deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-7759
Published: 2018-06-11
Description: Android intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs to local "file:" URLs, allowing for the reading of local data through a violation of same-origin policy. Note: This attack only affects Firefox for Android. Other operating systems are not affected. This vulnerability affects Firefox < 54.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/99052; http://www.securitytracker.com/id/1038689; https://bugzilla.mozilla.org/show_bug.cgi?id=1356893
CVE: CVE-2017-7760
Published: 2018-06-11
Description: The Mozilla Windows updater modifies some files to be updated by reading the original file and applying changes to it. The location of the original file can be altered by a malicious user by passing a special path to the callback parameter through the Mozilla Maintenance Service, allowing the manipulation of files in the installation directory and privilege escalation by manipulating the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.
CVSS Score: 7.8 (HIGH)
CWE: CWE-417
References: http://www.securityfocus.com/bid/99057; http://www.securitytracker.com/id/1038689; https://bugzilla.mozilla.org/show_bug.cgi?id=1348645
CVE: CVE-2017-7761
Published: 2018-06-11
Description: The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction (a form of symbolic link), protected files in the target directory of the junction can be deleted by the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: http://www.securityfocus.com/bid/99057; http://www.securitytracker.com/id/1038689; https://bugzilla.mozilla.org/show_bug.cgi?id=1215648
CVE: CVE-2017-7762
Published: 2018-06-11
Description: When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar. This can be used for spoofing the domain of the current page. This vulnerability affects Firefox < 54.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/99047; http://www.securitytracker.com/id/1038689; https://access.redhat.com/errata/RHSA-2018:2112
CVE: CVE-2017-7763
Published: 2018-06-11
Description: Default fonts on OS X display some Tibetan characters as whitespace. When used in the addressbar as part of an IDN this can be used for domain name spoofing attacks. Note: This attack only affects OS X operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/99057; http://www.securitytracker.com/id/1038689; https://bugzilla.mozilla.org/show_bug.cgi?id=1360309
CVE: CVE-2017-7764
Published: 2018-06-11
Description: Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rendered as their raw "punycode" form, allowing for domain name spoofing attacks through character confusion. The current Unicode standard allows characters from "Aspirational Use Scripts" such as Canadian Syllabics to be mixed with Latin characters in the "moderately restrictive" IDN profile. We have changed Firefox behavior to match the upcoming Unicode version 10.0 which removes this category and treats them as "Limited Use Scripts.". This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/99057; http://www.securitytracker.com/id/1038689; http://www.unicode.org/reports/tr31/tr31-26.html#Aspirational_Use_Scripts
CVE: CVE-2017-7765
Published: 2018-06-11
Description: The "Mark of the Web" was not correctly saved on Windows when files with very long names were downloaded from the Internet. Without the Mark of the Web data, the security warning that Windows displays before running executables downloaded from the Internet is not shown. Note: This attack only affects Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/99057; http://www.securitytracker.com/id/1038689; https://bugzilla.mozilla.org/show_bug.cgi?id=1273265
CVE: CVE-2017-7766
Published: 2018-06-11
Description: An attack using manipulation of "updater.ini" contents, used by the Mozilla Windows Updater, and privilege escalation through the Mozilla Maintenance Service to allow for arbitrary file execution and deletion by the Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/99057; http://www.securitytracker.com/id/1038689; https://bugzilla.mozilla.org/show_bug.cgi?id=1342742
CVE: CVE-2017-7767
Published: 2018-06-11
Description: The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files with junk data using the Mozilla Windows Updater, which runs with the Maintenance Service's privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: http://www.securityfocus.com/bid/99057; http://www.securitytracker.com/id/1038689; https://bugzilla.mozilla.org/show_bug.cgi?id=1336964
CVE: CVE-2017-7768
Published: 2018-06-11
Description: The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by convincing the service that it is reading a status file provided by the Mozilla Windows Updater. The Mozilla Maintenance Service executes with privileged access, bypassing system protections against unprivileged users. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/99057; http://www.securitytracker.com/id/1038689; https://bugzilla.mozilla.org/show_bug.cgi?id=1336979
CVE: CVE-2017-7770
Published: 2018-06-11
Description: A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar will not be rendered. This would allow a malicious site to displayed a spoofed addressbar, showing the location of an arbitrary website instead of the one loaded. Note: this issue only affects Firefox for Android. Desktop Firefox is unaffected. This vulnerability affects Firefox < 54.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/99049; http://www.securitytracker.com/id/1038689; https://bugzilla.mozilla.org/show_bug.cgi?id=1317242
