CVSS: 6.1EPSS: 0%CPEs: 17EXPL: 1CVE-2018-18397 – kernel: userfaultfd bypasses tmpfs file permissions
https://notcve.org/view.php?id=CVE-2018-18397
The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c. La implementación de userfaultfd en el kernel de Linux en versiones anteriores a la 4.17 gestiona de manera incorrecta para ciertas llamadas ioctl UFFDIO_, tal y como queda demostrado al permitir que usuarios locales escriban datos en huecos en un archivo tmpfs (si el usuario tiene acceso de solo lectura a dicho archivo que contiene huecos). Esto está relacionado con fs/userfaultfd.c y mm/userfaultfd.c. A flaw was found in the Linux kernel with files on tmpfs and hugetlbfs. An attacker is able to bypass file permissions on filesystems mounted with tmpfs/hugetlbs to modify a file and possibly disrupt normal system behavior. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=29ec90660d68bbdd69507c1c8b4e33aa299278b1 https://access.redhat.com/errata/RHBA-2019:0327 https://access.redhat.com/errata/RHSA-2019:0163 https://access.redhat.com/errata/RHSA-2019:0202 https://access.redhat.com/errata/RHSA-2019:0324 https://access.redhat.com/errata/RHSA-2019:0831 https://bugs.chromium.org/p/project-zero/issues/detail?id=1700 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.87& • CWE-20: Improper Input Validation CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-18497
https://notcve.org/view.php?id=CVE-2018-18497
Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to open privileged about: or file: locations. This vulnerability affects Firefox < 64. La API browser.windows.create permitía que las WebExtensions omitiesen las limitaciones en las URI cuando una tubería (pipe) en el campo URL se utiliza con la extensión para cargar múltiples páginas como un solo argumento. Esto podría permitir que un WebExtension malicioso abra las ubicaciones privilegiadas about: o file:. • http://www.securityfocus.com/bid/106167 https://bugzilla.mozilla.org/show_bug.cgi?id=1488180 https://usn.ubuntu.com/3844-1 https://www.mozilla.org/security/advisories/mfsa2018-29 •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2018-12407
https://notcve.org/view.php?id=CVE-2018-12407
A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, when working with the VertexBuffer11 module. This results in a potentially exploitable crash. This vulnerability affects Firefox < 64. Ocurre un desbordamiento de búfer cuando se dibujan y validan elementos con la librería de gráficos ANGLE, utilizado para contenidos WebGL, al utilizar el módulo VertexBuffer11. Esto resulta en un cierre inesperado potencialmente explotable. • http://www.securityfocus.com/bid/106167 https://bugzilla.mozilla.org/show_bug.cgi?id=1505973 https://usn.ubuntu.com/3844-1 https://www.mozilla.org/security/advisories/mfsa2018-29 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 18EXPL: 0CVE-2018-18498 – Mozilla: Integer overflow when calculating buffer sizes for images
https://notcve.org/view.php?id=CVE-2018-18498
A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value. This leads to a possible out-of-bounds write. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64. Puede ocurrir una vulnerabilidad potencial que conduce a un desbordamiento de enteros durante los cálculos de tamaño de búfer cuando se emplea un valor bruto en vez del valor comprobado. Esto conduce a una escritura fuera de límites. • http://www.securityfocus.com/bid/106168 https://access.redhat.com/errata/RHSA-2018:3831 https://access.redhat.com/errata/RHSA-2018:3833 https://access.redhat.com/errata/RHSA-2019:0159 https://access.redhat.com/errata/RHSA-2019:0160 https://bugzilla.mozilla.org/show_bug.cgi?id=1500011 https://lists.debian.org/debian-lts-announce/2018/12/msg00002.html https://security.gentoo.org/glsa/201903-04 https://usn.ubuntu.com/3844-1 https://usn.ubuntu.com/3868-1 https:/&# • CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 18EXPL: 0CVE-2018-18492 – Mozilla: Use-after-free with select element
https://notcve.org/view.php?id=CVE-2018-18492
A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64. Puede ocurrir una vulnerabilidad de uso de memoria previamente liberada tras el borrado de un elemento de selección debido a una referencia débil a dicho elemento en la colección de opciones. Esto resulta en un cierre inesperado potencialmente explotable. • http://www.securityfocus.com/bid/106168 https://access.redhat.com/errata/RHSA-2018:3831 https://access.redhat.com/errata/RHSA-2018:3833 https://access.redhat.com/errata/RHSA-2019:0159 https://access.redhat.com/errata/RHSA-2019:0160 https://bugzilla.mozilla.org/show_bug.cgi?id=1499861 https://lists.debian.org/debian-lts-announce/2018/12/msg00002.html https://security.gentoo.org/glsa/201903-04 https://usn.ubuntu.com/3844-1 https://usn.ubuntu.com/3868-1 https:/&# • CWE-416: Use After Free •