CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5266 – Gentoo Linux Security Advisory 201701-15
https://notcve.org/view.php?id=CVE-2016-5266
05 Aug 2016 — Mozilla Firefox before 48.0 does not properly restrict drag-and-drop (aka dataTransfer) actions for file: URIs, which allows user-assisted remote attackers to access local files via a crafted web site. Mozilla Firefox en versiones anteriores a 48.0 no restringe adecuadamente acciones arrastrar y soltar (también conocido como dataTransfer) para file: URIs, lo que permite a atacantes remotos asistidos por usuario acceder a archivos locales a través de un sitio web manipulado. Gustavo Grieco discovered an out-... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5268 – Gentoo Linux Security Advisory 201701-15
https://notcve.org/view.php?id=CVE-2016-5268
05 Aug 2016 — Mozilla Firefox before 48.0 does not properly set the LINKABLE and URI_SAFE_FOR_UNTRUSTED_CONTENT flags of about: URLs that are used for error pages, which makes it easier for remote attackers to conduct spoofing attacks via a crafted URL, as demonstrated by misleading text after an about:neterror?d= substring. Mozilla Firefox en versiones anteriores a 48.0 no fija adecuadamente los indicadores LINKABLE y URI_SAFE_FOR_UNTRUSTED_CONTENT de about: URLs que se usan para páginas de error, lo que facilita a atac... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html • CWE-254: 7PK - Security Features •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-5255 – Gentoo Linux Security Advisory 201701-15
https://notcve.org/view.php?id=CVE-2016-5255
05 Aug 2016 — Use-after-free vulnerability in the js::PreliminaryObjectArray::sweep function in Mozilla Firefox before 48.0 allows remote attackers to execute arbitrary code via crafted JavaScript that is mishandled during incremental garbage collection. Vulnerabilidad de uso después de liberación de memoria en la función js::PreliminaryObjectArray::sweep en Mozilla Firefox en versiones anteriores a 48.0 permite a atacantes remotos ejecutar código arbitrario a través de JavaScript manipulado que es manejado incorrectamen... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html • CWE-416: Use After Free •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2016-2830 – Mozilla: Favicon network connection persists when page is closed (MFSA 2016-62)
https://notcve.org/view.php?id=CVE-2016-2830
03 Aug 2016 — Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 preserve the network connection used for favicon resource retrieval after the associated browser window is closed, which makes it easier for remote web servers to track users by observing network traffic from multiple IP addresses. Mozilla Firefox en versiones anteriores a 48.0 y Firefox ESR 45.x en versiones anteriores a 45.3 conserva la conexión de red usada para la recuperación de recursos favicon después de que la ventana del navegador asociad... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2016-2836 – Mozilla: Miscellaneous memory safety hazards (rv:45.3) (MFSA 2016-62)
https://notcve.org/view.php?id=CVE-2016-2836
03 Aug 2016 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to Http2Session::Shutdown and SpdySession31::Shutdown, and other vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador en Mozilla Firefox en versiones anteriores a 48.0 y Firefox ESR 45.x en versiones anteriores a 4... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 0%CPEs: 8EXPL: 0CVE-2016-2837 – Mozilla Firefox ClearKeyDecryptor Heap Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-2837
03 Aug 2016 — Heap-based buffer overflow in the ClearKey Content Decryption Module (CDM) in the Encrypted Media Extensions (EME) API in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 might allow remote attackers to execute arbitrary code by providing a malformed video and leveraging a Gecko Media Plugin (GMP) sandbox bypass. Desbordamiento de búfer basado en memoria dinámica en el ClearKey Content Decryption Module (CDM) en el Encrypted Media Extensions (EME) API en Mozilla Firefox en versiones anteriores a... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2016-5262 – Mozilla: Scripts on marquee tag can execute in sandboxed iframes (MFSA 2016-76)
https://notcve.org/view.php?id=CVE-2016-5262
03 Aug 2016 — Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 process JavaScript event-handler attributes of a MARQUEE element within a sandboxed IFRAME element that lacks the sandbox="allow-scripts" attribute value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site. Mozilla Firefox en versiones anteriores a 48.0 y Firefox ESR 45.x en versiones anteriores a 45.3 procesa atributos de controladores de eventos JavaScript de un elemento MARQUEE dentro... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 1CVE-2016-5264 – Mozilla: Use-after-free when applying SVG effects (MFSA 2016-79)
https://notcve.org/view.php?id=CVE-2016-5264
03 Aug 2016 — Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application. Vulnerabilidad de uso después de liberación de memoria en la función nsNodeUtils::NativeAnonymousChildListChange en Mozilla Firefox en versiones anteriores a 48.0 y Firefox ESR 45.x en versi... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2016-5265 – Mozilla: Same-origin policy violation using local HTML file and saved shortcut file (MFSA 2016-80)
https://notcve.org/view.php?id=CVE-2016-5265
03 Aug 2016 — Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same local directory. Mozilla Firefox en versiones anteriores a 48.0 y Firefox ESR 45.x en versiones anteriores a 45.3 permite a atacantes remotos asistidos por usuario eludir el Same Origin Policy, y llevar a cabo ataques... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2016-2838 – Mozilla: Buffer overflow rendering SVG with bidirectional content (MFSA 2016-64)
https://notcve.org/view.php?id=CVE-2016-2838
03 Aug 2016 — Heap-based buffer overflow in the nsBidi::BracketData::AddOpening function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via directional content in an SVG document. Desbordamiento de búfer basado en memoria dinámica en la función nsBidi::BracketData::AddOpening en Mozilla Firefox en versiones anteriores a 48.0 y Firefox ESR 45.x en versiones anteriores a 45.3 permite a atacantes remotos ejecutar código arbitrario a través de un contenido di... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •