CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-15664 – Mozilla: Attacker-induced prompt for extension installation
https://notcve.org/view.php?id=CVE-2020-15664
By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious extension being installed. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, Firefox ESR < 78.2, and Firefox for Android < 80. Al mantener una referencia a la función eval() desde una ventana about:blank, una página web maliciosa podría haber conseguido acceso al objeto InstallTrigger, lo que le permitiría solicitar al usuario que instale una extensión. Combinado con la confusión del usuario, esto podría resultar en la instalación de una extensión maliciosa o involuntaria. • https://bugzilla.mozilla.org/show_bug.cgi?id=1658214 https://www.mozilla.org/security/advisories/mfsa2020-36 https://www.mozilla.org/security/advisories/mfsa2020-37 https://www.mozilla.org/security/advisories/mfsa2020-38 https://www.mozilla.org/security/advisories/mfsa2020-39 https://www.mozilla.org/security/advisories/mfsa2020-40 https://www.mozilla.org/security/advisories/mfsa2020-41 https://access.redhat.com/security/cve/CVE-2020-15664 https://bugzilla.redhat.com/show_bug.cgi?id=1872 • CWE-648: Incorrect Use of Privileged APIs CWE-863: Incorrect Authorization •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-15669 – Mozilla: Use-After-Free when aborting an operation
https://notcve.org/view.php?id=CVE-2020-15669
When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. This results in a use-after-free and we presume that with enough effort it could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.12 and Thunderbird < 68.12. Cuando se anula una operación, como una recuperación, puede ser eliminada una señal de cancelación mientras se alerta a los objetos que deben ser notificados. Esto resulta en un uso de la memoria previamente liberada y suponemos que con suficiente esfuerzo podría haber sido explotado para ejecutar código arbitrario. • https://bugzilla.mozilla.org/show_bug.cgi?id=1656957 https://www.mozilla.org/security/advisories/mfsa2020-37 https://www.mozilla.org/security/advisories/mfsa2020-40 https://access.redhat.com/security/cve/CVE-2020-15669 https://bugzilla.redhat.com/show_bug.cgi?id=1872532 • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-15649
https://notcve.org/view.php?id=CVE-2020-15649
Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.11. Dada una aplicación de selección de archivos maliciosa instalada, un atacante pudo robar y cargar archivos locales de su elección, independientemente de los archivos seleccionados. * Nota: este problema solo afectó a Firefox para Android. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1475835%2C1652364 https://www.mozilla.org/security/advisories/mfsa2020-31 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-15650
https://notcve.org/view.php?id=CVE-2020-15650
Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile). *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.11. Dada una aplicación de selección de archivos maliciosa instalada, un atacante fue capaz de sobrescribir archivos locales y, por lo tanto, sobrescribir la configuración de Firefox (pero sin acceder al perfil anterior). * Nota: este problema solo afectó a Firefox para Android. • https://bugzilla.mozilla.org/show_bug.cgi?id=1652360 https://www.mozilla.org/security/advisories/mfsa2020-31 •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2020-15657
https://notcve.org/view.php?id=CVE-2020-15657
Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker that is already capable of placing files in the installation directory. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1. • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html https://bugzilla.mozilla.org/show_bug.cgi?id=1644954 https://www.mozilla.org/security/advisories/mfsa2020-30 https://www.mozilla.org/security/advisories/mfsa2020-32 https://www.mozilla.org/security/advisories/mfsa2020-33 • CWE-427: Uncontrolled Search Path Element •