CVE: CVE-2017-7778
Published: 2018-06-11
Description: A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2 version 1.3.10. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-125, CWE-787
References: http://www.securityfocus.com/bid/99057; http://www.securitytracker.com/id/1038689; https://access.redhat.com/errata/RHSA-2017:1440
CVE: CVE-2017-7779
Published: 2018-06-11
Description: Memory safety bugs were reported in Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100201; http://www.securitytracker.com/id/1039124; https://access.redhat.com/errata/RHSA-2017:2456
CVE: CVE-2017-7780
Published: 2018-06-11
Description: Memory safety bugs were reported in Firefox 54. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 55.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100199; http://www.securitytracker.com/id/1039124; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1353763%2C1353356%2C1370070%2C1375435%2C1373663%2C1363150%2C1370817%2C1273678%2C1367850%2C1347968%2C1361749%2C1349138%2C1371982%2C1344666%2C1369836%2C1330739%2C1371511%2C1371484
CVE: CVE-2017-7781
Published: 2018-06-11
Description: An error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can yield a result "POINT_AT_INFINITY" when it should not. A man-in-the-middle attacker could use this to interfere with a connection, resulting in an attacked party computing an incorrect shared secret. This vulnerability affects Firefox < 55.
CVSS Score: 5.9 (MEDIUM)
References: http://www.securityfocus.com/bid/100383; http://www.securitytracker.com/id/1039124; https://bugzilla.mozilla.org/show_bug.cgi?id=1352039
CVE: CVE-2017-7782
Published: 2018-06-11
Description: An error in the "WindowsDllDetourPatcher" where a RWX ("Read/Write/Execute") 4k block is allocated but never protected, violating DEP protections. Note: This attack only affects Windows operating systems. Other operating systems are not affected. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269
References: http://www.securityfocus.com/bid/100243; http://www.securitytracker.com/id/1039124; https://bugzilla.mozilla.org/show_bug.cgi?id=1344034
CVE: CVE-2017-7783
Published: 2018-06-11
Description: If a long user name is used in a username/password combination in a site URL (such as " http://UserName:Password@example.com"), the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service. This vulnerability affects Firefox < 55.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/100401; http://www.securitytracker.com/id/1039124; https://bugzilla.mozilla.org/show_bug.cgi?id=1360842
CVE: CVE-2017-7784
Published: 2018-06-11
Description: A use-after-free vulnerability can occur when reading an image observer during frame reconstruction after the observer has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/100202; http://www.securitytracker.com/id/1039124; https://access.redhat.com/errata/RHSA-2017:2456
CVE: CVE-2017-7785
Published: 2018-06-11
Description: A buffer overflow can occur when manipulating Accessible Rich Internet Applications (ARIA) attributes within the DOM. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100206; http://www.securitytracker.com/id/1039124; https://access.redhat.com/errata/RHSA-2017:2456
CVE: CVE-2017-7786
Published: 2018-06-11
Description: A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100206; http://www.securitytracker.com/id/1039124; https://access.redhat.com/errata/RHSA-2017:2456
CVE: CVE-2017-7787
Published: 2018-06-11
Description: Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to information disclosure. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/100234; http://www.securitytracker.com/id/1039124; https://access.redhat.com/errata/RHSA-2017:2456
CVE: CVE-2017-7788
Published: 2018-06-11
Description: When an "iframe" has a "sandbox" attribute and its content is specified using "srcdoc", that content does not inherit the containing page's Content Security Policy (CSP) as it should unless the sandbox attribute included "allow-same-origin". This vulnerability affects Firefox < 55.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: http://www.securityfocus.com/bid/100379; http://www.securitytracker.com/id/1039124; https://bugzilla.mozilla.org/show_bug.cgi?id=1073952
CVE: CVE-2017-7789
Published: 2018-06-11
Description: If a server sends two Strict-Transport-Security (STS) headers for a single connection, they will be rejected as invalid and HTTP Strict Transport Security (HSTS) will not be enabled for the connection. This vulnerability affects Firefox < 55.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/100374; http://www.securitytracker.com/id/1039124; https://bugzilla.mozilla.org/show_bug.cgi?id=1074642
CVE: CVE-2017-7790
Published: 2018-06-11
Description: On Windows systems, if non-null-terminated strings are copied into the crash reporter for some specific registry keys, stack memory data can be copied until a null is found. This can potentially contain private data from the local system. Note: This attack only affects Windows operating systems. Other operating systems are not affected. This vulnerability affects Firefox < 55.
