CVSS: 4.3EPSS: 1%CPEs: 5EXPL: 0CVE-2018-5172 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5172
12 May 2018 — The Live Bookmarks page and the PDF viewer can run injected script content if a user pastes script from the clipboard into them while viewing RSS feeds or PDF files. This could allow a malicious site to socially engineer a user to copy and paste malicious script content that could then run with the context of either page but does not allow for privilege escalation. This vulnerability affects Firefox < 60. La página Live Bookmarks y el visor de PDF pueden ejecutar contenido de scripts inyectados si un usuari... • http://www.securityfocus.com/bid/104139 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5177 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5177
12 May 2018 — A vulnerability exists in XSLT during number formatting where a negative buffer size may be allocated in some instances, leading to a buffer overflow and crash if it occurs. This vulnerability affects Firefox < 60. Existe una vulnerabilidad en XSLT durante el formateo de números en la que se puede asignar un tamaño de búfer negativo en algunos casos, lo que provoca un desbordamiento de búfer y un cierre inesperado si ocurre. Esta vulnerabilidad afecta a las versiones anteriores a la 60 de Firefox. USN-3645-... • http://www.securityfocus.com/bid/104139 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5169 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5169
12 May 2018 — If manipulated hyperlinked text with "chrome:" URL contained in it is dragged and dropped on the "home" icon, the home page can be reset to include a normally-unlinkable chrome page as one of the home page tabs. This vulnerability affects Firefox < 60. Si se manipula el texto hipervinculado que contiene una URL "chrome:" y se arrastra y suelta en el icono "home", la página de inicio se puede restablecer para incluir una página chrome que normalmente no es enlazable como una de las pestañas de la página de i... • http://www.securityfocus.com/bid/104139 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5152 – Ubuntu Security Notice USN-3645-1
https://notcve.org/view.php?id=CVE-2018-5152
12 May 2018 — WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the "webRequest" API. For example, this allows for the interception of username and an encrypted password during login to Firefox Accounts. This issue does not expose synchronization traffic directly and is limited to the process of user login to the website and the data displayed to the user once logged in. This vulnerability affects Firef... • http://www.securityfocus.com/bid/104139 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 5.3EPSS: 1%CPEs: 5EXPL: 0CVE-2018-5173 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5173
12 May 2018 — The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed. This can be used to obscure the file extension of potentially executable files from user view in the panel. Note: the dialog to open the file will show the full, correct filename and whether it is executable or not. This vulnerability affects Firefox < 60. El nombre de archivo que aparece en el panel "Descargas" reproduce incorrectamente algunos caracteres Unicode, lo que per... • http://www.securityfocus.com/bid/104139 • CWE-20: Improper Input Validation •
CVSS: 8.1EPSS: 3%CPEs: 5EXPL: 0CVE-2018-5163 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5163
12 May 2018 — If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able to replace the alternate data resources stored in the JavaScript Start-up Bytecode Cache (JSBC) for other JavaScript code. If the parent process then runs this replaced code, the executed script would be run with the parent process' privileges, escaping the sandbox on content processes. This vulnerability affects Firefox < 60. Si un atacante malicioso ha utilizado otra vulnerabilidad para obt... • http://www.securityfocus.com/bid/104139 • CWE-281: Improper Preservation of Permissions •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5167 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5167
12 May 2018 — The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display "javascript:" links, which users could be tricked into clicking by malicious sites. This vulnerability affects Firefox < 60. • http://www.securityfocus.com/bid/104139 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 6%CPEs: 5EXPL: 0CVE-2018-5151 – Ubuntu Security Notice USN-3645-1
https://notcve.org/view.php?id=CVE-2018-5151
12 May 2018 — Memory safety bugs were reported in Firefox 59. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 60. Se ha informado sobre errores de seguridad de memoria en Firefox 59. Algunos de estos errores mostraron evidencias de corrupción de memoria y se cree que, con el esfuerzo necesario, se podrían explotar para ejecutar código arbitrario. • http://www.securityfocus.com/bid/104139 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 1CVE-2018-5181 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5181
12 May 2018 — If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child process the tab will open a local file corresponding to the dropped URL, contrary to policy. One way to make the target tab open more reliably in a separate process is to open it with the "noopener" keyword. This vulnerability affects Firefox < 60. Si una URL que utiliza el protocolo "file:" es arrastrada y soltada en una pestaña abierta que se está ejecutando en un proceso hijo diferente, la pes... • http://www.securityfocus.com/bid/104139 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 3%CPEs: 21EXPL: 0CVE-2018-5155 – Mozilla: Use-after-free with SVG animations and text paths
https://notcve.org/view.php?id=CVE-2018-5155
11 May 2018 — A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8. Puede ocurrir una vulnerabilidad de uso de memoria previamente liberada cuando se ajusta la disposición durante las animaciones SVG con rutas de texto. Esto resulta en un cierre inesperado explotable. • http://www.securityfocus.com/bid/104136 • CWE-416: Use After Free •