CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5164 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5164
12 May 2018 — Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the "multipart/x-mixed-replace" MIME type. This could allow for script to run where CSP should block it, allowing for cross-site scripting (XSS) and other attacks. This vulnerability affects Firefox < 60. La política de seguridad de contenidos (CSP) no se aplica correctamente a todas las partes del contenido multiparte enviado con el tipo MIME "multipart/x-mixed-replace". Esto podría permitir que el script se ... • http://www.securityfocus.com/bid/104139 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5176 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5176
12 May 2018 — The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links. If a JSON file contains malicious JavaScript script embedded as "javascript:" links, users may be tricked into clicking and running this code in the context of the JSON Viewer. This can allow for the theft of cookies and authorization tokens which are accessible to that context. This vulnerability affects Firefox < 60. JSON Viewer muestra hipervínculos que se pueden hacer clic en ellos para c... • http://www.securityfocus.com/bid/104139 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5182 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5182
12 May 2018 — If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specified local file will be opened. This is contrary to policy and is what would happen if the string were the equivalent "file:" URL. This vulnerability affects Firefox < 60. Si se arrastra una cadena de texto que resulta ser un nombre de archivo en el formato nativo del sistema operativo y se suelta en la barra de direcciones, se abrirá el archivo local especificado. Esto ... • http://www.securityfocus.com/bid/104139 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 1CVE-2018-5181 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5181
12 May 2018 — If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child process the tab will open a local file corresponding to the dropped URL, contrary to policy. One way to make the target tab open more reliably in a separate process is to open it with the "noopener" keyword. This vulnerability affects Firefox < 60. Si una URL que utiliza el protocolo "file:" es arrastrada y soltada en una pestaña abierta que se está ejecutando en un proceso hijo diferente, la pes... • http://www.securityfocus.com/bid/104139 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5167 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5167
12 May 2018 — The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display "javascript:" links, which users could be tricked into clicking by malicious sites. This vulnerability affects Firefox < 60. • http://www.securityfocus.com/bid/104139 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-5177 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5177
12 May 2018 — A vulnerability exists in XSLT during number formatting where a negative buffer size may be allocated in some instances, leading to a buffer overflow and crash if it occurs. This vulnerability affects Firefox < 60. Existe una vulnerabilidad en XSLT durante el formateo de números en la que se puede asignar un tamaño de búfer negativo en algunos casos, lo que provoca un desbordamiento de búfer y un cierre inesperado si ocurre. Esta vulnerabilidad afecta a las versiones anteriores a la 60 de Firefox. USN-3645-... • http://www.securityfocus.com/bid/104139 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5163 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5163
12 May 2018 — If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able to replace the alternate data resources stored in the JavaScript Start-up Bytecode Cache (JSBC) for other JavaScript code. If the parent process then runs this replaced code, the executed script would be run with the parent process' privileges, escaping the sandbox on content processes. This vulnerability affects Firefox < 60. Si un atacante malicioso ha utilizado otra vulnerabilidad para obt... • http://www.securityfocus.com/bid/104139 • CWE-281: Improper Preservation of Permissions •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5169 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5169
12 May 2018 — If manipulated hyperlinked text with "chrome:" URL contained in it is dragged and dropped on the "home" icon, the home page can be reset to include a normally-unlinkable chrome page as one of the home page tabs. This vulnerability affects Firefox < 60. Si se manipula el texto hipervinculado que contiene una URL "chrome:" y se arrastra y suelta en el icono "home", la página de inicio se puede restablecer para incluir una página chrome que normalmente no es enlazable como una de las pestañas de la página de i... • http://www.securityfocus.com/bid/104139 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5172 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5172
12 May 2018 — The Live Bookmarks page and the PDF viewer can run injected script content if a user pastes script from the clipboard into them while viewing RSS feeds or PDF files. This could allow a malicious site to socially engineer a user to copy and paste malicious script content that could then run with the context of either page but does not allow for privilege escalation. This vulnerability affects Firefox < 60. La página Live Bookmarks y el visor de PDF pueden ejecutar contenido de scripts inyectados si un usuari... • http://www.securityfocus.com/bid/104139 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5180 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5180
12 May 2018 — A use-after-free vulnerability can occur during WebGL operations. While this results in a potentially exploitable crash, the vulnerability is limited because the memory is freed and reused in a brief window of time during the freeing of the same callstack. This vulnerability affects Firefox < 60. Puede ocurrir una vulnerabilidad de uso de memoria previamente liberada durante las operaciones WebGL. Aunque esto resulta en una caída potencialmente explotable, la vulnerabilidad es limitada porque la memoria se ... • http://www.securityfocus.com/bid/104139 • CWE-416: Use After Free •