CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-23962
https://notcve.org/view.php?id=CVE-2021-23962
Incorrect use of the '<RowCountChanged>' method could have led to a user-after-poison and a potentially exploitable crash. This vulnerability affects Firefox < 85. Un uso incorrecto del método "(RowCountChanged)" podría conllevar a un uso posterior al envenenamiento y un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Firefox versiones anteriores a 85 • https://bugzilla.mozilla.org/show_bug.cgi?id=1677194 https://www.mozilla.org/security/advisories/mfsa2021-03 •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-23963
https://notcve.org/view.php?id=CVE-2021-23963
When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to loss of control over the currently granted permission. This vulnerability affects Firefox < 85. Cuando se comparten la geolocalización durante un recurso compartido de WebRTC activo, Firefox podría haber restablecido el estado del intercambio de webRTC en la interfaz de usuario, conllevando a una pérdida de control sobre el permiso otorgado actualmente. Esta vulnerabilidad afecta a Firefox versiones anteriores a 85 • https://bugzilla.mozilla.org/show_bug.cgi?id=1680793 https://www.mozilla.org/security/advisories/mfsa2021-03 • CWE-281: Improper Preservation of Permissions •
CVSS: 7.4EPSS: 0%CPEs: 3EXPL: 0CVE-2021-23961 – Mozilla: More internal network hosts could have been probed by a malicious webpage
https://notcve.org/view.php?id=CVE-2021-23961
Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox < 85. Otras técnicas que se basaron en la investigación de slipstream combinada con una página web maliciosa podrían haber expuesto tanto los hosts de una red interna como los servicios que se ejecutan en la máquina local del usuario. Esta vulnerabilidad afecta a Firefox versiones anteriores a 85 • https://bugzilla.mozilla.org/show_bug.cgi?id=1677940 https://lists.debian.org/debian-lts-announce/2021/04/msg00019.html https://lists.debian.org/debian-lts-announce/2021/04/msg00020.html https://security.gentoo.org/glsa/202104-09 https://security.gentoo.org/glsa/202104-10 https://www.debian.org/security/2021/dsa-4895 https://www.debian.org/security/2021/dsa-4897 https://www.mozilla.org/security/advisories/mfsa2021-03 https://access.redhat.com/security/cve/CVE-2021-23961 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-23964 – Mozilla: Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7
https://notcve.org/view.php?id=CVE-2021-23964
Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. Los desarrolladores de Mozilla reportaron bugs de seguridad de la memoria presentes en Firefox versión 84 y Firefox ESR versión 78.6. Algunos de estos bugs mostraron evidencia de corrupción de la memoria y suponemos que con esfuerzo suficiente algunos de ellos podrían haber sido explotado para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662507%2C1666285%2C1673526%2C1674278%2C1674835%2C1675097%2C1675844%2C1675868%2C1677590%2C1677888%2C1680410%2C1681268%2C1682068%2C1682938%2C1683736%2C1685260%2C1685925 https://www.mozilla.org/security/advisories/mfsa2021-03 https://www.mozilla.org/security/advisories/mfsa2021-04 https://www.mozilla.org/security/advisories/mfsa2021-05 https://access.redhat.com/security/cve/CVE-2021-23964 https://bugzilla.redhat.com/show_bug.cgi?id=1920651 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-23953 – Mozilla: Cross-origin information leakage via redirected PDF requests
https://notcve.org/view.php?id=CVE-2021-23953
If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. Si un usuario hace clic en un PDF diseñado específicamente, el lector de PDF podría confundirse y filtrar información de origen cruzado, cuando dicha información es servida como datos fragmentados. Esta vulnerabilidad afecta a Firefox versiones anteriores a 85, Thunderbird versiones anteriores a 78,7 y Firefox ESR versiones anteriores a 78,7 The Mozilla Foundation Security Advisory describes this flaw as: If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data. • https://bugzilla.mozilla.org/show_bug.cgi?id=1683940 https://www.mozilla.org/security/advisories/mfsa2021-03 https://www.mozilla.org/security/advisories/mfsa2021-04 https://www.mozilla.org/security/advisories/mfsa2021-05 https://access.redhat.com/security/cve/CVE-2021-23953 https://bugzilla.redhat.com/show_bug.cgi?id=1920646 • CWE-829: Inclusion of Functionality from Untrusted Control Sphere •