CVSS: 8.8EPSS: 1%CPEs: 7EXPL: 0CVE-2019-17012 – Mozilla: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3
https://notcve.org/view.php?id=CVE-2019-17012
04 Dec 2019 — Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Los desarrolladores de Mozilla reportaron bugs de seguridad de memoria presentes en Firefox versión 70 y Firefox ESR versión 68.2. Algunos de estos errores mostraron evidencia de... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-17008 – Mozilla: Use-after-free in worker destruction
https://notcve.org/view.php?id=CVE-2019-17008
04 Dec 2019 — When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Cuando se usan trabajadores anidados, puede ocurrir un uso de la memoria previamente liberada durante la destrucción del trabajador. Esto resultó en un bloqueo explotable potencialmente. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 25EXPL: 0CVE-2019-11745 – nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate
https://notcve.org/view.php?id=CVE-2019-11745
28 Nov 2019 — When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. Al encriptar con un cifrado de bloque, si se realizó una llamada a NSC_EncryptUpdate con datos más pequeños que el tamaño del bloque, podría producirse una pequeña escritura fuera de límites. Es... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11765 – Ubuntu Security Notice USN-4165-1
https://notcve.org/view.php?id=CVE-2019-11765
24 Oct 2019 — A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown. However, due to lack of validation from the parent process, if the user accepted the permission request an attacker-controlled permission would be granted rather than the 'Click to Play' permission. This vulnerability affects Firefox < 70. Un proceso de contenido comprometido podría enviar un mensaje al proceso principal que causaría que la petición del permiso "Click ... • https://bugzilla.mozilla.org/show_bug.cgi?id=1562582 • CWE-276: Incorrect Default Permissions •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2019-17002 – Ubuntu Security Notice USN-4165-1
https://notcve.org/view.php?id=CVE-2019-17002
24 Oct 2019 — If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was not upgraded to https. This vulnerability affects Firefox < 70. Si se especificaron peticiones de actualización no seguras en la Política de Seguridad de Contenido y un enlace fue arrastrado y soltado desde esa página, el enlace no se actualizó a https. Esta vulnerabilidad afecta a Firefox versiones anteriores a la versión 70. Multiple security issues were discovered in ... • https://bugzilla.mozilla.org/show_bug.cgi?id=1561056 •
CVSS: 8.8EPSS: 1%CPEs: 4EXPL: 0CVE-2019-11757 – Mozilla: Use-after-free when creating index updates in IndexedDB
https://notcve.org/view.php?id=CVE-2019-11757
23 Oct 2019 — When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. This resulted in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Siguiendo la cadena de prototipos de valor, era posible retener una referencia a una configuración regional, eliminarla y, posteriormente, hacer referencia a ella. Esto resultó en un uso de la memoria previamente libera... • https://bugzilla.mozilla.org/show_bug.cgi?id=1577107 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 2%CPEs: 4EXPL: 0CVE-2019-11759 – Mozilla: Stack buffer overflow in HKDF output
https://notcve.org/view.php?id=CVE-2019-11759
23 Oct 2019 — An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an attacker to execute arbitrary code or more likely lead to a crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Un atacante podría haber causado que 4 bytes de salida HMAC se escribieran más allá del final de un búfer almacenado en la pila. Esto podría ser usado por un atacante para ejecutar código arbitrario o, más probablemente, c... • https://bugzilla.mozilla.org/show_bug.cgi?id=1577953 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 1CVE-2019-11758 – Mozilla: Potentially exploitable crash due to 360 Total Security
https://notcve.org/view.php?id=CVE-2019-11758
23 Oct 2019 — Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed evidence of memory corruption in the accessibility engine and we presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.2, and Firefox ESR < 68.2. Philipp, miembro de la comunidad de Mozilla, reportó un bug de seguridad de la memoria presente en Firefox versión 68 cuando 360 Total Securi... • https://bugzilla.mozilla.org/show_bug.cgi?id=1536227 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 6.1EPSS: 1%CPEs: 4EXPL: 0CVE-2019-11763 – Mozilla: Incorrect HTML parsing results in XSS bypass technique
https://notcve.org/view.php?id=CVE-2019-11763
23 Oct 2019 — Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could have led to XSS in a web application under certain conditions. It could have also led to HTML entities being masked from filters - enabling the use of entities to mask the actual characters of interest from filters. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Si no se ma... • https://bugzilla.mozilla.org/show_bug.cgi?id=1584216 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 1%CPEs: 4EXPL: 0CVE-2019-11760 – Mozilla: Stack buffer overflow in WebRTC networking
https://notcve.org/view.php?id=CVE-2019-11760
23 Oct 2019 — A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Un búfer de pila de tamaño fijo podría desbordarse en nrappkit cuando realiza la señalización de WebRTC. Esto resultó en un bloqueo explotable potencialmente en algunos casos. • https://bugzilla.mozilla.org/show_bug.cgi?id=1577719 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •