CVE-2013-1689

https://notcve.org/view.php?id=CVE-2013-1689

10 Dec 2019 — Mozilla Firefox 20.0a1 and earlier allows remote attackers to cause a denial of service (crash), related to event handling with frames. Mozilla Firefox versión 20.0a1 y anteriores, permiten a atacantes remotos causar una denegación de servicio (bloqueo), relacionado con el manejo de eventos con tramas. • https://bugzilla.mozilla.org/show_bug.cgi?id=817219 • CWE-20: Improper Input Validation •

CVE-2019-17014 – Ubuntu Security Notice USN-4216-1

https://notcve.org/view.php?id=CVE-2019-17014

09 Dec 2019 — If an image had not loaded correctly (such as when it is not actually an image), it could be dragged and dropped cross-domain, resulting in a cross-origin information leak. This vulnerability affects Firefox < 71. Si una imagen no ha sido cargada correctamente (tal y como cuando en realidad no es una imagen), podría ser arrastrada y soltada entre dominios, resultando en un filtrado de información de origen cruzado. Esta vulnerabilidad afecta a Firefox versiones anteriores a la versión 71. Multiple security ... • https://bugzilla.mozilla.org/show_bug.cgi?id=1322864 • CWE-863: Incorrect Authorization •

CVE-2019-17005 – Mozilla: Buffer overflow in plain text serializer

https://notcve.org/view.php?id=CVE-2019-17005

04 Dec 2019 — The plain text serializer used a fixed-size array for the number of

elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. El serializador de texto plano utilizó una matriz de tamaño fijo para el número de elementos (ol) que podía procesar; sin embargo, fue posible desbordar la matriz de tamaño estático conllevando a un cor... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •

CVE-2019-17011 – Mozilla: Use-after-free when retrieving a document in antitracking

https://notcve.org/view.php?id=CVE-2019-17011

04 Dec 2019 — Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Bajo determinadas condiciones, al recuperar un documento desde un DocShell en el código antitracking, una condición de carrera podría causar un condición de uso de la memoria previamente liberada y un bloqueo explotable potencialmente. Est... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •

CVE-2019-17012 – Mozilla: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3

https://notcve.org/view.php?id=CVE-2019-17012

04 Dec 2019 — Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Los desarrolladores de Mozilla reportaron bugs de seguridad de memoria presentes en Firefox versión 70 y Firefox ESR versión 68.2. Algunos de estos errores mostraron evidencia de... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •

CVE-2019-17010 – Mozilla: Use-after-free when performing device orientation checks

https://notcve.org/view.php?id=CVE-2019-17010

04 Dec 2019 — Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Bajo determinadas condiciones, cuando se comprueba la preferencia Resist Fingerprinting durante las verificaciones de orientación del dispositivo, una condición de carrera podría haber causado un uso de la memoria previamente l... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •

CVE-2019-17008 – Mozilla: Use-after-free in worker destruction

https://notcve.org/view.php?id=CVE-2019-17008

04 Dec 2019 — When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Cuando se usan trabajadores anidados, puede ocurrir un uso de la memoria previamente liberada durante la destrucción del trabajador. Esto resultó en un bloqueo explotable potencialmente. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html • CWE-416: Use After Free •

CVE-2019-17009 – Slackware Security Advisory - mozilla-firefox Updates

https://notcve.org/view.php?id=CVE-2019-17009

04 Dec 2019 — When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.*. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Cuando se ejecuta, el servicio updater escribió el estado y los archivos de registro en una ubi... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html •

CVE-2019-11745 – nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate

https://notcve.org/view.php?id=CVE-2019-11745

28 Nov 2019 — When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Al encriptar con un cifrado de bloque, si se realizó una llamada a NSC_EncryptUpdate con datos más pequeños que el tamaño del bloque, podría producirse una pequeña escritura fuera de límites. Es... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html • CWE-787: Out-of-bounds Write •

CVE-2019-17002 – Ubuntu Security Notice USN-4165-1

https://notcve.org/view.php?id=CVE-2019-17002

24 Oct 2019 — If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was not upgraded to https. This vulnerability affects Firefox < 70. Si se especificaron peticiones de actualización no seguras en la Política de Seguridad de Contenido y un enlace fue arrastrado y soltado desde esa página, el enlace no se actualizó a https. Esta vulnerabilidad afecta a Firefox versiones anteriores a la versión 70. Multiple security issues were discovered in ... • https://bugzilla.mozilla.org/show_bug.cgi?id=1561056 •