CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 0CVE-2023-31248 – Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2023-31248
Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace Vulnerabilidad de Escalada de Privilegios Locales de Use-After-Free de Linux nftables; 'nft_chain_lookup_byid()' no pudo comprobar si una cadena estaba activa y CAP_NET_ADMIN está en cualquier espacio de nombres de usuario o red A use-after-free flaw was found in the Linux kernel's Netfilter module in net/netfilter/nf_tables_api.c in nft_chain_lookup_byid. This flaw allows a local attacker to cause a local privilege escalation issue due to a missing cleanup. This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of nft_chains. The issue results from the lack of validating the status of a chain while processing lookup on the chain. • http://packetstormsecurity.com/files/173757/Kernel-Live-Patch-Security-Notice-LSN-0096-1.html http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html http://www.openwall.com/lists/oss-security/2023/07/05/2 https://lists.debian.org/debian-lts-announce/2023/08/msg00001.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGZC5XOANA75OJ4XARBBXYSLDKUIJI5E https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.or • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-37211 – Mozilla: Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13
https://notcve.org/view.php?id=CVE-2023-37211
Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. The Mozilla Foundation Security Advisory describes this flaw as: Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1832306%2C1834862%2C1835886%2C1836550%2C1837450 https://lists.debian.org/debian-lts-announce/2023/07/msg00006.html https://lists.debian.org/debian-lts-announce/2023/07/msg00015.html https://www.debian.org/security/2023/dsa-5450 https://www.debian.org/security/2023/dsa-5451 https://www.mozilla.org/security/advisories/mfsa2023-22 https://www.mozilla.org/security/advisories/mfsa2023-23 https://www.mozilla.org/security/advisories/mfsa2023-24 https& • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-37208 – Mozilla: Lack of warning when opening Diagcab files
https://notcve.org/view.php?id=CVE-2023-37208
When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. The Mozilla Foundation Security Advisory describes this flaw as: When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. • https://bugzilla.mozilla.org/show_bug.cgi?id=1837675 https://lists.debian.org/debian-lts-announce/2023/07/msg00006.html https://lists.debian.org/debian-lts-announce/2023/07/msg00015.html https://www.debian.org/security/2023/dsa-5450 https://www.debian.org/security/2023/dsa-5451 https://www.mozilla.org/security/advisories/mfsa2023-22 https://www.mozilla.org/security/advisories/mfsa2023-23 https://www.mozilla.org/security/advisories/mfsa2023-24 https://access.redhat.com/security • CWE-1127: Compilation with Insufficient Warnings or Errors •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-37207 – Mozilla: Fullscreen notification obscured
https://notcve.org/view.php?id=CVE-2023-37207
A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. The Mozilla Foundation Security Advisory describes this flaw as: A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. • https://bugzilla.mozilla.org/show_bug.cgi?id=1816287 https://lists.debian.org/debian-lts-announce/2023/07/msg00006.html https://lists.debian.org/debian-lts-announce/2023/07/msg00015.html https://www.debian.org/security/2023/dsa-5450 https://www.debian.org/security/2023/dsa-5451 https://www.mozilla.org/security/advisories/mfsa2023-22 https://www.mozilla.org/security/advisories/mfsa2023-23 https://www.mozilla.org/security/advisories/mfsa2023-24 https://access.redhat.com/security • CWE-290: Authentication Bypass by Spoofing CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-37202 – Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey
https://notcve.org/view.php?id=CVE-2023-37202
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. The Mozilla Foundation Security Advisory describes this flaw as: Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free. • https://bugzilla.mozilla.org/show_bug.cgi?id=1834711 https://lists.debian.org/debian-lts-announce/2023/07/msg00006.html https://lists.debian.org/debian-lts-announce/2023/07/msg00015.html https://www.debian.org/security/2023/dsa-5450 https://www.debian.org/security/2023/dsa-5451 https://www.mozilla.org/security/advisories/mfsa2023-22 https://www.mozilla.org/security/advisories/mfsa2023-23 https://www.mozilla.org/security/advisories/mfsa2023-24 https://access.redhat.com/security • CWE-416: Use After Free •