CVSS: 9.8EPSS: 0%CPEs: 16EXPL: 0CVE-2024-6606 – Gentoo Linux Security Advisory 202412-04
https://notcve.org/view.php?id=CVE-2024-6606
09 Jul 2024 — Clipboard code failed to check the index on an array access. This could have lead to an out-of-bounds read. This vulnerability affects Firefox < 128. El código del portapapeles no pudo verificar el índice en un acceso a la matriz. Esto podría haber dado lugar a una lectura fuera de los límites. • https://bugzilla.mozilla.org/show_bug.cgi?id=1902305 • CWE-125: Out-of-bounds Read •
CVSS: 9.4EPSS: 0%CPEs: 12EXPL: 0CVE-2024-6605
https://notcve.org/view.php?id=CVE-2024-6605
09 Jul 2024 — Firefox Android allowed immediate interaction with permission prompts. This could be used for tapjacking. This vulnerability affects Firefox < 128. • https://bugzilla.mozilla.org/show_bug.cgi?id=1836786 • CWE-277: Insecure Inherited Permissions •
CVSS: 10.0EPSS: 0%CPEs: 35EXPL: 0CVE-2024-6604 – Mozilla: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13
https://notcve.org/view.php?id=CVE-2024-6604
09 Jul 2024 — Memory safety bugs present in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 128 and Firefox ESR < 115.13. Memory safety bugs present in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these coul... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1748105%2C1837550%2C1884266 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.4EPSS: 0%CPEs: 35EXPL: 0CVE-2024-6603 – Mozilla: Memory corruption in thread creation
https://notcve.org/view.php?id=CVE-2024-6603
09 Jul 2024 — In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption. This vulnerability affects Firefox < 128 and Firefox ESR < 115.13. In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128. The Mozilla Foundation Security Advisory describes t... • https://bugzilla.mozilla.org/show_bug.cgi?id=1895081 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-823: Use of Out-of-range Pointer Offset •
CVSS: 9.8EPSS: 0%CPEs: 28EXPL: 0CVE-2024-6602 – Mozilla: Memory corruption in NSS
https://notcve.org/view.php?id=CVE-2024-6602
09 Jul 2024 — A mismatch between allocator and deallocator could have lead to memory corruption. This vulnerability affects Firefox < 128 and Firefox ESR < 115.13. Una falta de coincidencia entre el asignador y el desasignador podría haber provocado daños en la memoria. Esta vulnerabilidad afecta a Firefox < 128 y Firefox ESR < 115.13. A mismatch between allocator and deallocator could have led to memory corruption. • https://bugzilla.mozilla.org/show_bug.cgi?id=1895032 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.4EPSS: 0%CPEs: 35EXPL: 0CVE-2024-6601 – Mozilla: Race condition in permission assignment
https://notcve.org/view.php?id=CVE-2024-6601
09 Jul 2024 — A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox < 128 and Firefox ESR < 115.13. A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128. The Mozilla Foundation Security Advisory describes this flaw as: A race condition could lead to a cross-origin container obtaining... • https://bugzilla.mozilla.org/show_bug.cgi?id=1890748 • CWE-281: Improper Preservation of Permissions CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 7.5EPSS: 0%CPEs: 18EXPL: 0CVE-2024-6600
https://notcve.org/view.php?id=CVE-2024-6600
09 Jul 2024 — Due to large allocation checks in Angle for GLSL shaders being too lenient an out-of-bounds access could occur when allocating more than 8192 ints in private shader memory on mac OS. This vulnerability affects Firefox < 128 and Firefox ESR < 115.13. Due to large allocation checks in Angle for GLSL shaders being too lenient an out-of-bounds access could occur when allocating more than 8192 ints in private shader memory on mac OS. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 1... • https://bugzilla.mozilla.org/show_bug.cgi?id=1888340 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-39894
https://notcve.org/view.php?id=CVE-2024-39894
02 Jul 2024 — OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur. OpenSSH 9.5 a 9.7 anterior a 9.8 a veces permite ataques de sincronización contra la entrada de contraseña sin eco (por ejemplo, para su y Sudo) debido a un error lógico de ObscureKeystrokeTiming. De manera similar, podrían ocurrir otros ataques de sincronización contra... • http://www.openwall.com/lists/oss-security/2024/07/03/6 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2024-32230
https://notcve.org/view.php?id=CVE-2024-32230
01 Jul 2024 — FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0 FFmpeg 7.0 es vulnerable al desbordamiento del búfer. Hay un error de parámetro de tamaño negativo en libavcodec/mpegvideo_enc.c:1216:21 en load_input_picture en FFmpeg7.0 • https://trac.ffmpeg.org/ticket/10952 •
CVSS: 7.2EPSS: 0%CPEs: 9EXPL: 0CVE-2024-38394
https://notcve.org/view.php?id=CVE-2024-38394
15 Jun 2024 — Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic allow a physically proximate attacker to access some unintended Linux kernel USB functionality, such as USB device-specific kernel modules and filesystem implementations. NOTE: the GSD supplier indicates that consideration of a mitigation for this within GSD would be in the context of "a new feature, not a CVE." Las discrepancias en la interpretación de... • https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/issues/780 •