CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-5113 – Ubuntu Security Notice USN-3544-1
https://notcve.org/view.php?id=CVE-2018-5113
25 Jan 2018 — The "browser.identity.launchWebAuthFlow" function of WebExtensions is only allowed to load content over "https:" but this requirement was not properly enforced. This can potentially allow privileged pages to be loaded by the extension. This vulnerability affects Firefox < 58. La función "browser.identity.launchWebAuthFlow" de WebExtensions solo tiene permitido cargar contenido sobre "https:" pero este requisito no se cumplió correctamente. Esto puede permitir que las páginas privilegiadas se carguen mediant... • http://www.securityfocus.com/bid/102786 • CWE-862: Missing Authorization •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2018-5114 – Ubuntu Security Notice USN-3544-1
https://notcve.org/view.php?id=CVE-2018-5114
25 Jan 2018 — If an existing cookie is changed to be "HttpOnly" while a document is open, the original value remains accessible through script until that document is closed. Network requests correctly use the changed HttpOnly cookie. This vulnerability affects Firefox < 58. Si una cookie existente se cambia a "HttpOnly" mientras un documento está abierto, el valor original permanece accesible a través del script hasta que el documento se cierra. Las peticiones de red utilizan correctamente la cookie modificada con el atr... • http://www.securityfocus.com/bid/102786 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-5092 – Ubuntu Security Notice USN-3544-1
https://notcve.org/view.php?id=CVE-2018-5092
25 Jan 2018 — A use-after-free vulnerability can occur when the thread for a Web Worker is freed from memory prematurely instead of from memory in the main thread while cancelling fetch operations. This vulnerability affects Firefox < 58. Puede ocurrir una vulnerabilidad de uso de memoria previamente liberada cuando el hilo para un Web Worker se libera de la memoria prematuramente en vez de la memoria en el hilo principal cuando se cancelan las operaciones fetch. Esta vulnerabilidad afecta a las versiones anteriores a la... • http://www.securityfocus.com/bid/102786 • CWE-416: Use After Free •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2018-5109 – Ubuntu Security Notice USN-3544-1
https://notcve.org/view.php?id=CVE-2018-5109
25 Jan 2018 — An audio capture session can started under an incorrect origin from the site making the capture request. Users are still prompted to allow the request but the prompt can display the wrong origin, leading to user confusion about which site is making the request to capture an audio stream. This vulnerability affects Firefox < 58. Se puede iniciar una sesión de captura de audio bajo un origen incorrecto desde el sitio enviando una petición de captura. Se les pedirán a los usuarios que permitan la petición pero... • http://www.securityfocus.com/bid/102786 • CWE-346: Origin Validation Error •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-5111 – Ubuntu Security Notice USN-3544-1
https://notcve.org/view.php?id=CVE-2018-5111
25 Jan 2018 — When the text of a specially formatted URL is dragged to the addressbar from page content, the displayed URL can be spoofed to show a different site than the one loaded. This allows for phishing attacks where a malicious page can spoof the identify of another site. This vulnerability affects Firefox < 58. Cuando el texto de una URL especialmente formateada se arrastra a la barra de dirección desde el contenido de la página, la URL mostrada se puede suplantar para mostrar un sitio diferente que el que se ha ... • http://www.securityfocus.com/bid/102786 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2018-5118 – Ubuntu Security Notice USN-3544-1
https://notcve.org/view.php?id=CVE-2018-5118
25 Jan 2018 — The screenshot images displayed in the Activity Stream page displayed when a new tab is opened is created from the meta tags of websites. An issue was discovered where the page could attempt to create these images through "file:" URLs from the local file system. This loading is blocked by the sandbox but could expose local data if combined with another attack that escapes sandbox protections. This vulnerability affects Firefox < 58. Las imágenes de captura de pantalla que se muestran en la página Activity S... • http://www.securityfocus.com/bid/102786 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2018-5090 – Ubuntu Security Notice USN-3544-1
https://notcve.org/view.php?id=CVE-2018-5090
25 Jan 2018 — Memory safety bugs were reported in Firefox 57. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 58. Se han informado de errores de seguridad de memoria en Firefox 57. Algunos de estos errores mostraron evidencias de corrupción de memoria y se cree que, con el esfuerzo necesario, se podrían explotar para ejecutar código arbitrario. • http://www.securityfocus.com/bid/102786 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2018-5119 – Ubuntu Security Notice USN-3544-1
https://notcve.org/view.php?id=CVE-2018-5119
25 Jan 2018 — The reader view will display cross-origin content when CORS headers are set to prohibit the loading of cross-origin content by a site. This could allow access to content that should be restricted in reader view. This vulnerability affects Firefox < 58. La vista del lector mostrará el contenido de orígenes cruzados cuando las cabeceras CORS estén configurados para prohibir la carga de contenido de orígenes cruzados por un sitio. Esto podría permitir el acceso a contenidos que deberían ser restringidos en la ... • http://www.securityfocus.com/bid/102786 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-5112 – Ubuntu Security Notice USN-3544-1
https://notcve.org/view.php?id=CVE-2018-5112
25 Jan 2018 — Development Tools panels of an extension are required to load URLs for the panels as relative URLs from the extension manifest file but this requirement was not enforced in all instances. This could allow the development tools panel for the extension to load a URL that it should not be able to access, including potentially privileged pages. This vulnerability affects Firefox < 58. Los paneles de las herramientas de desarrollo de una extensión son necesarios para cargar URL para los paneles como URL relativa... • http://www.securityfocus.com/bid/102786 • CWE-552: Files or Directories Accessible to External Parties •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-5094 – Ubuntu Security Notice USN-3544-1
https://notcve.org/view.php?id=CVE-2018-5094
25 Jan 2018 — A heap buffer overflow vulnerability may occur in WebAssembly when "shrinkElements" is called followed by garbage collection on memory that is now uninitialized. This results in a potentially exploitable crash. This vulnerability affects Firefox < 58. Podría ocurrir un desbordamiento de búfer basado en memoria dinámica (heap) en WebAssembly cuando se llama a "shrinkElements" seguido de la recolección de basura (garbage collection) en la memoria que ahora está sin inicializar. Esto resulta en un cierre inesp... • http://www.securityfocus.com/bid/102786 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •