The vulnerabilities of Firefox and Firefox ESR browsers, as well as the Thunderbird email client, are related to process-interaction errors (IPC errors). These vulnerabilities allow attackers to exploit them to disclose sensitive information.

The vulnerabilities of Firefox and Firefox ESR browsers, as well as the Thunderbird email client, are related to process-interaction errors. Exploiting these vulnerabilities can allow a malicious actor to disclose sensitive information...

ALPINE-CVE-2019-11708

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing...

USN-4045-1 thunderbird vulnerabilities

A type confusion bug was discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could exploit this by causing a denial of service, or executing arbirary code. CVE-2019-11707 It was discovered that a sandboxed child process...

Mozilla: Sandbox escape using Prompt:Open

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing...

Mozilla: Sandbox escape using Prompt:Open

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing...

CVE-2019-12936

BlueStacks App Player 2, 3, and 4 before 4.90 allows DNS Rebinding for attacks on exposed IPC functions...

DEBIAN-CVE-2018-16877

A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation...

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird, related to errors in the implementation of the inter-process communication authentication mechanism, allows an attacker to escalate their privileges and escape from the isolated software environment.

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird is related to errors in the implementation of the inter-process communication authentication mechanism. Exploiting this vulnerability can allow a malicious actor to increase their privileges and gain access...

DEBIAN-CVE-2018-12365

A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction. This could result in exposure of private local files. This vulnerability affects Thunderbird 60, Thunderbird 52.9, Firefox ESR 60.1, Firefox...

DEBIAN-CVE-2016-7035

An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain roo...

Mozilla: Compromised IPC child process can list local filenames

A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction. This could result in exposure of private local files. This vulnerability affects Thunderbird 60, Thunderbird 52.9, Firefox ESR 60.1, Firefox...

ALPINE-CVE-2018-3665

System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data from another process through a speculative execution side channel...

CVE-2017-5456

A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and write access to the local file system. This vulnerability affects Firefox ESR 52.1 and Firefox 53...

IPVanish for macOS elevation of privilege vulnerability

IPVanish for macOS is a VPN software for anonymous access to the Internet based on the macOS platform. An elevation of privilege vulnerability exists in version 3.0.11 of IPVanish for macOS-based platforms, which stems from the 'com.ipvanish.osx.vpnhelper' LaunchDaemon implementation of the...

Mozilla Firefox Out-of-Bounds Write Vulnerability

Mozilla Firefox browser Firefox is a free, open source browser for Windows, Linux and MacOSX platforms. An out-of-bounds write vulnerability exists in Mozilla Firefox. The vulnerability arises due to a lack of parameter validation for IPC messages. An attacker can exploit this vulnerability to...

IBM Client Application Access and Notes Elevation of Privilege Vulnerability (CNVD-2018-03879)

IBM Client Application Access and IBM Notes are both products of IBM Corporation in the U.S. IBM Client Application Access is a set of tools for accessing local applications.IBM Notes is a set of collaborative office software. An elevation of privilege vulnerability exists in IBM Client Applicati...

CVE-2018-7311

PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability. The software installs a privileged helper tool that runs as the root user. This privileged helper tool is installed as a LaunchDaemon and implements an XPC service. The XPC service is responsible for handling new...

CVE-2018-1410

IBM Notes Diagnostics IBM Client Application Access and IBM Notes could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could be tricked into executing an executable chosen by the attacker. IBM X-Force ID: 138709...

CVE-2018-1409

IBM Notes Diagnostics IBM Client Application Access and IBM Notes could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could be tricked into executing an executable chosen by the attacker. IBM X-Force ID: 138708...

Mailbutler Shimo Elevation of Privilege Vulnerability

Shimo is a multi-protocol VPN client for Mac OS. An elevation of privilege vulnerability exists in Mailbutler Shimo before 4.1.5.1. The vulnerability arises because com.feingeist.shimo.helper tool LaunchDaemon implements an unprotected XPC service. An attacker can use this vulnerability to execut...