CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-35111 – Mozilla: The proxy.onRequest API did not catch view-source URLs
https://notcve.org/view.php?id=CVE-2020-35111
When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening View Source could have inadvertently leaked their IP address. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. Cuando una extensión con el permiso de proxy se registró para recibir (all_urls), la devolución de llamada proxy.onRequest no se desencadenó para las URL de vista de origen. Si bien el contenido web no puede navegar a dichas URL, un usuario que abra View Source podría haber filtrado inadvertidamente su dirección IP. • https://bugzilla.mozilla.org/show_bug.cgi?id=1657916 https://www.mozilla.org/security/advisories/mfsa2020-54 https://www.mozilla.org/security/advisories/mfsa2020-55 https://www.mozilla.org/security/advisories/mfsa2020-56 https://access.redhat.com/security/cve/CVE-2020-35111 https://bugzilla.redhat.com/show_bug.cgi?id=1908027 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-35113 – Mozilla: Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6
https://notcve.org/view.php?id=CVE-2020-35113
Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. Los desarrolladores de Mozilla reportaron bugs de seguridad de la memoria presentes en Firefox versión 83 y Firefox versión ESR 78.5. Algunos de estos bugs mostraron evidencia de corrupción de la memoria y suponemos que con un suficiente esfuerzo algunos de ellos podrían haberse explotado para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1664831%2C1673589 https://www.mozilla.org/security/advisories/mfsa2020-54 https://www.mozilla.org/security/advisories/mfsa2020-55 https://www.mozilla.org/security/advisories/mfsa2020-56 https://access.redhat.com/security/cve/CVE-2020-35113 https://bugzilla.redhat.com/show_bug.cgi?id=1908029 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26969
https://notcve.org/view.php?id=CVE-2020-26969
Mozilla developers reported memory safety bugs present in Firefox 82. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 83. Los desarrolladores de Mozilla reportaron bugs de seguridad de la memoria presentes en Firefox versión 82. Algunos de estos bugs mostraron evidencia de corrupción de la memoria y suponemos que con un esfuerzo suficiente algunos de ellos podrían haber sido explotados para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1623920%2C1651705%2C1667872%2C1668876 https://www.mozilla.org/security/advisories/mfsa2020-50 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-26966
https://notcve.org/view.php?id=CVE-2020-26966
Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an information leak. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Una búsqueda de una sola palabra en la barra de direcciones causó que se enviara una petición mDNS en la red local buscando un nombre de host que constara de esa cadena; resultando en una filtración de información. • https://bugzilla.mozilla.org/show_bug.cgi?id=1663571 https://www.mozilla.org/security/advisories/mfsa2020-50 https://www.mozilla.org/security/advisories/mfsa2020-51 https://www.mozilla.org/security/advisories/mfsa2020-52 •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-26964
https://notcve.org/view.php?id=CVE-2020-26964
If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to the feature and operated with the privileges of the browser to read and interact with web content. The feature was implemented as a unix domain socket, protected by the Android SELinux policy; however, SELinux was not enforced for versions prior to 6.0. This was fixed by removing the Remote Debugging via USB feature from affected devices. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. • https://bugzilla.mozilla.org/show_bug.cgi?id=1658865 https://www.mozilla.org/security/advisories/mfsa2020-50 •