CVSS: 8.8EPSS: 2%CPEs: 26EXPL: 1CVE-2014-1497 – Mozilla: Out of bounds read during WAV file decoding (MFSA 2014-17)
https://notcve.org/view.php?id=CVE-2014-1497
The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process heap memory, cause a denial of service (out-of-bounds read and application crash), or possibly have unspecified other impact via a crafted WAV file. La función mozilla::WaveReader::DecodeAudioData en Mozilla Firefox anterior a 28.0, Firefox ESR 24.x anterior a 24.4, Thunderbird anterior a 24.4 y SeaMonkey anterior a 2.25 permite a atacantes remotos obtener información sensible de memoria dinámica de procesos, causar una denegación de servicio (lectura fuera de rango y caída de aplicación), o posiblemente tener otro impacto no especificado a través de un archivo WAV manipulado. • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00016.html http://rhn.redhat.com/errata/RHSA-2014-0310.html http://rhn.redhat.com/errata/RHSA-2014-0316.html http://www.debian.org/security/2014/dsa-2881 http://www.debian.org/security/2014/dsa-2911 • CWE-125: Out-of-bounds Read •
CVSS: 4.3EPSS: 0%CPEs: 153EXPL: 0CVE-2014-2018
https://notcve.org/view.php?id=CVE-2014-2018
Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in a (1) OBJECT or (2) EMBED element, a related issue to CVE-2013-6674. Vulnerabilidad de XSS en Mozilla Thunderbird 17.x hasta 17.0.8, Thunderbird ESR 17.x hasta 17.0.10 y SeaMonkey anterior a 2.20 permite a atacantes remotos asistidos por usuario inyectar script Web o HTML arbitrarios a través de un mensaje de e-mail que contiene un dato: URL en un elemento (1) OBJECT o (2) EMBED, un problema relacionado con CVE-2013-6674. • http://www.kb.cert.org/vuls/id/863369 http://www.mozilla.org/security/announce/2014/mfsa2014-14.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securitytracker.com/id/1029773 http://www.securitytracker.com/id/1029774 http://www.vulnerability-lab.com/get_content.php?id=953 https://bugzilla.mozilla.org/show_bug.cgi?id=875818 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.1EPSS: 94%CPEs: 157EXPL: 3CVE-2013-6674 – Mozilla Thunderbird 17.0.6 - Input Validation Filter Bypass
https://notcve.org/view.php?id=CVE-2013-6674
Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in an IFRAME element, a related issue to CVE-2014-2018. Vulnerabilidad de XSS en Mozilla Thunderbird 17.x hasta 17.0.8, Thunderbird ESR 17.x hasta 17.0.10 y SeaMonkey anterior a 2.20 permite a atacantes remotos asistidos por usuario inyectar script Web o HTML arbitrarios a través de un mensaje de e-mail que contiene un dato: URL en un elemento IFRAME, un problema relacionado con CVE-2014-2018. • https://www.exploit-db.com/exploits/31223 http://osvdb.org/102566 http://packetstormsecurity.com/files/124965/Mozilla-Thunderbird-Filter-Bypass.html http://seclists.org/fulldisclosure/2014/Jan/182 http://www.kb.cert.org/vuls/id/863369 http://www.mozilla.org/security/announce/2014/mfsa2014-14.html http://www.securitytracker.com/id/1029773 http://www.securitytracker.com/id/1029774 http://www.ubuntu.com/usn/USN-2119-1 https://bugzilla.mozilla.org/show_bug.cgi?id=868267 https • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 1%CPEs: 9EXPL: 0CVE-2014-1478
https://notcve.org/view.php?id=CVE-2014-1478
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the MPostWriteBarrier class in js/src/jit/MIR.h and stack alignment in js/src/jit/AsmJS.cpp in OdinMonkey, and unknown other vectors. Múltiples vulnerabilidades no especificadas en el motor de navegación en Mozilla Firefox anterior a 27.0 y SeaMonkey anterior a 2.24 permite a atacantes remotos causar una denegación de servicio (corrupción de memoria y caída de la aplicación) o posiblemente ejecutar un código arbitrario a través de vectores relacionados con la clase MPostWriteBarrier en js/src/jit/MIR.h y alineación de pila en js/src/jit/AsmJS.cpp en OdinMonkey y otros vectores desconocidos. • http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html http://osvdb.org/102865 http://secunia.com/advisories/56706 http://secunia.com/advisories/56767 http://secunia.com/advisories/56787 http://secunia.com/advisories/56888 http://secunia.com/advisories/56922 http://www.mozilla.org/security/announce/2014/mfsa2014-01.html& • CWE-787: Out-of-bounds Write •
CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 0CVE-2014-1480
https://notcve.org/view.php?id=CVE-2014-1480
The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which allows remote attackers to conduct clickjacking attacks, and trigger unintended launching of a downloaded file, via a crafted web site. La implementación de descarga de archivos en Mozilla Firefox anterior a 27.0 y SeaMonkey anterior a 2.24 no restringe debidamente el tiempo de las selecciones de botón, lo que permite a atacantes remotos llevar a cabo ataques de clickjacking y provocar el lanzamiento no intencionado de un archivo descargado, a través de un sitio web manipulado. • http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html http://osvdb.org/102867 http://secunia.com/advisories/56888 http://www.mozilla.org/security/announce/2014/mfsa2014-03.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securityfocus.com/bid/65331 http://www.securitytracker.com/id • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •