CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26968 – Mozilla: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5
https://notcve.org/view.php?id=CVE-2020-26968
Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Los desarrolladores de Mozilla reportaron bugs de seguridad de la memoria presentes en Firefox versión 82 y Firefox ESR versión 78.4. Algunos de estos bugs mostraron evidencia de corrupción de la memoria y suponemos que con un esfuerzo suficiente algunos de ellos podrían haber sido explotados para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1551615%2C1607762%2C1656697%2C1657739%2C1660236%2C1667912%2C1671479%2C1671923 https://www.mozilla.org/security/advisories/mfsa2020-50 https://www.mozilla.org/security/advisories/mfsa2020-51 https://www.mozilla.org/security/advisories/mfsa2020-52 https://access.redhat.com/security/cve/CVE-2020-26968 https://bugzilla.redhat.com/show_bug.cgi?id=1898741 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26956 – Mozilla: XSS through paste (manual and clipboard API)
https://notcve.org/view.php?id=CVE-2020-26956
In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. En algunos casos, al eliminar unos elementos HTML durante el saneamiento mantendría los actuales manejadores de eventos SVG y, por lo tanto, conllevaría a un ataque de tipo XSS. Esta vulnerabilidad afecta a Firefox versiones anteriores a 83, Firefox ESR versiones anteriores a 78.5, y Thunderbird versiones anteriores a 78.5 • https://bugzilla.mozilla.org/show_bug.cgi?id=1666300 https://www.mozilla.org/security/advisories/mfsa2020-50 https://www.mozilla.org/security/advisories/mfsa2020-51 https://www.mozilla.org/security/advisories/mfsa2020-52 https://access.redhat.com/security/cve/CVE-2020-26956 https://bugzilla.redhat.com/show_bug.cgi?id=1898734 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26961 – Mozilla: DoH did not filter IPv4 mapped IP Addresses
https://notcve.org/view.php?id=CVE-2020-26961
When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver. However when an IPv4 address was mapped through IPv6, these addresses were erroneously let through, leading to a potential DNS Rebinding attack. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Cuando un DNS sobre HTTPS está en uso, intencionalmente filtra el RFC1918 y los rangos de IP relacionados con las respuestas, ya que no tiene sentido al venir de un resolutor de DoH. Sin embargo, cuando una dirección IPv4 fue mapeada por medio de IPv6, estas direcciones fueron dejadas pasar erróneamente, conllevando a un potencial ataque de DNS Rebinding. • https://bugzilla.mozilla.org/show_bug.cgi?id=1672528 https://www.mozilla.org/security/advisories/mfsa2020-50 https://www.mozilla.org/security/advisories/mfsa2020-51 https://www.mozilla.org/security/advisories/mfsa2020-52 https://access.redhat.com/security/cve/CVE-2020-26961 https://bugzilla.redhat.com/show_bug.cgi?id=1898738 • CWE-358: Improperly Implemented Security Check for Standard •
CVSS: 9.3EPSS: 91%CPEs: 3EXPL: 2CVE-2020-26950 – Mozilla: Write side effects in MCallGetProperty opcode not accounted for
https://notcve.org/view.php?id=CVE-2020-26950
In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. This vulnerability affects Firefox < 82.0.3, Firefox ESR < 78.4.1, and Thunderbird < 78.4.2. En determinadas circunstancias, el opcode MCallGetProperty puede ser emitido con suposiciones no cumplidas, resultando en una condición de uso de la memoria previamente liberada explotable. Esta vulnerabilidad afecta a Firefox versiones anteriores a 82.0.3, Firefox ESR versiones anteriores a 78.4.1, y Thunderbird versiones anteriores a 78.4.2 • http://packetstormsecurity.com/files/166175/Firefox-MCallGetProperty-Write-Side-Effects-Use-After-Free.html https://bugzilla.mozilla.org/show_bug.cgi?id=1675905 https://www.mozilla.org/security/advisories/mfsa2020-49 https://access.redhat.com/security/cve/CVE-2020-26950 https://bugzilla.redhat.com/show_bug.cgi?id=1896306 https://www.mozilla.org/en-US/security/advisories/mfsa2020-49/#CVE-2020-26950 https://www.sentinelone.com/labs/firefox-jit-use-after-frees-exploiting-cve-2020-26950 • CWE-416: Use After Free •
CVSS: 9.8EPSS: 1%CPEs: 7EXPL: 0CVE-2020-15683 – Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4
https://notcve.org/view.php?id=CVE-2020-15683
Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4, Firefox < 82, and Thunderbird < 78.4. Los desarrolladores de Mozilla y los miembros de la comunidad informaron bugs de seguridad de la memoria presentes en Firefox versión 81 y Firefox ESR versión 78.3. Algunos de estos bugs mostraron evidencia de corrupción de la memoria y suponemos que con suficiente esfuerzo algunos de ellos podrían haber sido explotados para ejecutar código arbitrario. • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00057.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00062.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00074.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00077.html https://bugzilla.mozilla.org/buglist.cgi?bug_id=1576843%2C1656987%2C1660954%2C1662760%2C1663439%2C1666140 https://lists.debian.org/debian-lts-announce/2020/10/msg00027.html https://security.gentoo.org/glsa/202010 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-416: Use After Free CWE-787: Out-of-bounds Write •