CVSS: 10.0EPSS: 1%CPEs: 18EXPL: 0CVE-2016-1962 – Mozilla: Use-after-free when using multiple WebRTC data channels (MFSA 2016-25)
https://notcve.org/view.php?id=CVE-2016-1962
09 Mar 2016 — Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of WebRTC data-channel connections. Vulnerabilidad de uso después de liberación de memoria en la función mozilla::DataChannelConnection::Close en Mozilla Firefox en versiones anteriores a 45.0 y Firefox ESR 38.x en versiones anteriores a 38.7 permite a atacantes remotos ejecutar código ar... • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html • CWE-416: Use After Free •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2016-1963 – Ubuntu Security Notice USN-2917-2
https://notcve.org/view.php?id=CVE-2016-1963
09 Mar 2016 — The FileReader class in Mozilla Firefox before 45.0 allows local users to gain privileges or cause a denial of service (memory corruption) by changing a file during a FileReader API read operation. La clase FileReader en Mozilla Firefox en versiones anteriores a 45.0 permite a usuarios locales obtener privilegios o causar una denegación de servicio (corrupción de memoria) a través del cambio de archivo durante una operación de lectura de la API FileReader. Francis Gabriel discovered a buffer overflow during... • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 1%CPEs: 22EXPL: 0CVE-2016-1964 – Mozilla: Use-after-free during XML transformations (MFSA 2016-27)
https://notcve.org/view.php?id=CVE-2016-1964
09 Mar 2016 — Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging mishandling of XML transformations. Vulnerabilidad de uso después de liberación de memoria en la función AtomicBaseIncDec en Mozilla Firefox en versiones anteriores a 45.0 y Firefox ESR 38.x en versiones anteriores a 38.7 permite a atacantes remotos ejecutar código ar... • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html •
CVSS: 4.3EPSS: 0%CPEs: 18EXPL: 0CVE-2016-1965 – Mozilla: Addressbar spoofing though history navigation and Location protocol property (MFSA 2016-28)
https://notcve.org/view.php?id=CVE-2016-1965
09 Mar 2016 — Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers to spoof the address bar via vectors involving the history.back method and the location.protocol property. Mozilla Firefox en versiones anteriores a 45.0 y Firefox ESR 38.x en versiones anteriores a 38.7 no maneja correctamente la secuencia de navegación que devuelve a la página original, lo que permite a atacantes remotos suplantar la barra de direcci... • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html • CWE-254: 7PK - Security Features •
CVSS: 8.8EPSS: 0%CPEs: 19EXPL: 0CVE-2016-1966 – Mozilla: Memory corruption with malicious NPAPI plugin (MFSA 2016-31)
https://notcve.org/view.php?id=CVE-2016-1966
09 Mar 2016 — The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference and memory corruption) via a crafted NPAPI plugin. La función nsNPObjWrapper::GetNewOrUsed en dom/plugins/base/nsJSNPRuntime.cpp en Mozilla Firefox en versiones anteriores a 45.0 y Firefox ESR 38.x en versiones anteriores a 38.7 permite a atacantes remotos eje... • http://hg.mozilla.org/releases/mozilla-release/rev/f0d2911a9a4e •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-1967 – Ubuntu Security Notice USN-2917-2
https://notcve.org/view.php?id=CVE-2016-1967
09 Mar 2016 — Mozilla Firefox before 45.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls after restoring a browser session. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-7207. Mozilla Firefox en versiones anteriores a 45.0 no restringe correctamente la disponibilidad de los tiem... • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 4%CPEs: 1EXPL: 0CVE-2016-1968 – Ubuntu Security Notice USN-2917-2
https://notcve.org/view.php?id=CVE-2016-1968
09 Mar 2016 — Integer underflow in Brotli, as used in Mozilla Firefox before 45.0, allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted data with brotli compression. Desbordamiento inferior de entero en Brotli, como se utiliza en Mozilla Firefox en versiones anteriores a 45.0, permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (desbordamiento de buffer) a través de datos manipulados con compresión brotli. Francis Gabriel disco... • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html • CWE-189: Numeric Errors •
CVSS: 8.8EPSS: 1%CPEs: 4EXPL: 0CVE-2016-1973 – Mozilla: Use-after-free in GetStaticInstance in WebRTC (MFSA 2016-33)
https://notcve.org/view.php?id=CVE-2016-1973
09 Mar 2016 — Race condition in the GetStaticInstance function in the WebRTC implementation in Mozilla Firefox before 45.0 might allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via unspecified vectors. Condición de carrera en la función GetStaticInstance en la implementación de WebRTC en Mozilla Firefox en versiones anteriores a 45.0 podría permitir a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (uso después de liberación de memoria) a tra... • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html •
CVSS: 8.8EPSS: 1%CPEs: 22EXPL: 0CVE-2016-1974 – Mozilla: Out-of-bounds read in HTML parser following a failed allocation (MFSA 2016-34)
https://notcve.org/view.php?id=CVE-2016-1974
09 Mar 2016 — The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not verify that memory allocation succeeds, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via crafted Unicode data in an HTML, XML, or SVG document. La función nsScannerString::AppendUnicodeTo en Mozilla Firefox en versiones anteriores a 45.0 y Firefox ESR 38.x en versiones anteriores a 38.7 no verifica que la asignación de memoria ten... • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 2%CPEs: 22EXPL: 0CVE-2016-1977 – graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)
https://notcve.org/view.php?id=CVE-2016-1977
09 Mar 2016 — The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted Graphite smart font. La función Machine::Code::decoder::analysis::set_ref en Graphite 2 en versiones anteriores a 1.3.6, como se utiliza en Mozilla Firefox en versiones anteriores a 45.0 y Firefox ESR 38.x en versiones anteriores a 38.7,... • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •