CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6826 – Gentoo Linux Security Advisory 202004-11
https://notcve.org/view.php?id=CVE-2020-6826
23 Apr 2020 — Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory safety bugs present in Firefox 74. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 75. Los desarrolladores de Mozilla, Tyson Smith, Bob Clary y Alexandru Michis reportaron bugs de seguridad de la memoria presentes en Firefox versión 74. Algunos de estos bugs mostraron evidencia de cor... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1613009%2C1613195%2C1616734%2C1617488%2C1619229%2C1620719%2C1624897 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-6821 – Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method
https://notcve.org/view.php?id=CVE-2020-6821
08 Apr 2020 — When reading from areas partially or fully outside the source resource with WebGL's copyTexSubImage method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially sensitive data disclosure. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. Cuando se lee desde áreas parcial o completamente fuera del recurso fuente con el método copyTexSubImage de WebGL, la especificación requiere ... • https://bugzilla.mozilla.org/show_bug.cgi?id=1625404 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-908: Use of Uninitialized Resource •
CVSS: 2.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6824 – Gentoo Linux Security Advisory 202004-11
https://notcve.org/view.php?id=CVE-2020-6824
08 Apr 2020 — Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Firefox open. Subsequently, if the user had opened a new Private Browsing Window, revisited the same site, and generated a new password - the generated passwords would have been identical, rather than independent. This vulnerability affects Firefox < 75. Inicialmente, un usuario abre una Ventana de Navegación Privada y genera una contraseña para un sitio, luego cierra la ... • https://bugzilla.mozilla.org/show_bug.cgi?id=1621853 • CWE-384: Session Fixation •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-6822 – Mozilla: Out of bounds write in GMPDecodeData when processing large images
https://notcve.org/view.php?id=CVE-2020-6822
08 Apr 2020 — On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in GMPDecodeData. It is possible that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. En las compilaciones de 32 bits, podría haber ocurrido una escritura fuera de límites al procesar una imagen de más de 4 GB en (code)GMPDecodeData(/code). Es posible que con suficiente esfuerzo esto... • https://bugzilla.mozilla.org/show_bug.cgi?id=1544181 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-6825 – Mozilla: Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7
https://notcve.org/view.php?id=CVE-2020-6825
08 Apr 2020 — Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. Los desarrolladores y los miembros de la comunidad de Mozilla Tyson Smith y Christian Holler reportaron bugs de seguridad... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1572541%2C1620193%2C1620203 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6823 – Gentoo Linux Security Advisory 202004-11
https://notcve.org/view.php?id=CVE-2020-6823
08 Apr 2020 — A malicious extension could have called browser.identity.launchWebAuthFlow, controlling the redirect_uri, and through the Promise returned, obtain the Auth code and gain access to the user's account at the service provider. This vulnerability affects Firefox < 75. Una extensión maliciosa podría haber llamado (code)browser.identity.launchWebAuthFlow(/code), controlando el redirect_uri y, por medio de la Promesa devuelta, obtenga el código de Autenticación y consiga acceso a la cuenta del usuario... • https://bugzilla.mozilla.org/show_bug.cgi?id=1614919 • CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 12%CPEs: 3EXPL: 1CVE-2020-6819 – Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
https://notcve.org/view.php?id=CVE-2020-6819
06 Apr 2020 — Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. Bajo determinadas condiciones, cuando se ejecuta el destructor nsDocShell, una condición de carrera puede causar un uso de la memoria previamente liberada. Somos conscientes de los ataques dirigidos "in the wild" que abusan de este fallo. • https://bugzilla.mozilla.org/show_bug.cgi?id=1620818 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2020-6820 – Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
https://notcve.org/view.php?id=CVE-2020-6820
06 Apr 2020 — Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. Bajo determinadas condiciones, cuando se maneja un ReadableStream, una condición de carrera puede causar un uso de la memoria previamente liberada. Somos conscientes de los ataques dirigidos "in the wild" que abusan de este fallo. • https://bugzilla.mozilla.org/show_bug.cgi?id=1626728 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6813
https://notcve.org/view.php?id=CVE-2020-6813
25 Mar 2020 — When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker to inject arbitrary styles, bypassing the intent of the Content Security Policy. This vulnerability affects Firefox < 74. Cuando se protegen los bloques CSS con la funcionalidad nonce de la Content Security Policy, la sentencia @import en el bloque CSS podría permitir a un atacante inyectar estilos arbitrarios, omitiendo la intención de la Content Security Policy. Esta... • https://bugzilla.mozilla.org/show_bug.cgi?id=1605814 •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2020-6812 – Mozilla: The names of AirPods with personally identifiable information were exposed to websites with camera or microphone permission
https://notcve.org/view.php?id=CVE-2020-6812
12 Mar 2020 — The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microphone permission are able to enumerate device names, disclosing the user's name. To resolve this issue, Firefox added a special case that renames devices containing the substring 'AirPods' to simply 'AirPods'. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. • https://bugzilla.mozilla.org/show_bug.cgi?id=1616661 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •