CVSS: 9.3EPSS: 0%CPEs: 9EXPL: 0CVE-2020-12419 – Mozilla: Use-after-free in nsGlobalWindowInner
https://notcve.org/view.php?id=CVE-2020-12419
02 Jul 2020 — When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Al procesar devoluciones de llamada que ocurrieron durante el vaciado de la ventana en el proceso principal, la ventana asociada puede terminar; causando una condición de uso de la memoria pre... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-12424 – Mozilla: WebRTC permission prompt could have been bypassed by a compromised content process
https://notcve.org/view.php?id=CVE-2020-12424
02 Jul 2020 — When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin that was previously granted permission; bypassing the prompt. This vulnerability affects Firefox < 78. Cuando se construye un aviso de permiso para WebRTC, se suministraba un URI desde el proceso de contenido. Este URI no era confiable, y podría haber sido el URI de un origen que previamente se le concediera permiso; omitiendo el aviso. • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html • CWE-276: Incorrect Default Permissions CWE-451: User Interface (UI) Misrepresentation of Critical Information •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12425 – Mozilla: Out of bound read in Date.parse()
https://notcve.org/view.php?id=CVE-2020-12425
02 Jul 2020 — Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have occurred, leading to potential information disclosure. This vulnerability affects Firefox < 78. Debido a una confusión al procesar un carácter hyph en la función Date.parse(), podría haber ocurrido una lectura fuera de límites de un byte, conllevando a una potencial divulgación de información. Esta vulnerabilidad afecta a Firefox versiones anteriores a 78 An update that fixes 13 vulnerabilities is now av... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html • CWE-125: Out-of-bounds Read •
CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 1CVE-2020-12426 – Gentoo Linux Security Advisory 202007-10
https://notcve.org/view.php?id=CVE-2020-12426
02 Jul 2020 — Mozilla developers and community members reported memory safety bugs present in Firefox 77. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 78. Los desarrolladores de Mozilla y los miembros de la comunidad reportaron bugs de seguridad de la memoria presentes en Firefox versión 77. Algunos de estos errores mostraron evidencia de corrupción de la memoria y presumim... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2020-12421 – Mozilla: Add-On updates did not respect the same certificate trust rules as software updates
https://notcve.org/view.php?id=CVE-2020-12421
02 Jul 2020 — When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have caused add-ons to become out-of-date silently without notification to the user. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Cuando se llevan a cabo actualizaciones de add-on, las cadenas de certificados que terminan en non-built-in-roots fueron rechazadas (incluso si fueron agregadas legítim... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html • CWE-295: Improper Certificate Validation CWE-296: Improper Following of a Certificate's Chain of Trust •
CVSS: 9.3EPSS: 0%CPEs: 9EXPL: 1CVE-2020-12420 – Mozilla: Use-After-Free when trying to connect to a STUN server
https://notcve.org/view.php?id=CVE-2020-12420
02 Jul 2020 — When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Al intentar conectarse a un servidor STUN, una condición de carrera podría haber causado un uso de la memoria previamente liberada de un puntero, conllevando a una corrupción de la memoria y un bloqueo potencialmente explotable. Esta vulnerabilidad a... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12409 – Gentoo Linux Security Advisory 202006-07
https://notcve.org/view.php?id=CVE-2020-12409
12 Jun 2020 — When using certain blank characters in a URL, they where incorrectly rendered as spaces instead of an encoded URL. This vulnerability affects Firefox < 77. Cuando usan determinados caracteres en blanco en una URL, fueron incorrectamente renderizados como espacios en lugar de una URL codificada. Esta vulnerabilidad afecta a Firefox versiones anteriores a 77 Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. Versions less than 68.9.... • https://bugzilla.mozilla.org/show_bug.cgi?id=1629506 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12407 – Gentoo Linux Security Advisory 202006-07
https://notcve.org/view.php?id=CVE-2020-12407
05 Jun 2020 — Mozilla Developer Nicolas Silva found that when using WebRender, Firefox would under certain conditions leak arbitrary GPU memory to the visible screen. The leaked memory content was visible to the user, but not observable from web content. This vulnerability affects Firefox < 77. El desarrollador de Mozilla, Nicolas Silva, detectó que cuando usaba WebRender, Firefox, bajo determinadas condiciones, filtra memoria arbitraria de la GPU hacia la pantalla visible. El contenido de la memoria filtrada era visible... • https://bugzilla.mozilla.org/show_bug.cgi?id=1637112 • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12408 – Gentoo Linux Security Advisory 202006-07
https://notcve.org/view.php?id=CVE-2020-12408
05 Jun 2020 — When browsing a document hosted on an IP address, an attacker could insert certain characters to flip domain and path information in the address bar. This vulnerability affects Firefox < 77. Al explorar un documento alojado en una dirección IP, un atacante podría insertar determinados caracteres para voltear una información de dominio y ruta en la barra de direcciones. Esta vulnerabilidad afecta a Firefox versiones anteriores a 77 Multiple security issues were discovered in Firefox. If a user were tricked i... • https://bugzilla.mozilla.org/show_bug.cgi?id=1623888 •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12411 – Gentoo Linux Security Advisory 202006-07
https://notcve.org/view.php?id=CVE-2020-12411
05 Jun 2020 — Mozilla developers reported memory safety bugs present in Firefox 76. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 77. Los desarrolladores de Mozilla reportaron bugs de seguridad de la memoria presentes en Firefox versión 76. Algunos de estos bugs mostraron evidencia de corrupción de la memoria y presumimos que con suficiente esfuerzo algunos de estos podrían ... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1620972%2C1625333 • CWE-787: Out-of-bounds Write •