CVSS: 6.1EPSS: 0%CPEs: 21EXPL: 0CVE-2017-5383 – Mozilla: Location bar spoofing with unicode characters (MFSA 2017-02)
https://notcve.org/view.php?id=CVE-2017-5383
URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Las URL que contienen ciertos glifos unicode para guiones y comillas alternativas no desencadenan correctamente la visualización de punycode, lo que permite ataques de suplantación de nombre de dominio en la barra de direcciones. La vulnerabilidad afecta a Thunderbird en versiones anteriores a la 45.7, Firefox ESR en versiones anteriores a la 45.7 y Firefox en versiones anteriores a la 51. • http://rhn.redhat.com/errata/RHSA-2017-0190.html http://rhn.redhat.com/errata/RHSA-2017-0238.html http://www.securityfocus.com/bid/95769 http://www.securitytracker.com/id/1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1323338 https://bugzilla.mozilla.org/show_bug.cgi?id=1324716 https://security.gentoo.org/glsa/201702-13 https://security.gentoo.org/glsa/201702-22 https://www.debian.org/security/2017/dsa-3771 https://www.debian.org/security/2017/dsa-3832 https • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 21EXPL: 0CVE-2017-5390 – Mozilla: Insecure communication methods in Developer Tools JSON viewer (MFSA 2017-02)
https://notcve.org/view.php?id=CVE-2017-5390
The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing JSON or HTTP headers data, allowing for potential privilege escalation. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. El visor JSON en Developer Tools emplea métodos inseguros para crear un canal de comunicación para copiar y visualizar datos de cabeceras HTTP o JSON, lo que permite un potencial escalado de privilegios. La vulnerabilidad afecta a Thunderbird en versiones anteriores a la 45.7, Firefox ESR en versiones anteriores a la 45.7 y Firefox en versiones anteriores a la 51. • http://rhn.redhat.com/errata/RHSA-2017-0190.html http://rhn.redhat.com/errata/RHSA-2017-0238.html http://www.securityfocus.com/bid/95769 http://www.securitytracker.com/id/1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1297361 https://security.gentoo.org/glsa/201702-13 https://security.gentoo.org/glsa/201702-22 https://www.debian.org/security/2017/dsa-3771 https://www.debian.org/security/2017/dsa-3832 https://www.mozilla.org/security/advisories/mfsa2017-01 http •
CVSS: 9.8EPSS: 0%CPEs: 21EXPL: 0CVE-2017-5380 – Mozilla: Potential use-after-free during DOM manipulations (MFSA 2017-02)
https://notcve.org/view.php?id=CVE-2017-5380
A potential use-after-free found through fuzzing during DOM manipulation of SVG content. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Se ha encontrado un potencial uso de memoria previamente liberada mediante fuzzing durante la manipulación DOM del contenido SVG. La vulnerabilidad afecta a Thunderbird en versiones anteriores a la 45.7, Firefox ESR en versiones anteriores a la 45.7 y Firefox en versiones anteriores a la 51. • http://rhn.redhat.com/errata/RHSA-2017-0190.html http://rhn.redhat.com/errata/RHSA-2017-0238.html http://www.securityfocus.com/bid/95769 http://www.securitytracker.com/id/1037693 https://bugzilla.mozilla.org/show_bug.cgi?id=1322107 https://security.gentoo.org/glsa/201702-13 https://security.gentoo.org/glsa/201702-22 https://www.debian.org/security/2017/dsa-3771 https://www.debian.org/security/2017/dsa-3832 https://www.mozilla.org/security/advisories/mfsa2017-01 http • CWE-416: Use After Free •
CVSS: 8.8EPSS: 2%CPEs: 14EXPL: 0CVE-2017-5208 – icoutils: Check_offset overflow on 64-bit systems
https://notcve.org/view.php?id=CVE-2017-5208
Integer overflow in the wrestool program in icoutils before 0.31.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted executable, which triggers a denial of service (application crash) or the possibility of execution of arbitrary code. Un desbordamiento de números enteros en el programa wrestool en icoutils en versiones anteriores a la 0.31.1 permite que atacantes remotos provoquen una denegación de servicio (corrupción de memoria) mediante un ejecutable manipulado. Esto desencadena una denegación de servicio (bloqueo de aplicación) o la posibilidad de ejecución de código arbitrario. A vulnerability was found in icoutils, in the wrestool program. An attacker could create a crafted executable that, when read by wrestool, could result in memory corruption leading to a crash or potential code execution. • http://rhn.redhat.com/errata/RHSA-2017-0837.html http://www.debian.org/security/2017/dsa-3756 http://www.openwall.com/lists/oss-security/2017/01/08/5 http://www.securityfocus.com/bid/95315 https://bugzilla.redhat.com/show_bug.cgi?id=1411251 https://security.gentoo.org/glsa/201801-12 https://access.redhat.com/security/cve/CVE-2017-5208 • CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound •
CVSS: 8.1EPSS: 0%CPEs: 23EXPL: 0CVE-2017-5333 – icoutils: Integer overflow vulnerability in extract.c
https://notcve.org/view.php?id=CVE-2017-5333
Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) or execute arbitrary code via a crafted executable file. Un desbordamiento de enteros en la función extract_group_icon_cursor_resource en el archivo b/wrestool/extract.c en icoutils versiones anteriores a la versión 0.31.1, permite a usuarios locales causar una denegación de servicio (bloqueo del proceso) o ejecutar código arbitrario mediante un archivo ejecutable diseñado. A vulnerability was found in icoutils, in the wrestool program. An attacker could create a crafted executable that, when read by wrestool, could result in memory corruption leading to a crash or potential code execution. • http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00024.html http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00025.html http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00026.html http://rhn.redhat.com/errata/RHSA-2017-0837.html http://www.debian.org/security/2017/dsa-3765 http://www.openwall.com/lists/oss-security/2017/01/11/3 http://www.securityfocus.com/bid/95678 http://www.ubuntu.com/usn/USN-3178-1 https://bugzilla.redhat. • CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound •