CVE-2019-9816

A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all...

CVE-2019-11698

If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user's browser history can be run and transmitted to the content page via drop event data. This allows for...

Security fix for the ALT Linux 10 package firefox-esr version 60.7.0-alt1

May 21, 2019 Andrey Cherepanov 60.7.0-alt1 - New ESR version 60.7.0. - Fixed: + CVE-2019-9815 Disable hyperthreading on content JavaScript threads on macOS + CVE-2019-9816 Type confusion with object groups and UnboxedObjects + CVE-2019-9817 Stealing of cross-domain images using canvas +...

KLA11487 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, obtain sensitive information, cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. A type confusion...

Security fix for the ALT Linux 10 package thunderbird version 60.7.0-alt1

May 20, 2019 Andrey Cherepanov 60.7.0-alt1 - New version 60.7.0. - Fixed: + CVE-2019-9815 Disable hyperthreading on content JavaScript threads on macOS + CVE-2019-9816 Type confusion with object groups and UnboxedObjects + CVE-2019-9817 Stealing of cross-domain images using canvas + CVE-2019-9818...

Arbitrary Code Execution

Mozilla Thunderbird is vulnerable to arbitrary code execution. A type confusion due to memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 allows an attacker to execute arbitrary code in the host OS...

Denial Of Service

Firefox and Firefox ESR are vulnerable to denial of service DoS attacks. This occurs while parsing an HTML5 stream in concert with custom HTML elements which may lead to potentially exploitable crash...

Privilege Escalation

Firefox and Firefox ESR are vulnerable to privilege escalation attacks. This is because the authentication is insufficient for channels created after the IPC process is started which allow for a sandbox escape through IPC channels due to lack of message validation in the listener process, result ...

Remote Code Execution (RCE)

Firefox and Firefox ESR is vulnerable to remote code execution RCE attacks. This is because memory safety bugs present in Firefox which may lead to memory corruption and arbitrary code execution...

Denial Of Service (DoS)

Thunderbird, Firefox ESR and Firefox are vulnerable to denial of service attacks. A segmentation fault may occur in the media recorder when the track type is changed during capture allowing remote unauthenticated attacker to cause a system hang by exploiting the vulnerable Capture Handler compone...

Information Disclosure

Thunderbird, Firefox ESR and Firefox are vulnerable to information disclosure vulnerability. A remote unauthenticated attacker could compromise IPC child process and list the names of arbitrary files on the file system resulting in exposure of private local files...

Cross-Site Request Forgery (CSRF)

Thunderbird, Firefox ESR and Firefox are vulnerable to cross-site request forgery. A remote unauthenticated attacker can send non-simple requests to bypass cross-origin restrictions and conduct cross-site request forgery attacks via an NPAPI plugin...

Denial Of Service (DoS)

Thunderbird, Firefox ESR and Firefox are vulnerable to denial of service attacks. A remote unauthenticated user could crash the application by manipulating the SVG "animatedPathSegList" through script...

Node.js third-party modules: [hnzserver] Path Traversal allowing to read any files on the server

I would like to report path traversal vulnerability in module "hnzserver" It allows an attacker to read any files even system files via this path traversal vulnerability. Module module name: hnzserver version: 2.0.6 npm page: https://www.npmjs.com/package/hnzserver Module Description 静态服务器 means...

Mozilla: Use-after-free when removing in-use DOM elements

A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 60.6, Firefox ESR 60.6, and Firefox 66...

Mozilla: Improper bounds checks when Spectre mitigations are disabled

A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnerability could allow an attacker to create an arbitrary value in compiled JavaScript, for which the range analysis will infer a fully...

Node.js third-party modules: [min-http-server] Stored XSS in the filename when directories listing

I would like to report Stored XSS in module "min-http-server". It allows to inject malicious scripts in the file name, store them on the server, then execute these scripts in the browser via the XSS vulnerability. Module module name: min-http-server version: 1.0.6 npm page:...

Mozilla: Type-confusion in IonMonkey JIT compiler

A vulnerability where type-confusion in the IonMonkey just-in-time JIT compiler could potentially be used by malicious JavaScript to trigger a potentially exploitable crash. This vulnerability affects Thunderbird 60.6, Firefox ESR 60.6, and Firefox 66...

Mozilla: Improper bounds checks when Spectre mitigations are disabled

A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnerability could allow an attacker to create an arbitrary value in compiled JavaScript, for which the range analysis will infer a fully...

[SECURITY] [DLA 1780-1] firefox-esr new upstream version

Package : firefox-esr Version : 60.6.2esr-1deb8u1 Debian Bug : 928415 928449 928509 Firefox 60.6.2 ESR repairs a certificate chain issue that caused extensions to be disabled in the past few days. More information, and details of known remaining issues, can be found at...