CVSS: 8.8EPSS: 4%CPEs: 2EXPL: 0CVE-2016-1979 – nss: Use-after-free during processing of DER encoded keys in NSS (MFSA 2016-36)
https://notcve.org/view.php?id=CVE-2016-1979
13 Mar 2016 — Use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data with DER encoding. Vulnerabilidad de uso después de liberación de memoria en la función PK11_ImportDERPrivateKeyInfoAndReturnKey en Mozilla Network Security Services (NSS) en versiones anteriores a 3.21.1, como s... • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html •
CVSS: 4.3EPSS: 0%CPEs: 18EXPL: 0CVE-2016-1958 – Mozilla: Displayed page address can be overridden (MFSA 2016-21)
https://notcve.org/view.php?id=CVE-2016-1958
09 Mar 2016 — browser/base/content/browser.js in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to spoof the address bar via a javascript: URL. browser/base/content/browser.js en Mozilla Firefox en versiones anteriores a 45.0 y Firefox ESR 38.x en versiones anteriores a 38.7 permite a atacantes remotos suplantar la barra de direcciones a través de un URL javascript:. Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS. If a user were tricked in to opening a spec... • http://hg.mozilla.org/releases/mozilla-release/rev/80ce3f1ffe03 • CWE-254: 7PK - Security Features •
CVSS: 8.8EPSS: 4%CPEs: 1EXPL: 0CVE-2016-1959 – Ubuntu Security Notice USN-2917-2
https://notcve.org/view.php?id=CVE-2016-1959
09 Mar 2016 — The ServiceWorkerManager class in Mozilla Firefox before 45.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via unspecified use of the Clients API. La clase ServiceWorkerManager en Mozilla Firefox en versiones anteriores a 45.0 permite a atacantes remotos ejecutar código arbitrario o causar una denegación del servicio (lectura fuera de rango y corrupción de memoria) a través del uso no especificado de la API Clients. Francis Gabriel... • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 95%CPEs: 22EXPL: 4CVE-2016-1960 – Mozilla Firefox nsHtml5TreeBuilder Array Indexing Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-1960
09 Mar 2016 — Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545. Desbordamiento inferior de entero en la clase nsHtml5TreeBuilder en el intérprete de cadenas HTML5 en Mozilla Firefox en versiones anteriores a 45.0 y Firefox ESR 38.x en ve... • https://packetstorm.news/files/id/146819 •
CVSS: 8.8EPSS: 11%CPEs: 22EXPL: 0CVE-2016-1961 – Mozilla Firefox nsHTMLDocument SetBody Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-1961
09 Mar 2016 — Use-after-free vulnerability in the nsHTMLDocument::SetBody function in dom/html/nsHTMLDocument.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of a root element, aka ZDI-CAN-3574. Vulnerabilidad de uso después de liberación de memoria en la función nsHTMLDocument::SetBody en dom/html/nsHTMLDocument.cpp en Mozilla Firefox en versiones anteriores a 45.0 y Firefox ESR 38.x en versiones anteriores a 38.7 permite a a... • http://hg.mozilla.org/releases/mozilla-release/rev/b208427885d3 •
CVSS: 10.0EPSS: 1%CPEs: 18EXPL: 0CVE-2016-1962 – Mozilla: Use-after-free when using multiple WebRTC data channels (MFSA 2016-25)
https://notcve.org/view.php?id=CVE-2016-1962
09 Mar 2016 — Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of WebRTC data-channel connections. Vulnerabilidad de uso después de liberación de memoria en la función mozilla::DataChannelConnection::Close en Mozilla Firefox en versiones anteriores a 45.0 y Firefox ESR 38.x en versiones anteriores a 38.7 permite a atacantes remotos ejecutar código ar... • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html • CWE-416: Use After Free •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2016-1963 – Ubuntu Security Notice USN-2917-2
https://notcve.org/view.php?id=CVE-2016-1963
09 Mar 2016 — The FileReader class in Mozilla Firefox before 45.0 allows local users to gain privileges or cause a denial of service (memory corruption) by changing a file during a FileReader API read operation. La clase FileReader en Mozilla Firefox en versiones anteriores a 45.0 permite a usuarios locales obtener privilegios o causar una denegación de servicio (corrupción de memoria) a través del cambio de archivo durante una operación de lectura de la API FileReader. Francis Gabriel discovered a buffer overflow during... • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 1%CPEs: 22EXPL: 0CVE-2016-1964 – Mozilla: Use-after-free during XML transformations (MFSA 2016-27)
https://notcve.org/view.php?id=CVE-2016-1964
09 Mar 2016 — Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging mishandling of XML transformations. Vulnerabilidad de uso después de liberación de memoria en la función AtomicBaseIncDec en Mozilla Firefox en versiones anteriores a 45.0 y Firefox ESR 38.x en versiones anteriores a 38.7 permite a atacantes remotos ejecutar código ar... • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html •
CVSS: 4.3EPSS: 0%CPEs: 18EXPL: 0CVE-2016-1965 – Mozilla: Addressbar spoofing though history navigation and Location protocol property (MFSA 2016-28)
https://notcve.org/view.php?id=CVE-2016-1965
09 Mar 2016 — Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers to spoof the address bar via vectors involving the history.back method and the location.protocol property. Mozilla Firefox en versiones anteriores a 45.0 y Firefox ESR 38.x en versiones anteriores a 38.7 no maneja correctamente la secuencia de navegación que devuelve a la página original, lo que permite a atacantes remotos suplantar la barra de direcci... • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html • CWE-254: 7PK - Security Features •
CVSS: 8.8EPSS: 0%CPEs: 19EXPL: 0CVE-2016-1966 – Mozilla: Memory corruption with malicious NPAPI plugin (MFSA 2016-31)
https://notcve.org/view.php?id=CVE-2016-1966
09 Mar 2016 — The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference and memory corruption) via a crafted NPAPI plugin. La función nsNPObjWrapper::GetNewOrUsed en dom/plugins/base/nsJSNPRuntime.cpp en Mozilla Firefox en versiones anteriores a 45.0 y Firefox ESR 38.x en versiones anteriores a 38.7 permite a atacantes remotos eje... • http://hg.mozilla.org/releases/mozilla-release/rev/f0d2911a9a4e •