CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12409 – Gentoo Linux Security Advisory 202006-07
https://notcve.org/view.php?id=CVE-2020-12409
12 Jun 2020 — When using certain blank characters in a URL, they where incorrectly rendered as spaces instead of an encoded URL. This vulnerability affects Firefox < 77. Cuando usan determinados caracteres en blanco en una URL, fueron incorrectamente renderizados como espacios en lugar de una URL codificada. Esta vulnerabilidad afecta a Firefox versiones anteriores a 77 Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. Versions less than 68.9.... • https://bugzilla.mozilla.org/show_bug.cgi?id=1629506 •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12411 – Gentoo Linux Security Advisory 202006-07
https://notcve.org/view.php?id=CVE-2020-12411
05 Jun 2020 — Mozilla developers reported memory safety bugs present in Firefox 76. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 77. Los desarrolladores de Mozilla reportaron bugs de seguridad de la memoria presentes en Firefox versión 76. Algunos de estos bugs mostraron evidencia de corrupción de la memoria y presumimos que con suficiente esfuerzo algunos de estos podrían ... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1620972%2C1625333 • CWE-787: Out-of-bounds Write •
CVSS: 4.4EPSS: 0%CPEs: 4EXPL: 0CVE-2020-12399 – nss: Timing attack on DSA signature generation
https://notcve.org/view.php?id=CVE-2020-12399
05 Jun 2020 — NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. NSS ha mostrado diferencias de sincronización cuando se llevan a cabo firmas DSA, que fue explotable y eventualmente podría filtrar claves privadas. Esta vulnerabilidad afecta a Thunderbird versiones anteriores a 68.9.0, Firefox versiones anteriores a 77 y Firefox ESR versiones anteriores a 68.9 A... • https://bugzilla.mozilla.org/show_bug.cgi?id=1631576 • CWE-203: Observable Discrepancy CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12407 – Gentoo Linux Security Advisory 202006-07
https://notcve.org/view.php?id=CVE-2020-12407
05 Jun 2020 — Mozilla Developer Nicolas Silva found that when using WebRender, Firefox would under certain conditions leak arbitrary GPU memory to the visible screen. The leaked memory content was visible to the user, but not observable from web content. This vulnerability affects Firefox < 77. El desarrollador de Mozilla, Nicolas Silva, detectó que cuando usaba WebRender, Firefox, bajo determinadas condiciones, filtra memoria arbitraria de la GPU hacia la pantalla visible. El contenido de la memoria filtrada era visible... • https://bugzilla.mozilla.org/show_bug.cgi?id=1637112 • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12408 – Gentoo Linux Security Advisory 202006-07
https://notcve.org/view.php?id=CVE-2020-12408
05 Jun 2020 — When browsing a document hosted on an IP address, an attacker could insert certain characters to flip domain and path information in the address bar. This vulnerability affects Firefox < 77. Al explorar un documento alojado en una dirección IP, un atacante podría insertar determinados caracteres para voltear una información de dominio y ruta en la barra de direcciones. Esta vulnerabilidad afecta a Firefox versiones anteriores a 77 Multiple security issues were discovered in Firefox. If a user were tricked i... • https://bugzilla.mozilla.org/show_bug.cgi?id=1623888 •
CVSS: 5.3EPSS: 0%CPEs: 7EXPL: 1CVE-2020-12405 – Mozilla: Use-after-free in SharedWorkerService
https://notcve.org/view.php?id=CVE-2020-12405
03 Jun 2020 — When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. Cuando se navega una página maliciosa, podría ocurrir una condición de carrera en nuestro SharedWorkerService y conllevar a un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Thunderbird versiones anteriores a 68.9.0, Firefox versiones anteriores a 77 y Firefox ESR versiones ... • https://bugzilla.mozilla.org/show_bug.cgi?id=1631618 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 9.3EPSS: 0%CPEs: 6EXPL: 0CVE-2020-12410 – Mozilla: Memory safety bugs fixed in Firefox 77 and Firefox ESR 68.9
https://notcve.org/view.php?id=CVE-2020-12410
03 Jun 2020 — Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. Los desarrolladores de Mozilla reportaron bugs de seguridad de la memoria presentes en Firefox versión 76 y Firefox ESR versión 68.8. Algunos de estos bugs mostraron evidencia ... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1619305%2C1632717 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 9.3EPSS: 0%CPEs: 7EXPL: 0CVE-2020-12406 – Mozilla: JavaScript Type confusion with NativeTypes
https://notcve.org/view.php?id=CVE-2020-12406
03 Jun 2020 — Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. El desarrollador de Mozilla, Iain Ireland, detectó una falta de un tipo comprobación durante la eliminación de objetos sin caja, resultando en un bloqueo. Presumimos que con un esfuerzo suficiente podría ser explotado para ... • https://bugzilla.mozilla.org/show_bug.cgi?id=1639590 • CWE-345: Insufficient Verification of Data Authenticity CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6830
https://notcve.org/view.php?id=CVE-2020-6830
26 May 2020 — For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used for JS-to-native also, but it isn't needed in this case, and its usage was also leaking this token. This vulnerability affects Firefox for iOS < 25. Para el puente de red native-to-JS, la aplicación requiere que un token único que sea pasado garantice que el código que no sea de la aplicación no pueda llamar a las funciones del puente de red. Ese toke... • https://bugzilla.mozilla.org/show_bug.cgi?id=1632387 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 1%CPEs: 3EXPL: 1CVE-2020-12388 – Firefox Default Content Process DACL Sandbox Escape
https://notcve.org/view.php?id=CVE-2020-12388
26 May 2020 — The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76. Los procesos de contenido de Firefox no bloquearon suficientemente el control de acceso, lo que podría resultar en un escape del sandbox. *Nota: este problema solo afecta a Firefox en los sistemas operativos Windows.*. • https://packetstorm.news/files/id/157860 • CWE-20: Improper Input Validation •