Log

CVE-2019-9805 created at 25 Sep 2019 19:31:40
Severity
+ Medium
Remote
+ Remote
Type
+ Information disclosure
Description
+ A latent vulnerability exists in the Prio library in Firefox before 66.0 where data may be read from uninitialized memory for some functions, leading to potential memory corruption.
References
+ https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9805
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1521360
Notes
CVE-2019-9806 created at 25 Sep 2019 19:31:40
Severity
+ Low
Remote
+ Remote
Type
+ Denial of service
Description
+ A vulnerability exists in Firefox before 66.0 during authorization prompting for FTP transaction where successive modal prompts are displayed and cannot be immediately dismissed. This allows for a denial of service (DOS) attack.
References
+ https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9806
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1525267
Notes
CVE-2019-9807 created at 25 Sep 2019 19:31:40
Severity
+ Low
Remote
+ Remote
Type
+ Content spoofing
Description
+ When arbitrary text is sent over an FTP connection and a page reload is initiated in Firefox before 66.0, it is possible to create a modal alert message with this text as the content. This could potentially be used for social engineering attacks.
References
+ https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9807
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1362050
Notes
CVE-2019-9808 created at 25 Sep 2019 19:31:40
Severity
+ Low
Remote
+ Remote
Type
+ Content spoofing
Description
+ If WebRTC permission is requested from documents with data: or blob: URLs in Firefox before 66.0, the permission notifications do not properly display the originating domain. The notification states "Unknown origin" as the requestee, leading to user confusion about which site is asking for this permission.
References
+ https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9808
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1434634
Notes
CVE-2019-9809 created at 25 Sep 2019 19:31:40
Severity
+ Low
Remote
+ Remote
Type
+ Denial of service
Description
+ If the source for resources on a page is through an FTP connection in Firefox before 66.0, it is possible to trigger a series of modal alert messages for these resources through invalid credentials or locations. These messages cannot be immediately dismissed, allowing for a denial of service (DOS) attack.
References
+ https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9809
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1282430
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1523249
Notes
CVE-2019-9810 created at 25 Sep 2019 19:31:40
Severity
+ Critical
Remote
+ Remote
Type
+ Arbitrary code execution
Description
+ An incorrect alias information in the IonMonkey JIT compiler of Firefox before 66.0.1 and Thunderbird before 60.6.1 for the Array.prototype.slice method may lead to missing bounds check and a buffer overflow.
References
+ https://www.mozilla.org/en-US/security/advisories/mfsa2019-09/#CVE-2019-9810
+ https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/#CVE-2019-9810
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1537924
Notes
CVE-2019-9811 created at 25 Sep 2019 19:31:40
Severity
+ High
Remote
+ Remote
Type
+ Sandbox escape
Description
+ A sandbox escape has been found in Firefox before 68.0, by installing a malicious language pack and then opening a browser feature that used the compromised translation.
References
+ https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-9811
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1538007
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1539598
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1539759
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1523741
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1563327
Notes
CVE-2019-9812 created at 25 Sep 2019 19:31:40
Severity
+ High
Remote
+ Remote
Type
+ Sandbox escape
Description
+ In Firefox before 69.0, given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a malicious Firefox Sync account. Preference settings that disable the sandbox are then synchronized to the local machine and the compromised browser would restart without the sandbox if a crash is triggered.
References
+ https://www.mozilla.org/en-US/security/advisories/mfsa2019-25/#CVE-2019-9812
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1538008
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1538015
Notes
CVE-2019-9813 created at 25 Sep 2019 19:31:40
Severity
+ Critical
Remote
+ Remote
Type
+ Arbitrary code execution
Description
+ An incorrect handling of __proto__ mutations may lead to type confusion in the IonMonkey JIT code of Firefox before 66.0.1 and Thunderbird before 60.6.1, and can be leveraged for arbitrary memory read and write.
References
+ https://www.mozilla.org/en-US/security/advisories/mfsa2019-09/#CVE-2019-9813
+ https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/#CVE-2019-9813
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1538006
Notes
CVE-2019-9814 created at 25 Sep 2019 19:31:40
Severity
+ Critical
Remote
+ Remote
Type
+ Arbitrary code execution
Description
+ Several memory safety bugs have been found in Firefox before 67.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could be exploited to run arbitrary code.
References
+ https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-9814
+ https://bugzilla.mozilla.org/buglist.cgi?bug_id=1527592%2C1534536%2C1520132%2C1543159%2C1539393%2C1459932%2C1459182%2C1516425
Notes