CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2017-5421 – Ubuntu Security Notice USN-3216-1
https://notcve.org/view.php?id=CVE-2017-5421
08 Mar 2017 — A malicious site could spoof the contents of the print preview window if popup windows are enabled, resulting in user confusion of what site is currently loaded. This vulnerability affects Firefox < 52 and Thunderbird < 52. Un sitio malicioso podría suplantar el contenido de la ventana de previsualización de impresión si las ventanas emergentes están habilitadas, lo que resulta en una confusión del usuario de qué sitio está cargado actualmente. La vulnerabilidad afecta a Firefox en versiones anteriores a la... • http://www.securityfocus.com/bid/96692 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 22EXPL: 1CVE-2017-5407 – Mozilla: Pixel and history stealing via floating-point timing side channel with SVG filters (MFSA 2017-06)
https://notcve.org/view.php?id=CVE-2017-5407
08 Mar 2017 — Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This can be used to extract history information and read text values across domains. This violates same-origin policy and leads to information disclosure. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Mediante el uso de filtros SVG que no emplean la implementación de matemática de punto fijo en un ifr... • http://rhn.redhat.com/errata/RHSA-2017-0459.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 0%CPEs: 20EXPL: 0CVE-2017-5398 – Mozilla: Memory safety bugs fixed in Firefox 52 and Firefox ESR 45.8 (MFSA 2017-06)
https://notcve.org/view.php?id=CVE-2017-5398
08 Mar 2017 — Memory safety bugs were reported in Thunderbird 45.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Se han reportado errores de seguridad de memoria en Thunderbird 45.7. Algunos de estos errores mostraron evidencias de corrupción de memoria y se entiende que, con el suficiente esfuerzo, algunos de ... • http://rhn.redhat.com/errata/RHSA-2017-0459.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.1EPSS: 0%CPEs: 21EXPL: 1CVE-2017-5408 – Mozilla: Cross-origin reading of video captions in violation of CORS (MFSA 2017-06)
https://notcve.org/view.php?id=CVE-2017-5408
08 Mar 2017 — Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Los archivos de vídeo cargaron capturas de vídeo Cross-Origin sin comprobar la presencia de cabeceras CORS que permiten tal uso de Cross-Origin, lo que conduce a una potencial divulgación de información para captur... • http://rhn.redhat.com/errata/RHSA-2017-0459.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-5412 – Ubuntu Security Notice USN-3216-1
https://notcve.org/view.php?id=CVE-2017-5412
08 Mar 2017 — A buffer overflow read during SVG filter color value operations, resulting in data exposure. This vulnerability affects Firefox < 52 and Thunderbird < 52. Lectura por desbordamiento de búfer durante las operaciones de valor de color de filtrado SVG, lo que resulta en una exposición de datos. La vulnerabilidad afecta a Firefox en versiones anteriores a la 52 y Thunderbird en versiones anteriores a la 52. USN-3216-1 fixed vulnerabilities in Firefox. • http://www.securityfocus.com/bid/96692 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 1%CPEs: 21EXPL: 1CVE-2017-5401 – Mozilla: Memory Corruption when handling ErrorResult (MFSA 2017-06)
https://notcve.org/view.php?id=CVE-2017-5401
08 Mar 2017 — A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error. The resulting crash may be exploitable. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Un cierre inesperado desencadenable mediante contenido web en el que un "ErrorResult" referencia memoria no asignada debido a un error de lógica. El cierre inesperado resultante podría ser explotado. • http://rhn.redhat.com/errata/RHSA-2017-0459.html • CWE-388: 7PK - Errors •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2017-5416 – Ubuntu Security Notice USN-3216-1
https://notcve.org/view.php?id=CVE-2017-5416
08 Mar 2017 — In certain circumstances a networking event listener can be prematurely released. This appears to result in a null dereference in practice. This vulnerability affects Firefox < 52 and Thunderbird < 52. En determinadas circunstancias, un escuchador de eventos de red puede liberarse prematuramente. Esto parece resultar en la práctica en una desreferencia NULL. • http://www.securityfocus.com/bid/96692 • CWE-476: NULL Pointer Dereference •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2017-5426 – Ubuntu Security Notice USN-3216-1
https://notcve.org/view.php?id=CVE-2017-5426
08 Mar 2017 — On Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media Plugin sandbox is started, the sandbox fails to be applied and items that would run within the sandbox are run protected only by the running filter which is typically weak compared to the sandbox. Note: this issue only affects Linux. Other operating systems are not affected. This vulnerability affects Firefox < 52 and Thunderbird < 52. En Linux, si el filtro BPF en modo secure computing (seccomp-bpf) se está ejec... • http://www.securityfocus.com/bid/96694 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.8EPSS: 0%CPEs: 21EXPL: 0CVE-2017-5376 – Mozilla: Use-after-free in XSL (MFSA 2017-02)
https://notcve.org/view.php?id=CVE-2017-5376
25 Jan 2017 — Use-after-free while manipulating XSL in XSLT documents. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Uso de memoria previamente liberada al manipular XSL en documentos XSLT. La vulnerabilidad afecta a Thunderbird en versiones anteriores a la 45.7, Firefox ESR en versiones anteriores a la 45.7 y Firefox en versiones anteriores a la 51. USN-3175-1 fixed vulnerabilities in Firefox. • http://rhn.redhat.com/errata/RHSA-2017-0190.html • CWE-416: Use After Free •
CVSS: 6.1EPSS: 0%CPEs: 21EXPL: 0CVE-2017-5383 – Mozilla: Location bar spoofing with unicode characters (MFSA 2017-02)
https://notcve.org/view.php?id=CVE-2017-5383
25 Jan 2017 — URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Las URL que contienen ciertos glifos unicode para guiones y comillas alternativas no desencadenan correctamente la visualización de punycode, lo que permite ataques de suplantación de nombre de dominio en la barra de direcciones. La vulnerabilidad ... • http://rhn.redhat.com/errata/RHSA-2017-0190.html • CWE-20: Improper Input Validation •