CVE-2020-6797

By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer. The attacker is restricted as they are unable to download non-quarantined files or supply command line arguments to the application, limiting the impact...

CVE-2020-6797

CVE-2020-6797 describes a macOS-specific issue where downloading a file with the .fileloc extension could cause a semi-privileged extension to launch an arbitrary application on the user’s Mac. The attacker is constrained by the ability to download only quarantined files and cannot pass command-l...

openSUSE: Security Advisory for MozillaFirefox (openSUSE-SU-2020:0230-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE: Security Advisory for MozillaThunderbird (openSUSE-SU-2020:0231-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : MozillaFirefox (openSUSE-2020-230)

This update for MozillaFirefox fixes the following issues : - Firefox Extended Support Release 68.5.0 ESR - Fixed: Various stability and security fixes - Mozilla Firefox ESR68.5 MFSA 2020-06 bsc1163368 - CVE-2020-6796 bmo1610426 Missing bounds check on shared memory read in the parent process -...

openSUSE Security Update : MozillaThunderbird (openSUSE-2020-231)

This update for MozillaThunderbird fixes the following issues : - Mozilla Thunderbird 68.5 bsc1162777 MFSA 2020-07 bsc1163368 - CVE-2020-6793 bmo1608539 Out-of-bounds read when processing certain email messages - CVE-2020-6794 bmo1606619 Setting a master password post-Thunderbird 52 does not dele...

Security update for MozillaFirefox (important)

openSUSE Security Update: Security update for MozillaFirefox Announcement ID: openSUSE-SU-2020:0230-1 Rating: important References: 1163368 Cross-References: CVE-2020-6796 CVE-2020-6797 CVE-2020-6798 CVE-2020-6799 CVE-2020-6800 Affected Products: openSUSE Leap 15.1 An update that fixes 5...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-firefox-68.5.0esr-i686-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. For more...

Security fix for the ALT Linux 10 package firefox-esr version 68.5.0-alt1

Feb. 12, 2020 Andrey Cherepanov 68.5.0-alt1 - New ESR version 68.5.0. - Fixed: + CVE-2020-6796 Missing bounds check on shared memory read in the parent process + CVE-2020-6797 Extensions granted downloads.open permission could open arbitrary applications on Mac OSX + CVE-2020-6798 Incorrect parsi...

Slackware 14.2 / current : mozilla-thunderbird (SSA:2020-042-02)

New mozilla-thunderbird packages are available for Slackware 14.2 and -current to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2020-042-02. The text itself is copyright C Slackware Linu...

Slackware 14.2 / current : mozilla-firefox (SSA:2020-042-01)

New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2020-042-01. The text itself is copyright C Slackware Linux,...

Security fix for the ALT Linux 10 package thunderbird version 68.5.0-alt1

Feb. 12, 2020 Andrey Cherepanov 68.5.0-alt1 - New version 68.5.0. - Fixed: + CVE-2020-6793 Out-of-bounds read when processing certain email messages + CVE-2020-6794 Setting a master password post-Thunderbird 52 does not delete unencrypted previously stored passwords + CVE-2020-6795 Crash processi...

KLA11669 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, obtain sensitive information, perform cross-site scripting attack. Below is a complete list of vulnerabilities: 1. A memory corruption...

Huawei EulerOS: Security Advisory for perl (EulerOS-SA-2019-2326)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-6797

A heap buffer write overflow, with control over the bytes written, was found in the way regular expressions employing Unicode rules are compiled. An attacker, with the ability to provide a specially crafted regular expression, could crash the perl interpreter, or possibly execute arbitrary code...

GLSA-201909-01 : Perl: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201909-01 Perl: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Perl. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE identifiers for details...

CVE-2019-6797

creationtimestamp| type| source ---|---|--- 2019-05-17 16:51:41+00:00| seen| https://t.me/cvemitreorg/51...

CVE-2019-6797

CVE-2019-6797 describes an information-disclosure in GitLab Enterprise Edition prior to 11.5.8, 11.6.x prior to 11.6.6, and 11.7.x prior to 11.7.1, where the GitHub token used in CI/CD for External Repos could be leaked to project maintainers in the UI. The NVD lists this as a high-severity issue...

Photon OS 2.0: Perl PHSA-2018-2.0-0050

An update of the perl package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-2.0-0050. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid121950;...

Internet Bug Bounty: Heap-buffer-overflow in Perl__byte_dump_string (utf8.c) could lead to memory leak

With crafted regex match, I have found a heap-over-flow in function Perlbytedumpstring, which would lead to memory leak. Reported to the Perl security mailing list on 11 Sep 2017. Confirmed as a security flaw by TonyC on 24 Feb 2018 CVE-2018-6797 assigned to this flaw on 7 Feb 2018 Public securit...