CVSS: 9.8EPSS: 22%CPEs: 18EXPL: 0CVE-2018-5097 – Mozilla: Use-after-free when source document is manipulated during XSLT (MFSA 2018-03)
https://notcve.org/view.php?id=CVE-2018-5097
24 Jan 2018 — A use-after-free vulnerability can occur during XSL transformations when the source document for the transformation is manipulated by script content during the transformation. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58. Puede ocurrir una vulnerabilidad de uso de memoria previamente liberada durante las transformaciones XSL cuando el documento de origen para la transformación se manipula con scripts durante la transform... • http://www.securityfocus.com/bid/102783 • CWE-416: Use After Free •
CVSS: 7.5EPSS: 1%CPEs: 14EXPL: 1CVE-2017-7843 – Mozilla: Web worker in Private Browsing mode can write IndexedDB data
https://notcve.org/view.php?id=CVE-2017-7843
04 Dec 2017 — When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1. Cuando se utiliza el modo Navegación Privada, es posible que un trabajador web escriba datos persistentes en IndexedDB y re... • http://www.securityfocus.com/bid/102039 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer •
CVSS: 9.8EPSS: 34%CPEs: 15EXPL: 0CVE-2017-7828 – Mozilla: Use-after-free of PressShell while restyling layout (MFSA 2017-25)
https://notcve.org/view.php?id=CVE-2017-7828
16 Nov 2017 — A use-after-free vulnerability can occur when flushing and resizing layout because the "PressShell" object has been freed while still in use. This results in a potentially exploitable crash during these operations. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5. Puede ocurrir una vulnerabilidad de uso de memoria previamente liberada cuando se alinea y redimensiona la disposición porque el objeto "PressShell'" se ha liberado cuando se estaba utilizando. Esto resulta en un... • http://www.securityfocus.com/bid/101832 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 15EXPL: 0CVE-2017-7830 – Mozilla: Cross-origin URL information leak through Resource Timing API (MFSA 2017-25)
https://notcve.org/view.php?id=CVE-2017-7830
16 Nov 2017 — The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5. La API Resource Timing revelaba incorrectamente las navegaciones en iframes cross-origin. Esta es una violación de la política same-origin y podría permitir el robo de datos de URL cargadas por los usuarios. • http://www.securityfocus.com/bid/101832 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 2%CPEs: 17EXPL: 0CVE-2017-7826 – Mozilla: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5 (MFSA 2017-25)
https://notcve.org/view.php?id=CVE-2017-7826
16 Nov 2017 — Memory safety bugs were reported in Firefox 56 and Firefox ESR 52.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5. Se han informado de errores de seguridad de memoria en Firefox 56 y Firefox ESR 52.4. Algunos de estos errores mostraron evidencias de corrupción de memoria y se cree que, con el esfuerzo necesario, se ... • http://www.securityfocus.com/bid/101832 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.8EPSS: 9%CPEs: 16EXPL: 1CVE-2017-7818 – Mozilla: Use-after-free during ARIA array manipulation (MFSA 2017-22)
https://notcve.org/view.php?id=CVE-2017-7818
29 Sep 2017 — A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications (ARIA) elements within containers through the DOM. This results in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4. Puede ocurrir una vulnerabilidad de uso de memoria previamente liberada cuando se manipulan arrays de elementos ARIA (Accesible Rich Internet Applications) en los contenedores mediante el DOM. Esto resulta en un cierre i... • http://www.securityfocus.com/bid/101055 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 15EXPL: 0CVE-2017-7814 – Mozilla: Blob and data URLs bypass phishing and malware protection warnings (MFSA 2017-22)
https://notcve.org/view.php?id=CVE-2017-7814
29 Sep 2017 — File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. This would allow malicious sites to lure users into downloading executables that would otherwise be detected as suspicious. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4. Las descargas de archivos codificados con elementos URL "blob:" y "data:" omitían las comprobaciones de... • http://www.securityfocus.com/bid/101059 • CWE-20: Improper Input Validation CWE-494: Download of Code Without Integrity Check •
CVSS: 6.1EPSS: 1%CPEs: 15EXPL: 1CVE-2017-7823 – Mozilla: CSP sandbox directive did not create a unique origin (MFSA 2017-22)
https://notcve.org/view.php?id=CVE-2017-7823
29 Sep 2017 — The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to behave as if the "allow-same-origin" keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4. La directiva CSP (Content Security Policy) "sandbox" no creaba un origen único para el documento, provocando que se comporte como si estuviera siempre es... • http://www.securityfocus.com/bid/101059 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 15%CPEs: 15EXPL: 0CVE-2017-7824 – Mozilla: Buffer overflow when drawing and validating elements with ANGLE (MFSA 2017-22)
https://notcve.org/view.php?id=CVE-2017-7824
29 Sep 2017 — A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content. This is due to an incorrect value being passed within the library during checks and results in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4. Ocurre un desbordamiento de búfer cuando se dibujan y validan elementos con la librería de gráficos ANGLE, utilizado para contenidos WebGL. Esto se debe a que se pasa un valor inco... • http://www.securityfocus.com/bid/101053 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.5EPSS: 4%CPEs: 6EXPL: 0CVE-2017-7805 – nss: Potential use-after-free in TLS 1.2 server when verifying client authentication
https://notcve.org/view.php?id=CVE-2017-7805
29 Sep 2017 — During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases, the handshake transcript can exceed the space available in the current buffer, causing the allocation of a new buffer. This leaves a pointer pointing to the old, freed buffer, resulting in a use-after-free when handshake hashes are then calculated afterwards. This can result in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox... • http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html • CWE-416: Use After Free •