CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2021-29956 – Mozilla: Thunderbird stored OpenPGP secret keys without master password protection
https://notcve.org/view.php?id=CVE-2021-29956
OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will automatically protect keys that had been imported using affected Thunderbird versions. This vulnerability affects Thunderbird < 78.10.2. Unas claves secretas OpenPGP que se importaban con la versión 78.8.1 de Thunderbird hasta la versión 78.10.1 se almacenaban sin cifrar en el disco local del usuario. • https://bugzilla.mozilla.org/show_bug.cgi?id=1710290 https://www.mozilla.org/security/advisories/mfsa2021-22 https://access.redhat.com/security/cve/CVE-2021-29956 https://bugzilla.redhat.com/show_bug.cgi?id=1961504 • CWE-312: Cleartext Storage of Sensitive Information CWE-522: Insufficiently Protected Credentials •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2021-29957 – Mozilla: Partial protection of inline OpenPGP message not indicated
https://notcve.org/view.php?id=CVE-2021-29957
If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicate that only parts of the message are protected. This vulnerability affects Thunderbird < 78.10.2. Si un correo electrónico codificado con MIME contiene una parte del mensaje firmada o cifrada con OpenPGP en línea, pero también contiene una parte adicional no protegida, Thunderbird no indicaba que sólo algunas partes del mensaje estaban protegidas. Esta vulnerabilidad afecta a Thunderbird versiones anteriores a 78.10.2 • https://bugzilla.mozilla.org/show_bug.cgi?id=1673241 https://www.mozilla.org/security/advisories/mfsa2021-22 https://access.redhat.com/security/cve/CVE-2021-29957 https://bugzilla.redhat.com/show_bug.cgi?id=1961503 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-29967 – Mozilla: Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
https://notcve.org/view.php?id=CVE-2021-29967
Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11. Los desarrolladores de Mozilla han reportado bugs de seguridad de memoria presentes en Firefox versión 88 y Firefox ESR versión 78.11. Algunos de estos bugs mostraban evidencias de corrupción de memoria y presumimos que con el suficiente esfuerzo algunos de ellos podrían haber sido explotados para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1602862%2C1703191%2C1703760%2C1704722%2C1706041 https://security.gentoo.org/glsa/202208-14 https://www.mozilla.org/security/advisories/mfsa2021-23 https://www.mozilla.org/security/advisories/mfsa2021-24 https://www.mozilla.org/security/advisories/mfsa2021-26 https://access.redhat.com/security/cve/CVE-2021-29967 https://bugzilla.redhat.com/show_bug.cgi?id=1966831 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-29951 – Mozilla Windows Maintenance Service Weak DACL
https://notcve.org/view.php?id=CVE-2021-29951
The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating (if an attacker spammed the 'Stop' command); but also exposed attack surface in the maintenance service. *Note: This issue only affected Windows operating systems older than Win 10 build 1709. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.10.1, Firefox < 87, and Firefox ESR < 78.10.1. • https://bugzilla.mozilla.org/show_bug.cgi?id=1690062 https://www.mozilla.org/security/advisories/mfsa2021-10 https://www.mozilla.org/security/advisories/mfsa2021-18 https://www.mozilla.org/security/advisories/mfsa2021-19 • CWE-269: Improper Privilege Management •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-29950 – Mozilla: Logic issue potentially leaves key material unlocked
https://notcve.org/view.php?id=CVE-2021-29950
Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import task. If the task runs into a failure, the secret key may remain in memory in its unprotected state. This vulnerability affects Thunderbird < 78.8.1. Thunderbird desprotege una clave secreta OpenPGP antes de usarla para una tarea de descifrado, firma o importación de claves. Si la tarea ejecuta un fallo, la clave secreta puede permanecer en la memoria en su estado desprotegido. • https://bugzilla.mozilla.org/show_bug.cgi?id=1673239 https://www.mozilla.org/security/advisories/mfsa2021-17 https://access.redhat.com/security/cve/CVE-2021-29950 https://bugzilla.redhat.com/show_bug.cgi?id=1951873 • CWE-312: Cleartext Storage of Sensitive Information CWE-522: Insufficiently Protected Credentials •