CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5180 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5180
12 May 2018 — A use-after-free vulnerability can occur during WebGL operations. While this results in a potentially exploitable crash, the vulnerability is limited because the memory is freed and reused in a brief window of time during the freeing of the same callstack. This vulnerability affects Firefox < 60. Puede ocurrir una vulnerabilidad de uso de memoria previamente liberada durante las operaciones WebGL. Aunque esto resulta en una caída potencialmente explotable, la vulnerabilidad es limitada porque la memoria se ... • http://www.securityfocus.com/bid/104139 • CWE-416: Use After Free •
CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5163 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5163
12 May 2018 — If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able to replace the alternate data resources stored in the JavaScript Start-up Bytecode Cache (JSBC) for other JavaScript code. If the parent process then runs this replaced code, the executed script would be run with the parent process' privileges, escaping the sandbox on content processes. This vulnerability affects Firefox < 60. Si un atacante malicioso ha utilizado otra vulnerabilidad para obt... • http://www.securityfocus.com/bid/104139 • CWE-281: Improper Preservation of Permissions •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5164 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5164
12 May 2018 — Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the "multipart/x-mixed-replace" MIME type. This could allow for script to run where CSP should block it, allowing for cross-site scripting (XSS) and other attacks. This vulnerability affects Firefox < 60. La política de seguridad de contenidos (CSP) no se aplica correctamente a todas las partes del contenido multiparte enviado con el tipo MIME "multipart/x-mixed-replace". Esto podría permitir que el script se ... • http://www.securityfocus.com/bid/104139 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5182 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5182
12 May 2018 — If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specified local file will be opened. This is contrary to policy and is what would happen if the string were the equivalent "file:" URL. This vulnerability affects Firefox < 60. Si se arrastra una cadena de texto que resulta ser un nombre de archivo en el formato nativo del sistema operativo y se suelta en la barra de direcciones, se abrirá el archivo local especificado. Esto ... • http://www.securityfocus.com/bid/104139 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 32%CPEs: 21EXPL: 2CVE-2018-5159 – Skia and Firefox - Integer Overflow in SkTDArray Leading to Out-of-Bounds Write
https://notcve.org/view.php?id=CVE-2018-5159
11 May 2018 — An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-bounds writes. This could lead to a potentially exploitable crash triggerable by web content. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8. Puede ocurrir un desbordamiento de enteros en la biblioteca Skia debido al uso de números enteros de 32 bits en un array sin verificaciones de desbordamiento d... • https://packetstorm.news/files/id/147843 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 21EXPL: 0CVE-2018-5150 – Mozilla: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8
https://notcve.org/view.php?id=CVE-2018-5150
11 May 2018 — Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8. Se han informado de errores de seguridad de memoria en Firefox 55, Firefox ESR 52.7 y Thunderbird 52.7. Algunos de estos errores mostraron evidencias de corrup... • http://www.securityfocus.com/bid/104136 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.5EPSS: 0%CPEs: 19EXPL: 0CVE-2018-5157 – Mozilla: Same-origin bypass of PDF Viewer to view protected PDF files
https://notcve.org/view.php?id=CVE-2018-5157
11 May 2018 — Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer. This could allow the site to retrieve PDF files restricted to viewing by an authenticated user on a third-party website. This vulnerability affects Firefox ESR < 52.8 and Firefox < 60. Las protecciones del mismo origen para el visor de PDF pueden omitirse, lo que permite que un sitio malicioso intercepte los mensajes destinados al visor. Esto podría permitir que el sitio recupere... • http://www.securityfocus.com/bid/104136 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-346: Origin Validation Error CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 9.8EPSS: 0%CPEs: 21EXPL: 0CVE-2018-5154 – Mozilla: Use-after-free with SVG animations and clip paths
https://notcve.org/view.php?id=CVE-2018-5154
11 May 2018 — A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8. Puede ocurrir una vulnerabilidad de uso de memoria previamente liberada cuando se enumeran atributos durante las animaciones SVG con las rutas de clips. Esto resulta en un cierre inesperado explotable. • http://www.securityfocus.com/bid/104136 • CWE-416: Use After Free •
CVSS: 9.8EPSS: 0%CPEs: 21EXPL: 0CVE-2018-5155 – Mozilla: Use-after-free with SVG animations and text paths
https://notcve.org/view.php?id=CVE-2018-5155
11 May 2018 — A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8. Puede ocurrir una vulnerabilidad de uso de memoria previamente liberada cuando se ajusta la disposición durante las animaciones SVG con rutas de texto. Esto resulta en un cierre inesperado explotable. • http://www.securityfocus.com/bid/104136 • CWE-416: Use After Free •
CVSS: 6.1EPSS: 0%CPEs: 21EXPL: 0CVE-2018-5168 – Mozilla: Lightweight themes can be installed without user interaction
https://notcve.org/view.php?id=CVE-2018-5168
11 May 2018 — Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element. This could allow a malicious site to install a theme without user interaction which could contain offensive or embarrassing images. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8. Los sitios pueden omitir las comprobaciones de seguridad de los permisos para instalar temas ligeros manipulando la propiedad "baseU... • http://www.securityfocus.com/bid/104136 • CWE-862: Missing Authorization •