CVSS Score: 7.5 (HIGH)
References: http://www.securitytracker.com/id/1039124; https://bugzilla.mozilla.org/show_bug.cgi?id=1350460; https://www.mozilla.org/security/advisories/mfsa2017-18/
CVE: CVE-2017-7791
Published: 2018-06-11
Description: On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary domains following page navigation, spoofing of the origin of the modal alert from the iframe content. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/100240; http://www.securitytracker.com/id/1039124; https://access.redhat.com/errata/RHSA-2017:2456
CVE: CVE-2017-7792
Published: 2018-06-11
Description: A buffer overflow will occur when viewing a certificate in the certificate manager if the certificate has an extremely long object identifier (OID). This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/100206; http://www.securitytracker.com/id/1039124; https://access.redhat.com/errata/RHSA-2017:2456
CVE: CVE-2017-7793
Published: 2018-06-11
Description: A use-after-free vulnerability can occur in the Fetch API when the worker or the associated window are freed when still in use, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/101055; http://www.securitytracker.com/id/1039465; https://access.redhat.com/errata/RHSA-2017:2831
CVE: CVE-2017-7794
Published: 2018-06-11
Description: On Linux systems, if the content process is compromised, the sandbox broker will allow files to be truncated even though the sandbox explicitly only has read access to the local file system and no write permissions. Note: This attack only affects the Linux operating system. Other operating systems are not affected. This vulnerability affects Firefox < 55.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: http://www.securitytracker.com/id/1039124; https://bugzilla.mozilla.org/show_bug.cgi?id=1374281; https://www.mozilla.org/security/advisories/mfsa2017-18/
CVE: CVE-2017-7796
Published: 2018-06-11
Description: On Windows systems, the logger run by the Windows updater deletes the file "update.log" before it runs in order to write a new log of that name. The path to this file is supplied at the command line to the updater and could be used in concert with another local exploit to delete a different file named "update.log" instead of the one intended. Note: This attack only affects Windows operating systems. Other operating systems are not affected. This vulnerability affects Firefox < 55.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1039124; https://bugzilla.mozilla.org/show_bug.cgi?id=1234401; https://www.mozilla.org/security/advisories/mfsa2017-18/
CVE: CVE-2017-7797
Published: 2018-06-11
Description: Response header name interning does not have same-origin protections and these headers are stored in a global registry. This allows stored header names to be available cross-origin. This vulnerability affects Firefox < 55.
