CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5175 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5175
12 May 2018 — A mechanism to bypass Content Security Policy (CSP) protections on sites that have a "script-src" policy of "'strict-dynamic'". If a target website contains an HTML injection flaw an attacker could inject a reference to a copy of the "require.js" library that is part of Firefox's Developer Tools, and then use a known technique using that library to bypass the CSP restrictions on executing injected scripts. This vulnerability affects Firefox < 60. Un mecanismo para omitir las protecciones de la Política de S... • http://www.securityfocus.com/bid/104139 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5176 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5176
12 May 2018 — The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links. If a JSON file contains malicious JavaScript script embedded as "javascript:" links, users may be tricked into clicking and running this code in the context of the JSON Viewer. This can allow for the theft of cookies and authorization tokens which are accessible to that context. This vulnerability affects Firefox < 60. JSON Viewer muestra hipervínculos que se pueden hacer clic en ellos para c... • http://www.securityfocus.com/bid/104139 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5177 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5177
12 May 2018 — A vulnerability exists in XSLT during number formatting where a negative buffer size may be allocated in some instances, leading to a buffer overflow and crash if it occurs. This vulnerability affects Firefox < 60. Existe una vulnerabilidad en XSLT durante el formateo de números en la que se puede asignar un tamaño de búfer negativo en algunos casos, lo que provoca un desbordamiento de búfer y un cierre inesperado si ocurre. Esta vulnerabilidad afecta a las versiones anteriores a la 60 de Firefox. USN-3645-... • http://www.securityfocus.com/bid/104139 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 4%CPEs: 5EXPL: 0CVE-2018-5180 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5180
12 May 2018 — A use-after-free vulnerability can occur during WebGL operations. While this results in a potentially exploitable crash, the vulnerability is limited because the memory is freed and reused in a brief window of time during the freeing of the same callstack. This vulnerability affects Firefox < 60. Puede ocurrir una vulnerabilidad de uso de memoria previamente liberada durante las operaciones WebGL. Aunque esto resulta en una caída potencialmente explotable, la vulnerabilidad es limitada porque la memoria se ... • http://www.securityfocus.com/bid/104139 • CWE-416: Use After Free •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 1CVE-2018-5181 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5181
12 May 2018 — If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child process the tab will open a local file corresponding to the dropped URL, contrary to policy. One way to make the target tab open more reliably in a separate process is to open it with the "noopener" keyword. This vulnerability affects Firefox < 60. Si una URL que utiliza el protocolo "file:" es arrastrada y soltada en una pestaña abierta que se está ejecutando en un proceso hijo diferente, la pes... • http://www.securityfocus.com/bid/104139 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-5182 – Ubuntu Security Notice USN-3645-2
https://notcve.org/view.php?id=CVE-2018-5182
12 May 2018 — If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specified local file will be opened. This is contrary to policy and is what would happen if the string were the equivalent "file:" URL. This vulnerability affects Firefox < 60. Si se arrastra una cadena de texto que resulta ser un nombre de archivo en el formato nativo del sistema operativo y se suelta en la barra de direcciones, se abrirá el archivo local especificado. Esto ... • http://www.securityfocus.com/bid/104139 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5152 – Ubuntu Security Notice USN-3645-1
https://notcve.org/view.php?id=CVE-2018-5152
12 May 2018 — WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the "webRequest" API. For example, this allows for the interception of username and an encrypted password during login to Firefox Accounts. This issue does not expose synchronization traffic directly and is limited to the process of user login to the website and the data displayed to the user once logged in. This vulnerability affects Firef... • http://www.securityfocus.com/bid/104139 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 9.8EPSS: 3%CPEs: 21EXPL: 0CVE-2018-5150 – Mozilla: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8
https://notcve.org/view.php?id=CVE-2018-5150
11 May 2018 — Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8. Se han informado de errores de seguridad de memoria en Firefox 55, Firefox ESR 52.7 y Thunderbird 52.7. Algunos de estos errores mostraron evidencias de corrup... • http://www.securityfocus.com/bid/104136 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.8EPSS: 3%CPEs: 21EXPL: 0CVE-2018-5154 – Mozilla: Use-after-free with SVG animations and clip paths
https://notcve.org/view.php?id=CVE-2018-5154
11 May 2018 — A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8. Puede ocurrir una vulnerabilidad de uso de memoria previamente liberada cuando se enumeran atributos durante las animaciones SVG con las rutas de clips. Esto resulta en un cierre inesperado explotable. • http://www.securityfocus.com/bid/104136 • CWE-416: Use After Free •
CVSS: 9.8EPSS: 3%CPEs: 21EXPL: 0CVE-2018-5155 – Mozilla: Use-after-free with SVG animations and text paths
https://notcve.org/view.php?id=CVE-2018-5155
11 May 2018 — A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8. Puede ocurrir una vulnerabilidad de uso de memoria previamente liberada cuando se ajusta la disposición durante las animaciones SVG con rutas de texto. Esto resulta en un cierre inesperado explotable. • http://www.securityfocus.com/bid/104136 • CWE-416: Use After Free •