CVSS: 9.8EPSS: 1%CPEs: 21EXPL: 1CVE-2017-5401 – Mozilla: Memory Corruption when handling ErrorResult (MFSA 2017-06)
https://notcve.org/view.php?id=CVE-2017-5401
08 Mar 2017 — A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error. The resulting crash may be exploitable. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Un cierre inesperado desencadenable mediante contenido web en el que un "ErrorResult" referencia memoria no asignada debido a un error de lógica. El cierre inesperado resultante podría ser explotado. • http://rhn.redhat.com/errata/RHSA-2017-0459.html • CWE-388: 7PK - Errors •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2017-5416 – Ubuntu Security Notice USN-3216-1
https://notcve.org/view.php?id=CVE-2017-5416
08 Mar 2017 — In certain circumstances a networking event listener can be prematurely released. This appears to result in a null dereference in practice. This vulnerability affects Firefox < 52 and Thunderbird < 52. En determinadas circunstancias, un escuchador de eventos de red puede liberarse prematuramente. Esto parece resultar en la práctica en una desreferencia NULL. • http://www.securityfocus.com/bid/96692 • CWE-476: NULL Pointer Dereference •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2017-5426 – Ubuntu Security Notice USN-3216-1
https://notcve.org/view.php?id=CVE-2017-5426
08 Mar 2017 — On Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media Plugin sandbox is started, the sandbox fails to be applied and items that would run within the sandbox are run protected only by the running filter which is typically weak compared to the sandbox. Note: this issue only affects Linux. Other operating systems are not affected. This vulnerability affects Firefox < 52 and Thunderbird < 52. En Linux, si el filtro BPF en modo secure computing (seccomp-bpf) se está ejec... • http://www.securityfocus.com/bid/96694 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.8EPSS: 0%CPEs: 21EXPL: 0CVE-2017-5376 – Mozilla: Use-after-free in XSL (MFSA 2017-02)
https://notcve.org/view.php?id=CVE-2017-5376
25 Jan 2017 — Use-after-free while manipulating XSL in XSLT documents. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Uso de memoria previamente liberada al manipular XSL en documentos XSLT. La vulnerabilidad afecta a Thunderbird en versiones anteriores a la 45.7, Firefox ESR en versiones anteriores a la 45.7 y Firefox en versiones anteriores a la 51. USN-3175-1 fixed vulnerabilities in Firefox. • http://rhn.redhat.com/errata/RHSA-2017-0190.html • CWE-416: Use After Free •
CVSS: 6.1EPSS: 0%CPEs: 21EXPL: 0CVE-2017-5383 – Mozilla: Location bar spoofing with unicode characters (MFSA 2017-02)
https://notcve.org/view.php?id=CVE-2017-5383
25 Jan 2017 — URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Las URL que contienen ciertos glifos unicode para guiones y comillas alternativas no desencadenan correctamente la visualización de punycode, lo que permite ataques de suplantación de nombre de dominio en la barra de direcciones. La vulnerabilidad ... • http://rhn.redhat.com/errata/RHSA-2017-0190.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 21EXPL: 0CVE-2017-5390 – Mozilla: Insecure communication methods in Developer Tools JSON viewer (MFSA 2017-02)
https://notcve.org/view.php?id=CVE-2017-5390
25 Jan 2017 — The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing JSON or HTTP headers data, allowing for potential privilege escalation. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. El visor JSON en Developer Tools emplea métodos inseguros para crear un canal de comunicación para copiar y visualizar datos de cabeceras HTTP o JSON, lo que permite un potencial escalado de privilegios. La vulnerabilidad afecta a Thund... • http://rhn.redhat.com/errata/RHSA-2017-0190.html •
CVSS: 9.8EPSS: 0%CPEs: 21EXPL: 1CVE-2017-5396 – Mozilla: Use-after-free with Media Decoder (MFSA 2017-02)
https://notcve.org/view.php?id=CVE-2017-5396
25 Jan 2017 — A use-after-free vulnerability in the Media Decoder when working with media files when some events are fired after the media elements are freed from memory. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Vulnerabilidad de uso de memoria previamente liberada en Media Decoder al trabajar con archivos multimedia cuando se lanzan algunos eventos una vez se liberan de la memoria los elementos media. La vulnerabilidad afecta a Thunderbird en versiones anteriores a la 45.7, Fi... • http://rhn.redhat.com/errata/RHSA-2017-0190.html • CWE-416: Use After Free •
CVSS: 9.8EPSS: 0%CPEs: 21EXPL: 0CVE-2017-5380 – Mozilla: Potential use-after-free during DOM manipulations (MFSA 2017-02)
https://notcve.org/view.php?id=CVE-2017-5380
25 Jan 2017 — A potential use-after-free found through fuzzing during DOM manipulation of SVG content. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Se ha encontrado un potencial uso de memoria previamente liberada mediante fuzzing durante la manipulación DOM del contenido SVG. La vulnerabilidad afecta a Thunderbird en versiones anteriores a la 45.7, Firefox ESR en versiones anteriores a la 45.7 y Firefox en versiones anteriores a la 51. USN-3175-1 fixed vulnerabilities in Firefox. • http://rhn.redhat.com/errata/RHSA-2017-0190.html • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 21EXPL: 1CVE-2017-5378 – Mozilla: Pointer and frame data leakage of Javascript objects (MFSA 2017-02)
https://notcve.org/view.php?id=CVE-2017-5378
25 Jan 2017 — Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address can be discovered through hash codes, and also allows for data leakage of an object's content using these hash codes. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Los códigos hasheados de objetos JavaScript se comparten entre páginas. Esto permite fugas de puntero debido a que se puede descubrir la dirección de un objeto por medio de los códigos hash ... • http://rhn.redhat.com/errata/RHSA-2017-0190.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 13EXPL: 0CVE-2017-5373 – Mozilla: Memory safety bugs fixed in Firefox 51 and Firefox ESR 45.7 (MFSA 2017-01)
https://notcve.org/view.php?id=CVE-2017-5373
25 Jan 2017 — Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. Se han reportado errores de seguridad de memoria en Firefox 50.1 y Firefox ESR 45.6. Algunos de estos errores mostraron evidencias de corrupción de memoria y se entiende que, con el suficiente esfuerz... • http://rhn.redhat.com/errata/RHSA-2017-0190.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •