CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2019-11709 – Mozilla: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8
https://notcve.org/view.php?id=CVE-2019-11709
11 Jul 2019 — Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. Los desarrolladores de Mozilla y los miembros de la comunidad reportaron bugs de seguridad de memoria presentes en Firefox versión 67 y Firefox ESR versión 60... • http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 8.3EPSS: 2%CPEs: 7EXPL: 2CVE-2019-9811 – Mozilla Firefox Language Pack XUL Injection Sandbox Escape Vulnerability
https://notcve.org/view.php?id=CVE-2019-9811
10 Jul 2019 — As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. Como parte de una entrada Pwn2Own ganadora, un investigador demostró un escape del sandbox mediante la instalación de un paquete de idioma malicioso y luego abriendo una funcionalidad del navegador que usaba la traducción comprometida... • http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-807: Reliance on Untrusted Inputs in a Security Decision •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 4CVE-2019-11708 – Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability
https://notcve.org/view.php?id=CVE-2019-11708
24 Jun 2019 — Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2. Una revisión insuficiente de los parámetros pasados ??con el mensaje IPC de Prompt:Open... • https://packetstorm.news/files/id/165816 • CWE-20: Improper Input Validation CWE-270: Privilege Context Switching Error •
CVSS: 8.8EPSS: 68%CPEs: 3EXPL: 6CVE-2019-11707 – Mozilla Firefox and Thunderbird Type Confusion Vulnerability
https://notcve.org/view.php?id=CVE-2019-11707
19 Jun 2019 — A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2. Se puede producir una vulnerabilidad de tipo confusión cuando se manipulan objetos de JavaScript debido a problemas en Array.pop. • https://packetstorm.news/files/id/165816 • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-11693 – Mozilla: Buffer overflow in WebGL bufferdata on Linux
https://notcve.org/view.php?id=CVE-2019-11693
22 May 2019 — The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. • https://bugzilla.mozilla.org/show_bug.cgi?id=1532525 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2019-9817 – Mozilla: Stealing of cross-domain images using canvas
https://notcve.org/view.php?id=CVE-2019-9817
22 May 2019 — Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Las imágenes desde un dominio diferente pueden ser leídas utilizando un objeto de canvas en ciertas circunstancias. Esto podría ser usado para robar datos de imágenes desde un sitio diferente en violación de la política del mismo origen. • https://bugzilla.mozilla.org/show_bug.cgi?id=1540221 • CWE-346: Origin Validation Error CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-11692 – Mozilla: Use-after-free removing listeners in the event listener manager
https://notcve.org/view.php?id=CVE-2019-11692
22 May 2019 — A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Se puede producir una vulnerabilidad de uso después de la liberación cuando los escuchas se eliminan del administrador de escuchas de eventos mientras aún están en uso, lo que resulta en un fallo potencialmente explotable. Esta vulnerabilidad afecta a Thunderbi... • https://bugzilla.mozilla.org/show_bug.cgi?id=1544670 • CWE-416: Use After Free •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-9819 – Mozilla: Compartment mismatch with fetch API
https://notcve.org/view.php?id=CVE-2019-9819
22 May 2019 — A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7. Una vulnerabilidad donde puede ocurrir una discrepancia en el compartimento de JavaScript mientras trabaja con la API de fetch, lo que resulta en un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Thunderbird anterior a versión 60.7, Firefox anterior a versión 67 y... • https://bugzilla.mozilla.org/show_bug.cgi?id=1532553 • CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11697 – Ubuntu Security Notice USN-3991-1
https://notcve.org/view.php?id=CVE-2019-11697
21 May 2019 — If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that keeps the prompt visible in order for users to accept or decline the installation. A malicious web page could use this with spoofing on the page to trick users into installing a malicious extension. This vulnerability affects Firefox < 67. Si se presionan las teclas ALT y "a" cuando los usuarios reciben una solicitud de instalación de extensión, la ex... • https://bugzilla.mozilla.org/show_bug.cgi?id=1440079 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2019-11695 – Ubuntu Security Notice USN-3991-1
https://notcve.org/view.php?id=CVE-2019-11695
21 May 2019 — A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the primary web content area. This could be used by a malicious site to trick users into clicking on permission prompts, doorhanger notifications, or other buttons inadvertently if the location is spoofed over the user interface. This vulnerability affects Firefox < 67. Un cursor personalizado definido mediante secuencias de comandos en un sitio puede pos... • https://bugzilla.mozilla.org/show_bug.cgi?id=1445844 •