Mozilla: Data race and potential use-after-free in PK11_ChangePW

The Mozilla Foundation Security Advisory describes this flaw as: A data race could occur in the PK11ChangePW function, potentially leading to a use-after-free vulnerability. In Firefox, this lock protected the data when a user changed their master password...

Mozilla: Data race and potential use-after-free in PK11_ChangePW

The Mozilla Foundation Security Advisory describes this flaw as: A data race could occur in the PK11ChangePW function, potentially leading to a use-after-free vulnerability. In Firefox, this lock protected the data when a user changed their master password...

Mozilla: Data race and potential use-after-free in PK11_ChangePW

The Mozilla Foundation Security Advisory describes this flaw as: A data race could occur in the PK11ChangePW function, potentially leading to a use-after-free vulnerability. In Firefox, this lock protected the data when a user changed their master password...

Mozilla: Data race and potential use-after-free in PK11_ChangePW

The Mozilla Foundation Security Advisory describes this flaw as: A data race could occur in the PK11ChangePW function, potentially leading to a use-after-free vulnerability. In Firefox, this lock protected the data when a user changed their master password...

Mozilla: Data race and potential use-after-free in PK11_ChangePW

The Mozilla Foundation Security Advisory describes this flaw as: A data race could occur in the PK11ChangePW function, potentially leading to a use-after-free vulnerability. In Firefox, this lock protected the data when a user changed their master password...

Mozilla Firefox ESR 资源管理错误漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox ESR prior to version 102.2, which stems from a possible data contention issue in the PK11ChangePW function that can lead to reuse after release, and i...

CVE-2022-37400 Apache OpenOffice Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master Password

Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where the required initialization vector for encryption was always the same...

Hardcoded credentials

The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number...

CVE-2022-2107

CVE-2022-2107: MiCODUS MV720 GPS tracker API server uses a hard-coded master password, enabling unauthenticated login and direct SMS-command control of trackers (impersonating owners, accessing/modifying data, and potentially steering vehicles). Device IDs are sequential, aiding targeting. Public...

Couchbase Server 信息泄露漏洞

Couchbase Server is a distributed open source NoSQL non-relational database from Couchbase USA, which mainly supports data query, full-text search and active global replication. couchbase Server is vulnerable to an information disclosure vulnerability, which originates from couchbase-cli that...

CVE-2022-22563

Dell EMC Powerscale OneFS 8.2.x - 9.2.x omit security-relevant information in /etc/master.passwd. A high-privileged user can exploit this vulnerability to not record information identifying the source of account information changes...

Apache OpenOffice -- master password vulnerabilities

The Apache Openoffice project reports: Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where the required initialization...

Security update for MozillaThunderbird (moderate)

openSUSE Security Update: Security update for MozillaThunderbird Announcement ID: openSUSE-SU-2021:1854-1 Rating: moderate References: 1185086 1185633 1186198 1186199 Cross-References: CVE-2021-29950 CVE-2021-29951 CVE-2021-29956 CVE-2021-29957 CVSS scores: CVE-2021-29950 NVD : 7.5...

CVE-2021-29956

OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will...

DEBIAN-CVE-2021-29956

OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will...

Design/Logic Flaw

OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will...

CVE-2021-29956

OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2021:2263)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:2263-1 advisory. - Mozilla: Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11 CVE-2021-29967 - Mozilla: Thunderbird stored OpenPGP secret keys without...

Oracle Linux 7 : thunderbird (ELSA-2021-2263)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-2263 advisory. 78.11.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 78.11.0-1 - Update to 78.11.0 build1 Tenable has...

Mozilla: Thunderbird stored OpenPGP secret keys without master password protection

OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will...