CVSS Score: 7.5 (HIGH)
CWE: CWE-346
References: http://www.securitytracker.com/id/1039124; https://bugzilla.mozilla.org/show_bug.cgi?id=1334776; https://www.mozilla.org/security/advisories/mfsa2017-18/
CVE: CVE-2017-7798
Published: 2018-06-11
Description: The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page source code. In the worst case, this could allow arbitrary code execution when opening a malicious page with the style editor tool. This vulnerability affects Firefox ESR < 52.3 and Firefox < 55.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/100198; http://www.securitytracker.com/id/1039124; https://access.redhat.com/errata/RHSA-2017:2456
CVE: CVE-2017-7799
Published: 2018-06-11
Description: JavaScript in the "about:webrtc" page is not sanitized properly being assigned to "innerHTML". Data on this page is supplied by WebRTC usage and is not under third-party control, making this difficult to exploit, but the vulnerability could possibly be used for a cross-site scripting (XSS) attack. This vulnerability affects Firefox < 55.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/100377; http://www.securitytracker.com/id/1039124; https://bugzilla.mozilla.org/show_bug.cgi?id=1372509
CVE: CVE-2017-7800
Published: 2018-06-11
Description: A use-after-free vulnerability can occur in WebSockets when the object holding the connection is freed before the disconnection operation is finished. This results in an exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/100196; http://www.securitytracker.com/id/1039124; https://access.redhat.com/errata/RHSA-2017:2456
CVE: CVE-2017-7801
Published: 2018-06-11
Description: A use-after-free vulnerability can occur while re-computing layout for a "marquee" element during window resizing where the updated style object is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/100197; http://www.securitytracker.com/id/1039124; https://access.redhat.com/errata/RHSA-2017:2456
CVE: CVE-2017-7802
Published: 2018-06-11
Description: A use-after-free vulnerability can occur when manipulating the DOM during the resize event of an image element. If these elements have been freed due to a lack of strong references, a potentially exploitable crash may occur when the freed elements are accessed. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/100202; http://www.securitytracker.com/id/1039124; https://access.redhat.com/errata/RHSA-2017:2456
CVE: CVE-2017-7803
Published: 2018-06-11
Description: When a page's content security policy (CSP) header contains a "sandbox" directive, other directives are ignored. This results in the incorrect enforcement of CSP. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: http://www.securityfocus.com/bid/100234; http://www.securitytracker.com/id/1039124; https://access.redhat.com/errata/RHSA-2017:2456
CVE: CVE-2017-7804
Published: 2018-06-11
Description: The destructor function for the "WindowsDllDetourPatcher" class can be re-purposed by malicious code in concert with another vulnerability to write arbitrary data to an attacker controlled location in memory. This can be used to bypass existing memory protections in this situation. Note: This attack only affects Windows operating systems. Other operating systems are not affected. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/100234; http://www.securitytracker.com/id/1039124; https://bugzilla.mozilla.org/show_bug.cgi?id=1372849
CVE: CVE-2017-7805
Published: 2018-06-11
Description: During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases, the handshake transcript can exceed the space available in the current buffer, causing the allocation of a new buffer. This leaves a pointer pointing to the old, freed buffer, resulting in a use-after-free when handshake hashes are then calculated afterwards. This can result in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/101059; http://www.securitytracker.com/id/1039465
CVE: CVE-2017-7806
Published: 2018-06-11
Description: A use-after-free vulnerability can occur when the layer manager is freed too early when rendering specific SVG content, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 55.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/100389; http://www.securitytracker.com/id/1039124; https://bugzilla.mozilla.org/show_bug.cgi?id=1378113
CVE: CVE-2017-7807
Published: 2018-06-11
Description: A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the domain. This has been addressed by requiring fallback files be inside the manifest directory. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/100242; http://www.securitytracker.com/id/1039124; https://access.redhat.com/errata/RHSA-2017:2456
CVE: CVE-2017-7808
Published: 2018-06-11
Description: A content security policy (CSP) "frame-ancestors" directive containing origins with paths allows for comparisons against those paths instead of the origin. This results in a cross-origin information leak of this path information. This vulnerability affects Firefox < 55.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-346
References: http://www.securityfocus.com/bid/100373; http://www.securitytracker.com/id/1039124; https://bugzilla.mozilla.org/show_bug.cgi?id=1367531