CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5282 – Gentoo Linux Security Advisory 201701-15
https://notcve.org/view.php?id=CVE-2016-5282
22 Sep 2016 — Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests, which might allow remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by a jar: URL for a favicon resource. Mozilla Firefox en versiones anteriores a 49.0 no restringe adecuadamente el esquema en peticiones favicon, lo que podría permitir a atacantes remotos obtener información sensible a través de vectores no especificados, según lo demostrado por una URL jar: para un recurso favicon... • http://www.mozilla.org/security/announce/2016/mfsa2016-85.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5283 – Gentoo Linux Security Advisory 201701-15
https://notcve.org/view.php?id=CVE-2016-5283
22 Sep 2016 — Mozilla Firefox before 49.0 allows remote attackers to bypass the Same Origin Policy via a crafted fragment identifier in the SRC attribute of an IFRAME element, leading to insufficient restrictions on link-color information after a document is resized. Mozilla Firefox en versiones anteriores a 49.0 permite a atacantes remotos eludir la Same Origin Policy a través de un identificador de fragmento manipulado en el atributo SRC de un elemento IFRAME, dando lugar a restricciones insuficientes en información de... • http://www.mozilla.org/security/announce/2016/mfsa2016-85.html • CWE-284: Improper Access Control •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2016-5257 – Mozilla: Memory safety bugs fixed in Firefox ESR 45.4 (MFSA 2016-85, MFSA 2016-86)
https://notcve.org/view.php?id=CVE-2016-5257
21 Sep 2016 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4 and Thunderbird < 45.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador en Mozilla Firefox en versiones anteriores a la 49.0, Firefox ESR en versiones 45.x anteriores a la 45.4 y Thunderbird en versiones anteriores a la 4... • http://rhn.redhat.com/errata/RHSA-2016-1912.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 2%CPEs: 5EXPL: 0CVE-2016-5270 – Mozilla: Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString (MFSA 2016-85, MFSA 2016-86)
https://notcve.org/view.php?id=CVE-2016-5270
21 Sep 2016 — Heap-based buffer overflow in the nsCaseTransformTextRunFactory::TransformString function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to cause a denial of service (boolean out-of-bounds write) or possibly have unspecified other impact via Unicode characters that are mishandled during text conversion. Desbordamiento de búfer basado en memoria dinámica (heap) en la función nsCaseTransformTextRunFactory::TransformString en Mozilla Firefox en vers... • http://rhn.redhat.com/errata/RHSA-2016-1912.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2016-5272 – Mozilla: Bad cast in nsImageGeometryMixin (MFSA 2016-85, MFSA 2016-86)
https://notcve.org/view.php?id=CVE-2016-5272
21 Sep 2016 — The nsImageGeometryMixin class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements, which allows remote attackers to execute arbitrary code via a crafted web site. La clase nsImageGeometryMixin en Mozilla Firefox en versiones anteriores a la 49.0, Firefox ESR en versiones 45.x anteriores a la 45.4 y Thunderbird en versiones anteriores a la 45.4 no devuelve correctamente una variable... • http://rhn.redhat.com/errata/RHSA-2016-1912.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 1%CPEs: 5EXPL: 0CVE-2016-5274 – Mozilla: use-after-free in nsFrameManager::CaptureFrameState (MFSA 2016-85, MFSA 2016-86)
https://notcve.org/view.php?id=CVE-2016-5274
21 Sep 2016 — Use-after-free vulnerability in the nsFrameManager::CaptureFrameState function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between restyling and the Web Animations model implementation. Vulnerabilidad de uso de memoria previamente liberada en la función nsFrameManager::CaptureFrameState en Mozilla Firefox en versiones 45.x anteriores a la 49.0, Firefox ESR en versiones anteriores a l... • http://rhn.redhat.com/errata/RHSA-2016-1912.html • CWE-416: Use After Free •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2016-5276 – Mozilla: Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList (MFSA 2016-85, MFSA 2016-86)
https://notcve.org/view.php?id=CVE-2016-5276
21 Sep 2016 — Use-after-free vulnerability in the mozilla::a11y::DocAccessible::ProcessInvalidationList function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an aria-owns attribute. Vulnerabilidad de uso de memoria previamente liberada en la función mozilla::a11y::DocAccessible::ProcessInvalidationList en Mozilla Firefox en versiones anteriores a la 49.0, Firefox ESR en versi... • http://rhn.redhat.com/errata/RHSA-2016-1912.html • CWE-416: Use After Free •
CVSS: 9.8EPSS: 1%CPEs: 5EXPL: 0CVE-2016-5277 – Mozilla: Heap-use-after-free in nsRefreshDriver::Tick (MFSA 2016-85, MFSA 2016-86)
https://notcve.org/view.php?id=CVE-2016-5277
21 Sep 2016 — Use-after-free vulnerability in the nsRefreshDriver::Tick function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging improper interaction between timeline destruction and the Web Animations model implementation. Vulnerabilidad de uso de memoria previamente liberada en la función nsRefreshDriver::Tick en Mozilla Firefox en versiones anteriores a la 49.0, Fir... • http://rhn.redhat.com/errata/RHSA-2016-1912.html • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 5EXPL: 0CVE-2016-5278 – Mozilla: Heap-buffer-overflow in nsBMPEncoder::AddImageFrame (MFSA 2016-85, MFSA 2016-86)
https://notcve.org/view.php?id=CVE-2016-5278
21 Sep 2016 — Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image. Desbordamiento de búfer basado en memoria dinámica (heap) en la función nsBMPEncoder::AddImageFrame en Mozilla Firefox en versiones anteriores a la 49.0, Firefox ESR en versiones 45.x anteriores a la 45.4 y Thun... • http://rhn.redhat.com/errata/RHSA-2016-1912.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 1%CPEs: 7EXPL: 0CVE-2016-5280 – Mozilla: Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap (MFSA 2016-85, MFSA 2016-86)
https://notcve.org/view.php?id=CVE-2016-5280
21 Sep 2016 — Use-after-free vulnerability in the mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via bidirectional text. Vulnerabilidad de uso de memoria previamente liberada en la función mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap en Mozilla Firefox en versiones anteriores a la 49.0, Firefox ESR en versiones 45.x anteriores a la 45.4 y Thunderbird en ... • http://rhn.redhat.com/errata/RHSA-2016-1912.html • CWE-416: Use After Free •