CVE-2019-9796 – Mozilla: Use-after-free with SMIL animation controller
https://notcve.org/view.php?id=CVE-2019-9796
A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a single registration is expected. When a registration is later freed with the removal of the animation controller element, the refresh driver incorrectly leaves a dangling pointer to the driver's observer array. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66. Una vulnerabilidad de uso después de liberación de memoria puede darse cuando el controlador de animación SMIL registra incorrectamente con el controlador de actualización dos veces cuando sólo se espera un único registro. Cuando se libera un registro con la eliminación del elemento de controlador de animación, el controlador de actualización deja incorrectamente un puntero pendiente en la matriz de observadores del controlador. • https://access.redhat.com/errata/RHSA-2019:0966 https://access.redhat.com/errata/RHSA-2019:1144 https://bugzilla.mozilla.org/show_bug.cgi?id=1531277 https://www.mozilla.org/security/advisories/mfsa2019-07 https://www.mozilla.org/security/advisories/mfsa2019-08 https://www.mozilla.org/security/advisories/mfsa2019-11 https://access.redhat.com/security/cve/CVE-2019-9796 https://bugzilla.redhat.com/show_bug.cgi?id=1690681 • CWE-416: Use After Free •
CVE-2018-18499 – Mozilla: Same-origin policy violation using meta refresh and performance.getEntries to steal cross-origin URLs
https://notcve.org/view.php?id=CVE-2018-18499
A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1. Una violación de una política del mismo origen permite el robo de entradas URL Cross-Origin cuando utiliza meta http-equiv="refresh" en una página para provocar un redireccionamiento a otro sitio utilizando performance.getEntries(). Esta es una violación de la política del mismo origen y podría permitir el robo de datos. • https://bugzilla.mozilla.org/show_bug.cgi?id=1468523 https://www.mozilla.org/security/advisories/mfsa2018-20 https://www.mozilla.org/security/advisories/mfsa2018-21 https://www.mozilla.org/security/advisories/mfsa2018-25 https://access.redhat.com/security/cve/CVE-2018-18499 https://bugzilla.redhat.com/show_bug.cgi?id=1849971 • CWE-346: Origin Validation Error CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVE-2018-18509 – thunderbird: flaw in verification of S/MIME signature resulting in signature spoofing
https://notcve.org/view.php?id=CVE-2018-18509
A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. This vulnerability affects Thunderbird < 60.5.1. Un fallo durante la comprobación de ciertas firmas S/MIME produce correos electrónicos que se mostrarán en Thunderbird con una firma digital válida, incluso si el contenido del mensaje mostrado no está cubierto por la firma. El fallo le permite a un atacante reutilizar una firma S/MIME válida para poder elaborar un mensaje de correo electrónico con contenido arbitrario. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00043.html http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html http://seclists.org/fulldisclosure/2019/Apr/38 http://www.openwall.com/lists/oss-security/2019/04/30/4 https://access.redhat.com/errata/RHSA-2019:1144 https://bugzilla.mozilla.org/show_bug.cgi?id=1507218 https://github.com/RUB-NDS/Johnny-You-Are-Fired https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.p • CWE-347: Improper Verification of Cryptographic Signature •
CVE-2018-18505 – Mozilla: Privilege escalation through IPC channel messages
https://notcve.org/view.php?id=CVE-2018-18505
An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server parents during IPC process creation. This authentication is insufficient for channels created after the IPC process is started, leading to the authentication not being correctly applied to later channels. This could allow for a sandbox escape through IPC channels due to lack of message validation in the listener process. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65. Una solución anterior para la vulnerabilidad de comunicación entre procesos (IPC), CVE-2011-3079, añadía una autenticación para comunicaciones entre endpoints de IPC y servidores padres durante la creación de procesos IPC. • http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html http://www.securityfocus.com/bid/106781 https://access.redhat.com/errata/RHSA-2019:0218 https://access.redhat.com/errata/RHSA-2019:0219 https://access.redhat.com/errata/RHSA-2019:0269 https://access.redhat.com/errata/RHSA-2019:0270 https://bugzilla.mozilla.org/show_bug.cgi?id=1087565 https://lists.debian.org/debian-lts-announce/2019/01/msg00025.html https://lists.debian.org/debian-lts-announce/2019/02 • CWE-287: Improper Authentication •
CVE-2018-18500 – Mozilla: Use-after-free parsing HTML5 stream
https://notcve.org/view.php?id=CVE-2018-18500
A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream parser object being freed while still in use, leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65. Una vulnerabilidad de memoria previamente liberada puede ocurrir a la hora de analizar una transmisión HTML5 junto con elementos HTML personalizados. Esto resulta en la liberación del objeto de análisis de transmisión mientras está en uso, conduciendo potencialmente a un cierre inesperado explotable. • https://github.com/sophoslabs/CVE-2018-18500 http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html http://www.securityfocus.com/bid/106781 https://access.redhat.com/errata/RHSA-2019:0218 https://access.redhat.com/errata/RHSA-2019:0219 https://access.redhat.com/errata/RHSA-2019:0269 https://access.redhat.com/errata/RHSA-2019:0270 https://lists.debian.org/debian-lts-announce/2019/01/msg00025.html https://lists.debian.org/debian-lts-announce/2019/02/msg00024 • CWE-416: Use After Free •