CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-38497 – Mozilla: Validation message could have been overlaid on another origin
https://notcve.org/view.php?id=CVE-2021-38497
Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to possible user confusion and spoofing attacks. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2. Mediante el uso de las funciones reportValidity() y window.open(), un mensaje de comprobación de texto plano podría haberse superpuesto a otro origen, conllevando una posible confusión del usuario y ataques de suplantación. Esta vulnerabilidad afecta a Firefox versiones anteriores a 93, Thunderbird versiones anteriores a 91.2 y Firefox ESR versiones anteriores a 91.2 • https://bugzilla.mozilla.org/show_bug.cgi?id=1726621 https://www.mozilla.org/security/advisories/mfsa2021-43 https://www.mozilla.org/security/advisories/mfsa2021-45 https://www.mozilla.org/security/advisories/mfsa2021-47 https://access.redhat.com/security/cve/CVE-2021-38497 https://bugzilla.redhat.com/show_bug.cgi?id=2011098 • CWE-346: Origin Validation Error CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-38498 – Mozilla: Use-after-free of nsLanguageAtomService object
https://notcve.org/view.php?id=CVE-2021-38498
During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2. Durante el cierre del proceso, un documento podría haber causado un uso de memoria previamente liberada de un objeto de servicio de idiomas, conllevando a una corrupción de memoria y un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Firefox versiones anteriores a 93, Thunderbird versiones anteriores a 91.2 y Firefox ESR versiones anteriores a 91.2 • https://bugzilla.mozilla.org/show_bug.cgi?id=1729642 https://www.mozilla.org/security/advisories/mfsa2021-43 https://www.mozilla.org/security/advisories/mfsa2021-45 https://www.mozilla.org/security/advisories/mfsa2021-47 https://access.redhat.com/security/cve/CVE-2021-38498 https://bugzilla.redhat.com/show_bug.cgi?id=2011099 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2021-38500 – Mozilla: Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15, and Firefox ESR 91.2
https://notcve.org/view.php?id=CVE-2021-38500
Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.15, Thunderbird < 91.2, Firefox ESR < 91.2, Firefox ESR < 78.15, and Firefox < 93. Los desarrolladores de Mozilla informaron de bugs de seguridad de memoria presentes en Firefox 92 y Firefox ESR 91.1. Algunos de estos bugs mostraban evidencias de corrupción de memoria y suponemos que con suficiente esfuerzo algunos de ellos podrían haber sido explotados para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1725854%2C1728321 https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html https://www.debian.org/security/2022/dsa-5034 https://www.mozilla.org/security/advisories/mfsa2021-43 https://www.mozilla.org/security/advisories/mfsa2021-44 https://www.mozilla.org/security/advisories/mfsa2021-45 https://www.mozilla.org/security/advisories/mfsa2021-46 https://www.mozilla.org/security/advisories/mfsa2021-47 https://access.redhat.com/security& • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-38501 – Mozilla: Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2
https://notcve.org/view.php?id=CVE-2021-38501
Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2. Los desarrolladores de Mozilla informaron de bugs de seguridad de memoria presentes en Firefox 92 y Firefox ESR 91.1. Algunos de estos bugs mostraban evidencias de corrupción de memoria y suponemos que con suficiente esfuerzo algunos de ellos podrían haber sido explotados para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1685354%2C1715755%2C1723176 https://www.mozilla.org/security/advisories/mfsa2021-43 https://www.mozilla.org/security/advisories/mfsa2021-45 https://www.mozilla.org/security/advisories/mfsa2021-47 https://access.redhat.com/security/cve/CVE-2021-38501 https://bugzilla.redhat.com/show_bug.cgi?id=2011101 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-38499
https://notcve.org/view.php?id=CVE-2021-38499
Mozilla developers reported memory safety bugs present in Firefox 92. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 93. Los desarrolladores de Mozilla informaron de bugs de seguridad de memoria presentes en Firefox versión 92. Algunos de estos bugs mostraban evidencias de corrupción de memoria y suponemos que con suficiente esfuerzo algunos de ellos podrían haber sido explotados para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1667102%2C1723170%2C1725356%2C1727364 https://www.mozilla.org/security/advisories/mfsa2021-43 • CWE-787: Out-of-bounds Write •