CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2016-2812 – Gentoo Linux Security Advisory 201701-15
https://notcve.org/view.php?id=CVE-2016-2812
28 Apr 2016 — Race condition in the get implementation in the ServiceWorkerManager class in the Service Worker subsystem in Mozilla Firefox before 46.0 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted web site. Condición de carrera en la implementación de get en la clase ServiceWorkerManager en el subsistema Service Worker en Mozilla Firefox en versiones anteriores a 46.0 permite a atacantes remotos ejecutar código arbitrario o provocar u... • http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00005.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-2816 – Gentoo Linux Security Advisory 201701-15
https://notcve.org/view.php?id=CVE-2016-2816
28 Apr 2016 — Mozilla Firefox before 46.0 allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via the multipart/x-mixed-replace content type. Mozilla Firefox en versiones anteriores a 46.0 permite a atacantes remotos eludir el mecanismo de protección Content Security Policy (CSP) a través del tipo de contenido multipart/x-mixed-replace. USN-2936-1 fixed vulnerabilities in Firefox. The update caused an issue where a device update POST request was sent every time about:preferences#sync ... • http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00005.html • CWE-284: Improper Access Control •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2016-2817 – Gentoo Linux Security Advisory 201701-15
https://notcve.org/view.php?id=CVE-2016-2817
28 Apr 2016 — The WebExtension sandbox feature in browser/components/extensions/ext-tabs.js in Mozilla Firefox before 46.0 does not properly restrict principal inheritance during chrome.tabs.create and chrome.tabs.update API calls, which allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted extension that accesses a (1) javascript: or (2) data: URL. La funcionalidad de sandbox WebExtension en browser/components/extensions/ext-tabs.js en Mozilla Firefox en versiones anteriores a 46.0 no restringe a... • http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00005.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 1%CPEs: 1EXPL: 0CVE-2016-2820 – Gentoo Linux Security Advisory 201701-15
https://notcve.org/view.php?id=CVE-2016-2820
28 Apr 2016 — The Firefox Health Reports (aka FHR or about:healthreport) feature in Mozilla Firefox before 46.0 does not properly restrict the origin of events, which makes it easier for remote attackers to modify sharing preferences by leveraging access to the remote-report IFRAME element. La funcionalidad Firefox Health Reports (también conocida como FHR o about:healthreport) en Mozilla Firefox en versiones anteriores a 46.0 no restringe adecuadamente el origen de eventos, lo que facilita a atacantes remotos modificar ... • http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00005.html • CWE-284: Improper Access Control •
CVSS: 10.0EPSS: 2%CPEs: 7EXPL: 0CVE-2016-2806 – Mozilla: Miscellaneous memory safety hazards (rv:46.0 / rv:45.1) (MFSA 2016-39)
https://notcve.org/view.php?id=CVE-2016-2806
26 Apr 2016 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0 and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador en Mozilla Firefox en versiones anteriores a 46.0 y Firefox ESR 45.x en versiones anteriores a 45.1 permiten a atacantes remotos provocar una denegación de servicio (cor... • http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00005.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 1%CPEs: 21EXPL: 0CVE-2016-2807 – Mozilla: Miscellaneous memory safety hazards (rv:46.0 / rv:45.1 / rv:38.8) (MFSA 2016-39)
https://notcve.org/view.php?id=CVE-2016-2807
26 Apr 2016 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador en Mozilla Firefox en versiones anteriores a 46.0, Firefox ESR 38.x en versiones anteriores a 38.8 y Firefox ESR 45.x en versiones anterio... • http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00005.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 2%CPEs: 17EXPL: 0CVE-2016-2808 – Mozilla: Write to invalid HashMap entry through JavaScript.watch() (MFSA 2016-47)
https://notcve.org/view.php?id=CVE-2016-2808
26 Apr 2016 — The watch implementation in the JavaScript engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code or cause a denial of service (generation-count overflow, out-of-bounds HashMap write access, and application crash) via a crafted web site. La implementación de watch en el motor JavaScript en Mozilla Firefox en versiones anteriores a 46.0, Firefox ESR 38.x en versiones anteriores a 38.8 y Firefox ESR 45.x en versio... • http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00005.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 17%CPEs: 17EXPL: 0CVE-2016-2814 – Mozilla: Buffer overflow in libstagefright with CENC offsets (MFSA 2016-44)
https://notcve.org/view.php?id=CVE-2016-2814
26 Apr 2016 — Heap-based buffer overflow in the stagefright::SampleTable::parseSampleCencInfo function in libstagefright in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code via crafted CENC offsets that lead to mismanagement of the sizes table. Desbordamiento de buffer basado en memoria dinámica en la función stagefright::SampleTable::parseSampleCencInfo en libstagefright en Mozilla Firefox en versiones anteriores a 46.0, Firefox... • http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00005.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 0%CPEs: 14EXPL: 0CVE-2016-1969 – mozilla: out-of-bounds write with malicious font in graphite2 (MFSA 2016-38)
https://notcve.org/view.php?id=CVE-2016-1969
13 Mar 2016 — The setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.6.1, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted Graphite smart font. La función setAttr en Graphite 2 en versiones anteriores a 1.3.6, como se utiliza en Mozilla Firefox en versiones anteriores a 45.0 y Firefox ESR 38.x en versiones anteriores a 38.6.1, permite a atacantes remotos causar una denegación d... • http://www.mozilla.org/security/announce/2016/mfsa2016-38.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 2%CPEs: 2EXPL: 0CVE-2016-1970 – Gentoo Linux Security Advisory 201605-06
https://notcve.org/view.php?id=CVE-2016-1970
13 Mar 2016 — Integer underflow in the srtp_unprotect function in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors. Desbordamiento inferior de entero en la función srtp_unprotect en la implementación de WebRTC en Mozilla Firefox en versiones anteriores a 45.0 en Windows podría permitir a atacantes remotos causar una denegación de servicio (corrupción de memoria) o ... • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •