CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-15654 – Mozilla: Custom cursor can overlay user interface
https://notcve.org/view.php?id=CVE-2020-15654
30 Jul 2020 — When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1. Cuando en un bucle infinito, un sitio web que especifica un cursor personalizado usando CSS podría hacer que parezca que el usuario e... • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html • CWE-451: User Interface (UI) Misrepresentation of Critical Information CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-15653 – Mozilla: Bypassing iframe sandbox when allowing popups
https://notcve.org/view.php?id=CVE-2020-15653
30 Jul 2020 — An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1. Un elemento del sandbox de iframe con el flag allow-popups podría ser omitida cuando se usan enlaces noopener. Esto podría haber conllevado a problemas de seguridad para los sitios web que depe... • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html • CWE-276: Incorrect Default Permissions •
CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0CVE-2020-15652 – Mozilla: Potential leak of redirect targets when loading scripts in a worker
https://notcve.org/view.php?id=CVE-2020-15652
28 Jul 2020 — By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1. Al observar el seguimiento de la pila de errores de JavaScript en los trabajadores web, fue posible filtrar el resultado de un redireccionamiento de origen cruzado. Esto se aplica solo al contenid... • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00022.html • CWE-209: Generation of Error Message Containing Sensitive Information CWE-346: Origin Validation Error •
CVSS: 9.3EPSS: 1%CPEs: 10EXPL: 0CVE-2020-15659 – Mozilla: Memory safety bugs fixed in Firefox 79 and Firefox ESR 68.11
https://notcve.org/view.php?id=CVE-2020-15659
28 Jul 2020 — Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1. Los desarrolladores de Mozilla y los miembros de la comunidad informaron bugs de seguridad de la memoria presentes... • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00022.html • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 1%CPEs: 9EXPL: 0CVE-2020-12418 – Mozilla: Information disclosure due to manipulated URL object
https://notcve.org/view.php?id=CVE-2020-12418
06 Jul 2020 — Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. La manipulación de partes individuales de un objeto URL podría haber causado una lectura fuera de límites, filtrando la memoria de proceso a un JavaScript malicioso. Esta vulnerabilidad afecta a Firefox ESR versiones anteriores a 68.10, Firefox versiones anteriores a 78 y Thunderbird ver... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html • CWE-125: Out-of-bounds Read CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 0%CPEs: 9EXPL: 1CVE-2020-12417 – Mozilla: Memory corruption due to missing sign-extension for ValueTags on ARM64
https://notcve.org/view.php?id=CVE-2020-12417
06 Jul 2020 — Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash. *Note: this issue only affects Firefox on ARM64 platforms.* This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Debido a una confusión acerca de ValueTags en objetos JavaScript, un objeto puede pasar a través de la barrera de tipo, resultando en una corrupción de la memoria y un bloqueo potencialmente exp... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-617: Reachable Assertion CWE-681: Incorrect Conversion between Numeric Types CWE-787: Out-of-bounds Write •
CVSS: 9.3EPSS: 0%CPEs: 9EXPL: 0CVE-2020-12419 – Mozilla: Use-after-free in nsGlobalWindowInner
https://notcve.org/view.php?id=CVE-2020-12419
02 Jul 2020 — When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Al procesar devoluciones de llamada que ocurrieron durante el vaciado de la ventana en el proceso principal, la ventana asociada puede terminar; causando una condición de uso de la memoria pre... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2020-12421 – Mozilla: Add-On updates did not respect the same certificate trust rules as software updates
https://notcve.org/view.php?id=CVE-2020-12421
02 Jul 2020 — When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have caused add-ons to become out-of-date silently without notification to the user. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Cuando se llevan a cabo actualizaciones de add-on, las cadenas de certificados que terminan en non-built-in-roots fueron rechazadas (incluso si fueron agregadas legítim... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html • CWE-295: Improper Certificate Validation CWE-296: Improper Following of a Certificate's Chain of Trust •
CVSS: 9.3EPSS: 0%CPEs: 9EXPL: 1CVE-2020-12420 – Mozilla: Use-After-Free when trying to connect to a STUN server
https://notcve.org/view.php?id=CVE-2020-12420
02 Jul 2020 — When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Al intentar conectarse a un servidor STUN, una condición de carrera podría haber causado un uso de la memoria previamente liberada de un puntero, conllevando a una corrupción de la memoria y un bloqueo potencialmente explotable. Esta vulnerabilidad a... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2020-12398 – Mozilla: Security downgrade with IMAP STARTTLS leads to information leakage
https://notcve.org/view.php?id=CVE-2020-12398
16 Jun 2020 — If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection. This vulnerability affects Thunderbird < 68.9.0. Si Thunderbird está configurado para usar STARTTLS para un servidor IMAP, y el servidor envía una respuesta PREAUTH, entonces Thunderbird continuará con una conexión sin cifrar, causando que unos datos de correo electrónico sean enviados sin pr... • https://bugzilla.mozilla.org/show_bug.cgi?id=1613623 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-319: Cleartext Transmission of Sensitive Information •