CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26957
https://notcve.org/view.php?id=CVE-2020-26957
OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83. • https://bugzilla.mozilla.org/show_bug.cgi?id=1667179 https://www.mozilla.org/security/advisories/mfsa2020-50 • CWE-665: Improper Initialization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26955
https://notcve.org/view.php?id=CVE-2020-26955
When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same domain, regardless of whether the original and subsequent request were in private and non-private browsing modes. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83. Cuando un usuario descargaba un archivo en Firefox para Android, si una cookie es ajustada, ésta habría sido reenviada durante una operación posterior de descarga de archivos en el mismo dominio, independientemente de si la petición original y posterior se encontraban en modos de navegación privados y no privados. • https://bugzilla.mozilla.org/show_bug.cgi?id=1663261 https://www.mozilla.org/security/advisories/mfsa2020-50 • CWE-565: Reliance on Cookies without Validation and Integrity Checking •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26954
https://notcve.org/view.php?id=CVE-2020-26954
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83. • https://bugzilla.mozilla.org/show_bug.cgi?id=1657026 https://www.mozilla.org/security/advisories/mfsa2020-50 •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26952
https://notcve.org/view.php?id=CVE-2020-26952
Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and a potentially exploitable crash when handling out-of-memory errors. This vulnerability affects Firefox < 83. Una contabilización incorrecta de las funciones en línea durante la compilación de JIT podría haber conllevado a una corrupción de la memoria y a un bloqueo potencialmente explotable cuando se manejan errores fuera de la memoria. Esta vulnerabilidad afecta a Firefox versiones anteriores a 83 • https://bugzilla.mozilla.org/show_bug.cgi?id=1667685 https://www.mozilla.org/security/advisories/mfsa2020-50 • CWE-787: Out-of-bounds Write •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26958 – Mozilla: Requests intercepted through ServiceWorkers lacked MIME type restrictions
https://notcve.org/view.php?id=CVE-2020-26958
Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Firefox no bloqueó una ejecución de scripts con tipos MIME incorrectos cuando la respuesta fue interceptada y almacenada en caché por medio de un ServiceWorker. Esto podría conllevar a una vulnerabilidad de inclusión de cross-site script, o una omisión de Content Security Policy. • https://bugzilla.mozilla.org/show_bug.cgi?id=1669355 https://www.mozilla.org/security/advisories/mfsa2020-50 https://www.mozilla.org/security/advisories/mfsa2020-51 https://www.mozilla.org/security/advisories/mfsa2020-52 https://access.redhat.com/security/cve/CVE-2020-26958 https://bugzilla.redhat.com/show_bug.cgi?id=1898735 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •