DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Mozilla Firefox: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2019-12-03
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox und Mozilla Firefox ESR ausnutzen, um beliebigen Programmcode auszuführen, seine Privilegien zu erhöhen, Informationen offenzulegen oder einen Denial of Service Zustand zu verursachen.
01
beschreibt (11)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-13722US | medium6.5 | — | ||
Inappropriate implementation in WebRTC in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||||
| CVE-2019-17014US | high7.4OT erhöht | — | ||
If an image had not loaded correctly (such as when it is not actually an image), it could be dragged and dropped cross-domain, resulting in a cross-origin information leak. This vu… | ||||
| CVE-2019-17013US | high8.8 | — | ||
Mozilla developers reported memory safety bugs present in Firefox 70. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these c… | ||||
| CVE-2019-17012US | high8.8 | — | ||
Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed evidence of memory corruption and we presume that with enough e… | ||||
| CVE-2019-17011US | high7.5 | — | ||
Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable… | ||||
| CVE-2019-17010US | high7.5 | — | ||
Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially… | ||||
| CVE-2019-17009US | high7.8OT erhöht | — | ||
When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file… | ||||
| CVE-2019-17008US | high8.8 | — | ||
When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3,… | ||||
| CVE-2019-17005US | high8.8 | — | ||
The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array leading to memory cor… | ||||
| CVE-2019-11756US | high8.8 | — | ||
Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects Firefox < 71. | ||||
| CVE-2019-11745US | high8.8 | — | ||
When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- CentOS Security Advisory CESA-2019:4107 vom 2019-12-24external
- CentOS Security Advisory CESA-2019:4108 vom 2019-12-11external
- CentOS Security Advisory CESA-2019:4152 vom 2019-12-11external
- CentOS Security Advisory CESA-2019:4190 vom 2019-12-24external
- CentOS Security Advisory CESA-2019:4190 vom 2019-12-24external
- CentOS Security Advisory CESA-2019:4190 vom 2019-12-24external
- SUSE Security Update SUSE-SU-2020:14418-1 vom 2020-07-06external
- Red Hat Security Advisory RHSA-2021:0758 vom 2021-03-10external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan