CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-12422 – Mozilla: Integer overflow in nsJPEGEncoder::emptyOutputBuffer
https://notcve.org/view.php?id=CVE-2020-12422
09 Jul 2020 — In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable to overflow, resulting in an out of bounds write, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 78. En configuraciones no estándar, una imagen JPEG creada por JavaScript podría haber causado un desbordamiento de una variable interna, resultando en una escritura fuera de límites, corrupción de la memoria y un bloqueo explotable potencialmente. Esta vulnerabi... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html • CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-12423
https://notcve.org/view.php?id=CVE-2020-12423
09 Jul 2020 — When the Windows DLL "webauthn.dll" was missing from the Operating System, and a malicious one was placed in a folder in the user's %PATH%, Firefox may have loaded the DLL, leading to arbitrary code execution. *Note: This issue only affects the Windows operating system; other operating systems are unaffected.* This vulnerability affects Firefox < 78. Cuando la DLL "webauthn.dll" de Windows estaba faltando desde el Sistema Operativo y se colocaba una maliciosa en una carpeta en la %PATH% de usuario, Firefox ... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html • CWE-427: Uncontrolled Search Path Element •
CVSS: 4.4EPSS: 0%CPEs: 5EXPL: 0CVE-2020-12402 – nss: Side channel vulnerabilities during RSA key generation
https://notcve.org/view.php?id=CVE-2020-12402
06 Jul 2020 — During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78. Durante la generac... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00016.html • CWE-203: Observable Discrepancy CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 9.3EPSS: 0%CPEs: 9EXPL: 1CVE-2020-12417 – Mozilla: Memory corruption due to missing sign-extension for ValueTags on ARM64
https://notcve.org/view.php?id=CVE-2020-12417
06 Jul 2020 — Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash. *Note: this issue only affects Firefox on ARM64 platforms.* This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Debido a una confusión acerca de ValueTags en objetos JavaScript, un objeto puede pasar a través de la barrera de tipo, resultando en una corrupción de la memoria y un bloqueo potencialmente exp... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-617: Reachable Assertion CWE-681: Incorrect Conversion between Numeric Types CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 1%CPEs: 9EXPL: 0CVE-2020-12418 – Mozilla: Information disclosure due to manipulated URL object
https://notcve.org/view.php?id=CVE-2020-12418
06 Jul 2020 — Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. La manipulación de partes individuales de un objeto URL podría haber causado una lectura fuera de límites, filtrando la memoria de proceso a un JavaScript malicioso. Esta vulnerabilidad afecta a Firefox ESR versiones anteriores a 68.10, Firefox versiones anteriores a 78 y Thunderbird ver... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html • CWE-125: Out-of-bounds Read CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-12415 – Gentoo Linux Security Advisory 202007-10
https://notcve.org/view.php?id=CVE-2020-12415
02 Jul 2020 — When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a subdirectory. This could cause the appcache to be used to service requests for the top level directory. This vulnerability affects Firefox < 78. Cuando "%2F" estaba presente en una URL de manifiesto, el comportamiento de AppCache de Firefox puede haber sido confundido y permitir que sea servido un manifiesto desde un subdirectorio. Esto podría hacer que el appcache sea us... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html • CWE-276: Incorrect Default Permissions •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12425 – Mozilla: Out of bound read in Date.parse()
https://notcve.org/view.php?id=CVE-2020-12425
02 Jul 2020 — Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have occurred, leading to potential information disclosure. This vulnerability affects Firefox < 78. Debido a una confusión al procesar un carácter hyph en la función Date.parse(), podría haber ocurrido una lectura fuera de límites de un byte, conllevando a una potencial divulgación de información. Esta vulnerabilidad afecta a Firefox versiones anteriores a 78 Multiple security issues were discovered in Firef... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-12424 – Mozilla: WebRTC permission prompt could have been bypassed by a compromised content process
https://notcve.org/view.php?id=CVE-2020-12424
02 Jul 2020 — When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin that was previously granted permission; bypassing the prompt. This vulnerability affects Firefox < 78. Cuando se construye un aviso de permiso para WebRTC, se suministraba un URI desde el proceso de contenido. Este URI no era confiable, y podría haber sido el URI de un origen que previamente se le concediera permiso; omitiendo el aviso. • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html • CWE-276: Incorrect Default Permissions CWE-451: User Interface (UI) Misrepresentation of Critical Information •
CVSS: 9.3EPSS: 0%CPEs: 9EXPL: 0CVE-2020-12419 – Mozilla: Use-after-free in nsGlobalWindowInner
https://notcve.org/view.php?id=CVE-2020-12419
02 Jul 2020 — When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Al procesar devoluciones de llamada que ocurrieron durante el vaciado de la ventana en el proceso principal, la ventana asociada puede terminar; causando una condición de uso de la memoria pre... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html • CWE-416: Use After Free •
CVSS: 9.3EPSS: 0%CPEs: 9EXPL: 1CVE-2020-12420 – Mozilla: Use-After-Free when trying to connect to a STUN server
https://notcve.org/view.php?id=CVE-2020-12420
02 Jul 2020 — When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Al intentar conectarse a un servidor STUN, una condición de carrera podría haber causado un uso de la memoria previamente liberada de un puntero, conllevando a una corrupción de la memoria y un bloqueo potencialmente explotable. Esta vulnerabilidad a... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •