CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7842 – Ubuntu Security Notice USN-3477-3
https://notcve.org/view.php?id=CVE-2017-7842
17 Nov 2017 — If a document's Referrer Policy attribute is set to "no-referrer" sometimes two network requests are made for "" elements instead of one. One of these requests includes the referrer instead of respecting the set policy to not include a referrer on requests. This vulnerability affects Firefox < 57. Si el atributo Referrer Policy de un documento se establece en "no-referrer", a veces se hacen dos peticiones de red para elementos "" en lugar de una. Una de estas peticiones incluye al referrer en lugar de... • http://www.securityfocus.com/bid/101832 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 2%CPEs: 17EXPL: 0CVE-2017-7826 – Mozilla: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5 (MFSA 2017-25)
https://notcve.org/view.php?id=CVE-2017-7826
16 Nov 2017 — Memory safety bugs were reported in Firefox 56 and Firefox ESR 52.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5. Se han informado de errores de seguridad de memoria en Firefox 56 y Firefox ESR 52.4. Algunos de estos errores mostraron evidencias de corrupción de memoria y se cree que, con el esfuerzo necesario, se ... • http://www.securityfocus.com/bid/101832 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.8EPSS: 34%CPEs: 15EXPL: 0CVE-2017-7828 – Mozilla: Use-after-free of PressShell while restyling layout (MFSA 2017-25)
https://notcve.org/view.php?id=CVE-2017-7828
16 Nov 2017 — A use-after-free vulnerability can occur when flushing and resizing layout because the "PressShell" object has been freed while still in use. This results in a potentially exploitable crash during these operations. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5. Puede ocurrir una vulnerabilidad de uso de memoria previamente liberada cuando se alinea y redimensiona la disposición porque el objeto "PressShell'" se ha liberado cuando se estaba utilizando. Esto resulta en un... • http://www.securityfocus.com/bid/101832 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 15EXPL: 0CVE-2017-7830 – Mozilla: Cross-origin URL information leak through Resource Timing API (MFSA 2017-25)
https://notcve.org/view.php?id=CVE-2017-7830
16 Nov 2017 — The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5. La API Resource Timing revelaba incorrectamente las navegaciones en iframes cross-origin. Esta es una violación de la política same-origin y podría permitir el robo de datos de URL cargadas por los usuarios. • http://www.securityfocus.com/bid/101832 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 3%CPEs: 1EXPL: 1CVE-2017-7811 – Ubuntu Security Notice USN-3435-1
https://notcve.org/view.php?id=CVE-2017-7811
03 Oct 2017 — Memory safety bugs were reported in Firefox 55. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 56. Se han informado de errores de seguridad de memoria en Firefox 55. Algunos de estos errores mostraron evidencias de corrupción de memoria y se cree que, con el esfuerzo necesario, se podrían explotar para ejecutar código arbitrario. • http://www.securityfocus.com/bid/101057 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2017-7812 – Ubuntu Security Notice USN-3435-1
https://notcve.org/view.php?id=CVE-2017-7812
03 Oct 2017 — If web content on a page is dragged onto portions of the browser UI, such as the tab bar, links can be opened that otherwise would not be allowed to open. This can allow malicious web content to open a locally stored file through "file:" URLs. This vulnerability affects Firefox < 56. Si el contenido web en una página se arrastra a porciones de la interfaz de usuario del navegador como una barra de pestañas, los enlaces se pueden abrir, algo que de otra manera no se podrían abrir. Esto puede permitir que un ... • http://www.securityfocus.com/bid/101057 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 1CVE-2017-7813 – Ubuntu Security Notice USN-3435-1
https://notcve.org/view.php?id=CVE-2017-7813
03 Oct 2017 — Inside the JavaScript parser, a cast of an integer to a narrower type can result in data read from outside the buffer being parsed. This usually results in a non-exploitable crash, but can leak a limited amount of information from memory if it matches JavaScript identifier syntax. This vulnerability affects Firefox < 56. Dentro del analizador JavaScript, el retorno de un entero a un tipo más estrecho puede resultar en que los datos leídos desde fuera del búfer sean analizados. Esto generalmente resulta en u... • http://www.securityfocus.com/bid/101057 • CWE-125: Out-of-bounds Read CWE-704: Incorrect Type Conversion or Cast •
CVSS: 5.3EPSS: 1%CPEs: 1EXPL: 1CVE-2017-7815 – Ubuntu Security Notice USN-3435-1
https://notcve.org/view.php?id=CVE-2017-7815
03 Oct 2017 — On pages containing an iframe, the "data:" protocol can be used to create a modal dialog through Javascript that will have an arbitrary domains as the dialog's location, spoofing of the origin of the modal dialog from the user view. Note: This attack only affects installations with e10 multiprocess turned off. Installations with e10s turned on do not support the modal dialog functionality. This vulnerability affects Firefox < 56. En las páginas que contienen un iframe, se podría utilizar el protocolo "data:... • http://www.securityfocus.com/bid/101057 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2017-7816 – Ubuntu Security Notice USN-3435-1
https://notcve.org/view.php?id=CVE-2017-7816
03 Oct 2017 — WebExtensions could use popups and panels in the extension UI to load an "about:" privileged URL, violating security checks that disallow this behavior. This vulnerability affects Firefox < 56. WebExtensions podría utilizar las ventanas emergentes y los paneles en la interfaz de usuario de la extensión para cargar una URL privilegiada "about:", violando las comprobaciones de seguridad que no permiten este comportamiento. Esta vulnerabilidad afecta a las versiones anteriores a la 56 de Firefox. Multiple secu... • http://www.securityfocus.com/bid/101057 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 1%CPEs: 1EXPL: 1CVE-2017-7820 – Ubuntu Security Notice USN-3435-1
https://notcve.org/view.php?id=CVE-2017-7820
03 Oct 2017 — The "instanceof" operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or an extension the web content can provide its own result for that operator, possibly tricking the browser or extension into mishandling the element. This vulnerability affects Firefox < 56. El operador "instanceof" puede omitir el mecanismo del wrapper Xray. Cuando se le llama en un contenido web desde el propio navegador o una extensión, el contenido web puede proporcionar su propio resulta... • http://www.securityfocus.com/bid/101057 •