Advisories for 124.
This commit is contained in:
Tom Ritter
Родитель
3b6f7a9795
Коммит
97776e2e31
|
|
@ -0,0 +1,108 @@
|
|||
## mfsa2024-FIXME.yml
|
||||
announced: FIXME <Month> <Day of Month>, <Year>
|
||||
impact: high
|
||||
fixed_in:
|
||||
- Firefox 124
|
||||
title: Security Vulnerabilities fixed in Firefox 124
|
||||
description: |
|
||||
Do you want a description?
|
||||
advisories:
|
||||
MFSA-RESERVE-2024-1872920:
|
||||
title: Windows Error Reporter could be used as a Sandbox escape vector
|
||||
impact: high
|
||||
reporter: Miloš
|
||||
description: |
|
||||
An attacker could leverage the Windows Error Reporter to run arbitrary code on the system escaping the sandbox. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.
|
||||
bugs:
|
||||
- url: 1872920
|
||||
MFSA-RESERVE-2024-1879237:
|
||||
title: Mishandling of WASM register values
|
||||
impact: high
|
||||
reporter: P1umer
|
||||
description: |
|
||||
Passing invalid data could, for example, lead to invalid wasm values being created, such as arbitrary integers turning into pointer values.
|
||||
bugs:
|
||||
- url: 1879237
|
||||
MFSA-RESERVE-2024-1879939:
|
||||
title: JIT code failed to save return registers on Armv7-A
|
||||
impact: high
|
||||
reporter: Gary Kwong
|
||||
description: |
|
||||
Return registers were overwritten which could allow an attacker to execute arbitrary code.
|
||||
Note: This issue only affected Armv7-A systems. Other operating systems are unaffected.
|
||||
bugs:
|
||||
- url: 1879939
|
||||
MFSA-RESERVE-2024-1880692:
|
||||
title: Integer overflow could lead to out of bounds write
|
||||
impact: high
|
||||
reporter: Ronald Crane
|
||||
description: |
|
||||
AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding() and AppendEncodedCharacters() could experience integer overflows, causing underallocation of an output buffer leading to an out of bounds write.
|
||||
bugs:
|
||||
- url: 1880692
|
||||
CVE-2023-5388:
|
||||
title: NSS susceptible to timing attack against RSA decryption
|
||||
impact: moderate
|
||||
reporter: Hubert Kario
|
||||
description: |
|
||||
NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data.
|
||||
bugs:
|
||||
- url: 1780432
|
||||
MFSA-RESERVE-2024-1866100:
|
||||
title: Permission prompt input delay could expire when not in focus
|
||||
impact: moderate
|
||||
reporter: Shaheen Fazim
|
||||
description: |
|
||||
The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites.
|
||||
bugs:
|
||||
- url: 1866100
|
||||
MFSA-RESERVE-2024-1871112:
|
||||
title: Improper handling of html and body tags enables CSP nonce leakage
|
||||
impact: moderate
|
||||
reporter: Georg Felber and Marco Squarcina (TU Wien)
|
||||
description: |
|
||||
Using a markup injection an attacker could steal nonce values. This can be used to bypass strict content security policies.
|
||||
bugs:
|
||||
- url: 1871112
|
||||
MFSA-RESERVE-2024-1876675:
|
||||
title: Clickjacking vulnerability could lead to user accidentally granting permissions
|
||||
impact: moderate
|
||||
reporter: Hafiizh
|
||||
description: |
|
||||
A missing delay on when pointer lock is used could allow a malicious page to trick a user into granting permissions.
|
||||
bugs:
|
||||
- url: 1876675
|
||||
MFSA-RESERVE-2024-1879444:
|
||||
title: Self referencing object could potentially lead to a use-after-free
|
||||
impact: moderate
|
||||
reporter: Ronald Crane
|
||||
description: |
|
||||
If an attacker could find a way to trigger this code path it could trigger a crash or potentially be leveraged to achieve code execution.
|
||||
bugs:
|
||||
- url: 1879444
|
||||
MFSA-RESERVE-2024-1875701:
|
||||
title: Improper handling of QUIC ACK frame data can lead to OOM
|
||||
impact: low
|
||||
reporter: Max Inden
|
||||
description: |
|
||||
Data was not properly sanitized when decoding a QUIC ACK frame, this could lead to unrestricted memory consumption and a crash.
