CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2019-11762 – Mozilla: document.domain-based origin isolation has same-origin-property violation
https://notcve.org/view.php?id=CVE-2019-11762
23 Oct 2019 — If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin window. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Si dos documentos del mismo origen configuran a document.domain de manera diferente para convertirse en origen cruzado, es posible llamar arbitrariamente a DOM methods/getters/setters en la ventana ahora de origen cruzado. Esta vulnerabili... • https://bugzilla.mozilla.org/show_bug.cgi?id=1582857 • CWE-346: Origin Validation Error CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 6.1EPSS: 1%CPEs: 4EXPL: 0CVE-2019-11763 – Mozilla: Incorrect HTML parsing results in XSS bypass technique
https://notcve.org/view.php?id=CVE-2019-11763
23 Oct 2019 — Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could have led to XSS in a web application under certain conditions. It could have also led to HTML entities being masked from filters - enabling the use of entities to mask the actual characters of interest from filters. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Si no se ma... • https://bugzilla.mozilla.org/show_bug.cgi?id=1584216 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 1CVE-2019-11764 – Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2
https://notcve.org/view.php?id=CVE-2019-11764
23 Oct 2019 — Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Los desarrolladores de Mozilla y los miembros de la comunidad reportaron bugs de seguridad de memoria presentes en Firefox versión 69 y Firefox ESR versión 68.1. A... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1558522%2C1577061%2C1548044%2C1571223%2C1573048%2C1578933%2C1575217%2C1583684%2C1586845%2C1581950%2C1583463%2C1586599 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 7.0EPSS: 0%CPEs: 3EXPL: 0CVE-2019-11736
https://notcve.org/view.php?id=CVE-2019-11736
27 Sep 2019 — The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged access. Additionally, there was a race condition during checks for junctions and symbolic links by the Maintenance Service, allowing for potential local file and directory manipulation to be undetected in some circumstances. This allows for potential privilege escalation ... • http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-11751
https://notcve.org/view.php?id=CVE-2019-11751
27 Sep 2019 — Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks on malicious links in a chat application. This can be used to write a log file to an arbitrary location such as the Windows 'Startup' folder.
*Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1. Los parámetros de línea de comando relacionados con el Inicio de Sesión no son saneados apro... • http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-11753
https://notcve.org/view.php?id=CVE-2019-11753
27 Sep 2019 — The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malware. If the Mozilla Maintenance Service is manipulated to update this unprotected location and the updated maintenance service in the unprotected location has been altered, the altered maintenance service can run with elevated privileges during the update process due to a lack of integrity checks. This allows for privilege escalation if the executable... • http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html • CWE-354: Improper Validation of Integrity Check Value •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11754 – Ubuntu Security Notice USN-4140-1
https://notcve.org/view.php?id=CVE-2019-11754
26 Sep 2019 — When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given. This could allow a malicious website to hijack the mouse pointer and confuse users. This vulnerability affects Firefox < 69.0.1. Cuando el bloqueo del puntero es habilitado por un sitio web por medio de la función requestPointerLock(), no se entrega ninguna notificación al usuario. Esto podría permitir que un sitio web malicioso secuestrara el puntero del mouse y confundiera a los usuarios. • https://bugzilla.mozilla.org/show_bug.cgi?id=1580506 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11734 – Ubuntu Security Notice USN-4122-1
https://notcve.org/view.php?id=CVE-2019-11734
04 Sep 2019 — Mozilla developers and community members reported memory safety bugs present in Firefox 68. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 69. Los desarrolladores de Mozilla y los miembros de la comunidad reportaron bugs de seguridad de la memoria presentes en Firefox versión 68. Algunos de estos errores mostraron evidencia de corrupción de la memoria y presumimos... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1352875%2C1536227%2C1557208%2C1560641 • CWE-787: Out-of-bounds Write •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11737 – Ubuntu Security Notice USN-4122-1
https://notcve.org/view.php?id=CVE-2019-11737
04 Sep 2019 — If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive will be ignored, leading to CSP directives not being properly applied to content. This vulnerability affects Firefox < 69. Si es especificado un comodín ('*') para el host en las directivas de Content Security Policy (CSP), será ignorada cualquier restricción de puerto o ruta de la directiva, lo que provocará que las directivas CSP no se apliquen correctamente al contenido... • https://bugzilla.mozilla.org/show_bug.cgi?id=1388015 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11741 – Ubuntu Security Notice USN-4122-1
https://notcve.org/view.php?id=CVE-2019-11741
04 Sep 2019 — A compromised sandboxed content process can perform a Universal Cross-site Scripting (UXSS) attack on content from any site it can cause to be loaded in the same process. Because addons.mozilla.org and accounts.firefox.com have close ties to the Firefox product, malicious manipulation of these sites within the browser can potentially be used to modify a user's Firefox configuration. These two sites will now be isolated into their own process and not allowed to be loaded in a standard content process. This v... • https://bugzilla.mozilla.org/show_bug.cgi?id=1539595 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •