios web que depe... • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html • CWE-276: Incorrect Default Permissions •
CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0CVE-2020-15652 – Mozilla: Potential leak of redirect targets when loading scripts in a worker
https://notcve.org/view.php?id=CVE-2020-15652
28 Jul 2020 — By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1. Al observar el seguimiento de la pila de errores de JavaScript en los trabajadores web, fue posible filtrar el resultado de un redireccionamiento de origen cruzado. Esto se aplica solo al contenid... • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00022.html • CWE-209: Generation of Error Message Containing Sensitive Information CWE-346: Origin Validation Error •
CVSS: 9.3EPSS: 1%CPEs: 10EXPL: 0CVE-2020-15659 – Mozilla: Memory safety bugs fixed in Firefox 79 and Firefox ESR 68.11
https://notcve.org/view.php?id=CVE-2020-15659
28 Jul 2020 — Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1. Los desarrolladores de Mozilla y los miembros de la comunidad informaron bugs de seguridad de la memoria presentes... • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00022.html • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 1%CPEs: 9EXPL: 0CVE-2020-12418 – Mozilla: Information disclosure due to manipulated URL object
https://notcve.org/view.php?id=CVE-2020-12418
06 Jul 2020 — Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. La manipulación de partes individuales de un objeto URL podría haber causado una lectura fuera de límites, filtrando la memoria de proceso a un JavaScript malicioso. Esta vulnerabilidad afecta a Firefox ESR versiones anteriores a 68.10, Firefox versiones anteriores a 78 y Thunderbird ver... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html • CWE-125: Out-of-bounds Read CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 0%CPEs: 9EXPL: 1CVE-2020-12417 – Mozilla: Memory corruption due to missing sign-extension for ValueTags on ARM64
https://notcve.org/view.php?id=CVE-2020-12417
06 Jul 2020 — Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash. *Note: this issue only affects Firefox on ARM64 platforms.* This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Debido a una confusión acerca de ValueTags en objetos JavaScript, un objeto puede pasar a través de la barrera de tipo, resultando en una corrupción de la memoria y un bloqueo potencialmente exp... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-617: Reachable Assertion CWE-681: Incorrect Conversion between Numeric Types CWE-787: Out-of-bounds Write •
CVSS: 9.3EPSS: 0%CPEs: 9EXPL: 0CVE-2020-12419 – Mozilla: Use-after-free in nsGlobalWindowInner
https://notcve.org/view.php?id=CVE-2020-12419
02 Jul 2020 — When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Al procesar devoluciones de llamada que ocurrieron durante el vaciado de la ventana en el proceso principal, la ventana asociada puede terminar; causando una condición de uso de la memoria pre... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html • CWE-416: Use After Free •