|
||||
bugs:
|
||||
- url: 1875701
|
||||
MFSA-RESERVE-2024-2:
|
||||
title: Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9
|
||||
impact: high
|
||||
reporter: Ryan VanderMeulen, Noah Lokocz, Kevin Brosnan [Ex-Mozilla], the Mozilla Fuzzing Team
|
||||
description: |
|
||||
Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
|
||||
bugs:
|
||||
- url: 1685358, 1861016, 1880405, 1881093
|
||||
desc: Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9
|
||||
MFSA-RESERVE-2024-4:
|
||||
title: Memory safety bugs fixed in Firefox 124
|
||||
impact: critical
|
||||
reporter: Paul Bone, the Mozilla Fuzzing Team
|
||||
description: |
|
||||
Memory safety bugs present in Firefox 123. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
|
||||
bugs:
|
||||
- url: 1881074, 1882438
|
||||
desc: Memory safety bugs fixed in Firefox 124
|
||||
|
|
@ -0,0 +1,91 @@
|
|||
## mfsa2024-FIXME.yml
|
||||
announced: FIXME <Month> <Day of Month>, <Year>
|
||||
impact: high
|
||||
fixed_in:
|
||||
- Firefox ESR 115.9
|
||||
title: Security Vulnerabilities fixed in Firefox ESR 115.9
|
||||
description: |
|
||||
Do you want a description?
|
||||
advisories:
|
||||
CVE-2024-0743:
|
||||
title: Crash in NSS TLS method
|
||||
impact: high
|
||||
reporter: John Schanck
|
||||
description: |
|
||||
An unchecked return value in TLS handshake code could have caused a potentially exploitable crash.
|
||||
bugs:
|
||||
- url: 1867408
|
||||
MFSA-RESERVE-2024-1872920:
|
||||
title: Windows Error Reporter could be used as a Sandbox escape vector
|
||||
impact: high
|
||||
reporter: Miloš
|
||||
description: |
|
||||
An attacker could leverage the Windows Error Reporter to run arbitrary code on the system escaping the sandbox. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.
|
||||
bugs:
|
||||
- url: 1872920
|
||||
MFSA-RESERVE-2024-1879939:
|
||||
title: JIT code failed to save return registers on Armv7-A
|
||||
impact: high
|
||||
reporter: Gary Kwong
|
||||
description: |
|
||||
Return registers were overwritten which could allow an attacker to execute arbitrary code.
|
||||
Note: This issue only affected Armv7-A systems. Other operating systems are unaffected.
|
||||
bugs:
|
||||
- url: 1879939
|
||||
MFSA-RESERVE-2024-1880692:
|
||||
title: Integer overflow could lead to out of bounds write
|
||||
impact: high
|
||||
reporter: Ronald Crane
|
||||
description: |
|
||||
AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding() and AppendEncodedCharacters() could experience integer overflows, causing underallocation of an output buffer leading to an out of bounds write.
|
||||
bugs:
|
||||
- url: 1880692
|
||||
MFSA-RESERVE-2024-1846197:
|
||||
title: Improve handling of out-of-memory conditions in ICU
|
||||
impact: high
|
||||
reporter: Ryan VanderMeulen and Dan Minor
|
||||
description: |
|
||||
To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead of attempt to continue.
|
||||
bugs:
|
||||
- url: 1846197
|
||||
CVE-2023-5388:
|
||||
title: NSS susceptible to timing attack against RSA decryption
|
||||
impact: moderate
|
||||
reporter: Hubert Kario
|
||||
description: |
|
||||
NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data.
|
||||
bugs:
|
||||
- url: 1780432
|
||||
MFSA-RESERVE-2024-1871112:
|
||||
title: Improper handling of html and body tags enables CSP nonce leakage
|
||||
impact: moderate
|
||||
reporter: Georg Felber and Marco Squarcina (TU Wien)
|
||||
description: |
|
||||
Using a markup injection an attacker could steal nonce values. This can be used to bypass strict content security policies.
|
||||
bugs:
|
||||
- url: 1871112
|
||||
MFSA-RESERVE-2024-1876675:
|
||||
title: Clickjacking vulnerability could lead to user accidentally granting permissions
|
||||
impact: moderate
|
||||
reporter: Hafiizh
|
||||
description: |
|
||||
A missing delay on when pointer lock is used could allow a malicious page to trick a user into granting permissions.
|
||||
bugs:
|
||||
- url: 1876675
|
||||
MFSA-RESERVE-2024-1879444:
|
||||
title: Self referencing object could potentially lead to a use-after-free
|
||||
impact: moderate
|
||||
reporter: Ronald Crane
|
||||
description: |
|
||||
If an attacker could find a way to trigger this code path it could trigger a crash or potentially be leveraged to achieve code execution.
|
||||
bugs:
|
||||
- url: 1879444
|
||||
MFSA-RESERVE-2024-2:
|
||||
title: Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9
|
||||
impact: high
|
||||
reporter: the Mozilla Fuzzing Team, Noah Lokocz, Kevin Brosnan [Ex-Mozilla], Ryan VanderMeulen
|
||||
description: |
|
||||
Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
|
||||
bugs:
|
||||
- url: 1685358, 1861016, 1880405, 1881093
|
||||
desc: Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9
|
||||
Загрузка…
Ссылка в новой задаче