CVSS: 3.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24000 – Ubuntu Security Notice USN-4926-1
https://notcve.org/view.php?id=CVE-2021-24000
27 Apr 2021 — A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they were on a separate tab. In conjunction with certain elements (such as <input type="file">) this could have led to an attack where a user was confused about the origin of the webpage and potentially disclosed information they did not intend to. This vulnerability affects Firefox < 88. Una condición de carrera con las funciones requestPointerLock() y setTimeout() pod... • https://bugzilla.mozilla.org/show_bug.cgi?id=1694698 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24001 – Ubuntu Security Notice USN-4926-1
https://notcve.org/view.php?id=CVE-2021-24001
27 Apr 2021 — A compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructure that was not restricted to testing-only configurations. This vulnerability affects Firefox < 88. Un proceso de contenido comprometido podría haber llevado a cabo manipulaciones del historial de sesiones que no debería haber podido debido a la infraestructura de pruebas que no estaba restringida a las configuraciones de solo prueba. Esta vulnerabilidad afecta a Firefo... • https://bugzilla.mozilla.org/show_bug.cgi?id=1694727 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-29946 – Mozilla: Port blocking could be bypassed
https://notcve.org/view.php?id=CVE-2021-29946
26 Apr 2021 — Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. Los puertos que se escribieron como un desbordamiento de enteros por encima de los límites de un entero de 16 bits podrían haber omitido las restricciones de bloqueo de puertos cuando se usaron en la cabecera Alt-Svc. Esta vulnerabilidad afecta a Firefox ESR ve... • https://bugzilla.mozilla.org/show_bug.cgi?id=1698503 • CWE-190: Integer Overflow or Wraparound •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-23995 – Mozilla: Use-after-free in Responsive Design Mode
https://notcve.org/view.php?id=CVE-2021-23995
26 Apr 2021 — When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. Cuando se habilitó el Modo de Diseño Responsivo, se usaron referencias a objetos que fueron liberados previamente. Presumimos que con suficiente esfuerzo esto podría haber sido explotado para ejecutar código arbitrario. • https://bugzilla.mozilla.org/show_bug.cgi?id=1699835 • CWE-416: Use After Free CWE-672: Operation on a Resource after Expiration or Release •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 1CVE-2021-23999 – Mozilla: Blob URLs may have been granted additional privileges
https://notcve.org/view.php?id=CVE-2021-23999
26 Apr 2021 — If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. Si una URL Blob se cargó mediante alguna interacción inusual del usuario, podría haber sido cargada por el Principal del Sistema y conceder privilegios adicionales que no deberían concederse al contenido web. Esta vulnerabilidad afect... • https://bugzilla.mozilla.org/show_bug.cgi?id=1691153 • CWE-269: Improper Privilege Management CWE-281: Improper Preservation of Permissions CWE-697: Incorrect Comparison •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-23998 – Mozilla: Secure Lock icon could have been spoofed
https://notcve.org/view.php?id=CVE-2021-23998
26 Apr 2021 — Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. Mediante navegaciones complicadas con nuevas ventanas, una página HTTP podría haber heredado un icono de bloqueo seguro de una página HTTPS. Esta vulnerabilidad afecta a Firefox ESR versiones anteriores a 78.10, Thunderbird versiones anteriores a 78.10 y Firefox versiones anteriores a 88 Multiple secu... • https://bugzilla.mozilla.org/show_bug.cgi?id=1667456 • CWE-281: Improper Preservation of Permissions CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-24002 – Mozilla: Arbitrary FTP command execution on FTP servers using an encoded URL
https://notcve.org/view.php?id=CVE-2021-24002
26 Apr 2021 — When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and allowed arbitrary commands to be sent to the FTP server. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. Cuando un usuario hacía clic en una URL de FTP conteniendo caracteres de nueva línea codificados (%0A y %0D), las nuevas líneas se interpretaban como tales y permitían que comandos arbitrarios fueran enviados al servidor FTP. Es... • https://bugzilla.mozilla.org/show_bug.cgi?id=1702374 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-29945 – Mozilla: Incorrect size computation in WebAssembly JIT could lead to null-reads
https://notcve.org/view.php?id=CVE-2021-29945
26 Apr 2021 — The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash. *Note: This issue only affected x86-32 platforms. Other platforms are unaffected.*. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. El JIT de WebAssembly podía calcular mal el tamaño de un tipo de retorno, lo que podía conllevar a una lectura nula y resultar en un bloqueo. • https://bugzilla.mozilla.org/show_bug.cgi?id=1700690 • CWE-476: NULL Pointer Dereference CWE-682: Incorrect Calculation •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-23994 – Mozilla: Out of bound write due to lazy initialization
https://notcve.org/view.php?id=CVE-2021-23994
26 Apr 2021 — A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. Un framebuffer de WebGL no se inicializaba con suficiente antelación, resultando en una corrupción de memoria y una escritura fuera de límites. Esta vulnerabilidad afecta a Firefox ESR versiones anteriores a 78.10, Thunderbird versiones anteriores a 78.10 y Firefox versiones anteriores a 88 USN-4995-1 fixed vuln... • https://bugzilla.mozilla.org/show_bug.cgi?id=1699077 • CWE-787: Out-of-bounds Write CWE-909: Missing Initialization of Resource •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-23988 – Gentoo Linux Security Advisory 202104-10
https://notcve.org/view.php?id=CVE-2021-23988
31 Mar 2021 — Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 87. Los desarrolladores de Mozilla, reportaron bugs de seguridad de la memoria presentes en Firefox versión 86. Algunos de estos bugs mostraron evidencia de corrupción de la memoria y suponemos que con suficiente esfuerzo algunos de ellos podrían ... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1684994%2C1686653 • CWE-787: Out-of-bounds Write •