CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-23960 – Mozilla: Use-after-poison for incorrectly redeclared JavaScript variables during GC
https://notcve.org/view.php?id=CVE-2021-23960
Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. Realizar una recolección de basura en variables de JavaScript declaradas nuevamente resultó en un usuario después del envenenamiento y un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Firefox versiones anteriores a 85, Thunderbird versiones anteriores a 78,7 y Firefox ESR versiones anteriores a 78,7 The Mozilla Foundation Security Advisory describes this flaw as: Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. • https://bugzilla.mozilla.org/show_bug.cgi?id=1675755 https://www.mozilla.org/security/advisories/mfsa2021-03 https://www.mozilla.org/security/advisories/mfsa2021-04 https://www.mozilla.org/security/advisories/mfsa2021-05 https://access.redhat.com/security/cve/CVE-2021-23960 https://bugzilla.redhat.com/show_bug.cgi?id=1920650 • CWE-626: Null Byte Interaction Error (Poison Null Byte) •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-23954 – Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements
https://notcve.org/view.php?id=CVE-2021-23954
Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. Usando los nuevos operadores de asignación lógica en una declaración de cambio de JavaScript podría haber causado una confusión de tipos, conllevando a una corrupción de la memoria y un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Firefox versiones anteriores a 85, Thunderbird versiones anteriores a 78,7 y Firefox ESR versiones anteriores a 78,7 The Mozilla Foundation Security Advisory describes this flaw as: Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash. • https://bugzilla.mozilla.org/show_bug.cgi?id=1684020 https://www.mozilla.org/security/advisories/mfsa2021-03 https://www.mozilla.org/security/advisories/mfsa2021-04 https://www.mozilla.org/security/advisories/mfsa2021-05 https://access.redhat.com/security/cve/CVE-2021-23954 https://bugzilla.redhat.com/show_bug.cgi?id=1920648 • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2020-35112
https://notcve.org/view.php?id=CVE-2020-35112
If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with an executable extension (such as .bat or .exe) that executable would have been launched instead. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. Si un usuario descargó un archivo que carece de una extensión en Windows y luego "Open"-ed desde el panel de descargas, si había un archivo ejecutable en el directorio de descargas con el mismo nombre pero con una extensión ejecutable (como .bat o .exe) ese ejecutable habría sido iniciado en su lugar. • https://bugzilla.mozilla.org/show_bug.cgi?id=1661365 https://www.mozilla.org/security/advisories/mfsa2020-54 https://www.mozilla.org/security/advisories/mfsa2020-55 https://www.mozilla.org/security/advisories/mfsa2020-56 •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26973 – Mozilla: CSS Sanitizer performed incorrect sanitization
https://notcve.org/view.php?id=CVE-2020-26973
Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. Determinadas entradas hacia el CSS Sanitizer lo confundieron, resultando en una eliminación de componentes incorrectos. Esto podría haber sido usado como una omisión de saneo. • https://bugzilla.mozilla.org/show_bug.cgi?id=1680084 https://www.mozilla.org/security/advisories/mfsa2020-54 https://www.mozilla.org/security/advisories/mfsa2020-55 https://www.mozilla.org/security/advisories/mfsa2020-56 https://access.redhat.com/security/cve/CVE-2020-26973 https://bugzilla.redhat.com/show_bug.cgi?id=1908023 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26971 – Mozilla: Heap buffer overflow in WebGL
https://notcve.org/view.php?id=CVE-2020-26971
Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. Determinados valores de blit proporcionados por el usuario no se restringieron apropiadamente, conllevando a un desbordamiento del búfer de pila en algunos controladores de video. Esta vulnerabilidad afecta a Firefox versiones anteriores a 84, Thunderbird versiones anteriores a 78,6 y Firefox ESR versiones anteriores a 78,6 The Mozilla Foundation Security Advisory describes this flaw as: Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers. • https://bugzilla.mozilla.org/show_bug.cgi?id=1663466 https://www.mozilla.org/security/advisories/mfsa2020-54 https://www.mozilla.org/security/advisories/mfsa2020-55 https://www.mozilla.org/security/advisories/mfsa2020-56 https://access.redhat.com/security/cve/CVE-2020-26971 https://bugzilla.redhat.com/show_bug.cgi?id=1908022 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •