CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2021-23978 – Mozilla: Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
https://notcve.org/view.php?id=CVE-2021-23978
Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. Los desarrolladores de Mozilla reportaron bugs de seguridad de la memoria presentes en Firefox versión 85 y Firefox ESR versión 78.7. Algunos de estos bugs mostraron evidencia de corrupción de la memoria y suponemos que con esfuerzo suficiente algunos de ellos podrían haber sido explotado para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=786797%2C1682928%2C1687391%2C1687597 https://lists.debian.org/debian-lts-announce/2021/03/msg00000.html https://security.gentoo.org/glsa/202104-09 https://security.gentoo.org/glsa/202104-10 https://www.debian.org/security/2021/dsa-4866 https://www.mozilla.org/security/advisories/mfsa2021-07 https://www.mozilla.org/security/advisories/mfsa2021-08 https://www.mozilla.org/security/advisories/mfsa2021-09 https://access.redhat.com/security/cve& • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2021-23973 – Mozilla: MediaError message property could have leaked information about cross-origin resources
https://notcve.org/view.php?id=CVE-2021-23973
When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed information about the resource. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. Cuando se intenta cargar un recurso de origen cruzado en un contexto de audio y video, puede haber resultado un error de decodificación, y el contenido de ese error puede haber divulgado información sobre el recurso. Esta vulnerabilidad afecta a Firefox versiones anteriores a 86, Thunderbird versiones anteriores a 78,8 y Firefox ESR versiones anteriores a 78,8 • https://bugzilla.mozilla.org/show_bug.cgi?id=1690976 https://lists.debian.org/debian-lts-announce/2021/03/msg00000.html https://security.gentoo.org/glsa/202104-09 https://security.gentoo.org/glsa/202104-10 https://www.debian.org/security/2021/dsa-4866 https://www.mozilla.org/security/advisories/mfsa2021-07 https://www.mozilla.org/security/advisories/mfsa2021-08 https://www.mozilla.org/security/advisories/mfsa2021-09 https://access.redhat.com/security/cve/CVE-2021-23973 https:&# • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-23960 – Mozilla: Use-after-poison for incorrectly redeclared JavaScript variables during GC
https://notcve.org/view.php?id=CVE-2021-23960
Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. Realizar una recolección de basura en variables de JavaScript declaradas nuevamente resultó en un usuario después del envenenamiento y un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Firefox versiones anteriores a 85, Thunderbird versiones anteriores a 78,7 y Firefox ESR versiones anteriores a 78,7 The Mozilla Foundation Security Advisory describes this flaw as: Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. • https://bugzilla.mozilla.org/show_bug.cgi?id=1675755 https://www.mozilla.org/security/advisories/mfsa2021-03 https://www.mozilla.org/security/advisories/mfsa2021-04 https://www.mozilla.org/security/advisories/mfsa2021-05 https://access.redhat.com/security/cve/CVE-2021-23960 https://bugzilla.redhat.com/show_bug.cgi?id=1920650 • CWE-626: Null Byte Interaction Error (Poison Null Byte) •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-23964 – Mozilla: Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7
https://notcve.org/view.php?id=CVE-2021-23964
Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. Los desarrolladores de Mozilla reportaron bugs de seguridad de la memoria presentes en Firefox versión 84 y Firefox ESR versión 78.6. Algunos de estos bugs mostraron evidencia de corrupción de la memoria y suponemos que con esfuerzo suficiente algunos de ellos podrían haber sido explotado para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662507%2C1666285%2C1673526%2C1674278%2C1674835%2C1675097%2C1675844%2C1675868%2C1677590%2C1677888%2C1680410%2C1681268%2C1682068%2C1682938%2C1683736%2C1685260%2C1685925 https://www.mozilla.org/security/advisories/mfsa2021-03 https://www.mozilla.org/security/advisories/mfsa2021-04 https://www.mozilla.org/security/advisories/mfsa2021-05 https://access.redhat.com/security/cve/CVE-2021-23964 https://bugzilla.redhat.com/show_bug.cgi?id=1920651 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-23953 – Mozilla: Cross-origin information leakage via redirected PDF requests
https://notcve.org/view.php?id=CVE-2021-23953
If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. Si un usuario hace clic en un PDF diseñado específicamente, el lector de PDF podría confundirse y filtrar información de origen cruzado, cuando dicha información es servida como datos fragmentados. Esta vulnerabilidad afecta a Firefox versiones anteriores a 85, Thunderbird versiones anteriores a 78,7 y Firefox ESR versiones anteriores a 78,7 The Mozilla Foundation Security Advisory describes this flaw as: If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data. • https://bugzilla.mozilla.org/show_bug.cgi?id=1683940 https://www.mozilla.org/security/advisories/mfsa2021-03 https://www.mozilla.org/security/advisories/mfsa2021-04 https://www.mozilla.org/security/advisories/mfsa2021-05 https://access.redhat.com/security/cve/CVE-2021-23953 https://bugzilla.redhat.com/show_bug.cgi?id=1920646 • CWE-829: Inclusion of Functionality from Untrusted Control Sphere •