CVSS: 5.9EPSS: 2%CPEs: 19EXPL: 0CVE-2015-7575 – TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH)
https://notcve.org/view.php?id=CVE-2015-7575
07 Jan 2016 — Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision. Mozilla Network Security Services (NSS) en versiones anteriores a 3.20.2, tal como se utiliza en Mozilla Firefox en versiones anteriores a 43.0.2 y Firefox ESR 38.x en versiones an... • http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html • CWE-19: Data Processing Errors •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2015-7211 – Ubuntu Security Notice USN-2833-1
https://notcve.org/view.php?id=CVE-2015-7211
16 Dec 2015 — Mozilla Firefox before 43.0 mishandles the # (number sign) character in a data: URI, which allows remote attackers to spoof web sites via unspecified vectors. Mozilla Firefox en versiones anteriores a 43.0 no maneja correctamente el carácter # (signo numérico) en un data: URI, lo que permite a atacantes remotos suplantar sitios web a través de vectores no especificados. Andrei Vaida, Jesse Ruderman, Bob Clary, Christian Holler, Jesse Ruderman, Eric Rahm, Robert Kaiser, Harald Kirschner, and Michael Henretty... • http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0CVE-2015-7219 – Ubuntu Security Notice USN-2833-1
https://notcve.org/view.php?id=CVE-2015-7219
16 Dec 2015 — The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service (integer underflow, assertion failure, and application exit) via a malformed PushPromise frame that triggers decompressed-buffer length miscalculation and incorrect memory allocation. La implementación HTTP/2 en Mozilla Firefox en versiones anteriores a 43.0 permite a atacantes remotos causar una denegación de servicio (Desbordamiento inferior de entero, fallo de aserción y salida de aplicación) a t... • http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html • CWE-189: Numeric Errors •
CVSS: 10.0EPSS: 3%CPEs: 15EXPL: 0CVE-2015-7201 – Mozilla: Miscellaneous memory safety hazards (rv:38.5) (MFSA 2015-134)
https://notcve.org/view.php?id=CVE-2015-7201
16 Dec 2015 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador en Mozilla Firefox en versiones anteriores a 43.0 y Firefox ESR 38.x en versiones anteriores a 38.5 permite a atacantes remotos causar una denegación de servicio (corrup... • http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0CVE-2015-7218 – Ubuntu Security Notice USN-2833-1
https://notcve.org/view.php?id=CVE-2015-7218
16 Dec 2015 — The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service (integer underflow, assertion failure, and application exit) via a single-byte header frame that triggers incorrect memory allocation. La implementación HTTP/2 en Mozilla Firefox en versiones anteriores a 43.0 permite a atacantes remotos causar una denegación de servicio (Desbordamiento inferior de entero, fallo de aserción y salida de aplicación) a través de un frame de cabecera de un solo byte que... • http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html • CWE-189: Numeric Errors •
CVSS: 10.0EPSS: 3%CPEs: 6EXPL: 0CVE-2015-7202 – Ubuntu Security Notice USN-2833-1
https://notcve.org/view.php?id=CVE-2015-7202
16 Dec 2015 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador en Mozilla Firefox en versiones anteriores a 43.0 permite a atacantes remotos causar una denegación de servicio (corrupción de memoria y caída de aplicación) o posiblemente ejecutar código arbitrario a ... • http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2015-7208 – Ubuntu Security Notice USN-2833-1
https://notcve.org/view.php?id=CVE-2015-7208
16 Dec 2015 — Mozilla Firefox before 43.0 stores cookies containing vertical tab characters, which allows remote attackers to obtain sensitive information by reading HTTP Cookie headers. Mozilla Firefox en versiones anteriores a 43.0 almacena las cookies que contienen caracteres de tabulación verticales, lo que permite a atacantes remotos obtener información sensible mediante la lectura de cabeceras HTTP Cookie. Andrei Vaida, Jesse Ruderman, Bob Clary, Christian Holler, Jesse Ruderman, Eric Rahm, Robert Kaiser, Harald Ki... • http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 6%CPEs: 15EXPL: 1CVE-2015-7214 – Mozilla: Cross-site reading attack through data: and view-source: URIs (MFSA 2015-149)
https://notcve.org/view.php?id=CVE-2015-7214
16 Dec 2015 — Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and view-source: URIs. Mozilla Firefox en versiones anteriores a 43.0 y Firefox ESR 38.x en versiones anteriores a 38.5 permite a atacantes remotos eludir la Same Origin Policy a través de data: y view-source: URIs. Andrei Vaida, Jesse Ruderman, Bob Clary, Christian Holler, Jesse Ruderman, Eric Rahm, Robert Kaiser, Harald Kirschner, and Michael Henretty discovered multiple memory sa... • https://github.com/llamakko/CVE-2015-7214 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 2%CPEs: 6EXPL: 0CVE-2015-7220 – Ubuntu Security Notice USN-2833-1
https://notcve.org/view.php?id=CVE-2015-7220
16 Dec 2015 — Buffer overflow in the XDRBuffer::grow function in js/src/vm/Xdr.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code. Desbordamiento de buffer en la función XDRBuffer::grow en js/src/vm/Xdr.cpp en Mozilla Firefox en versiones anteriores a 43.0 puede permitir a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto no especificado a través de código JavaScript manipula... • http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 1%CPEs: 6EXPL: 0CVE-2015-7223 – Ubuntu Security Notice USN-2833-1
https://notcve.org/view.php?id=CVE-2015-7223
16 Dec 2015 — The WebExtension APIs in Mozilla Firefox before 43.0 allow remote attackers to gain privileges, and possibly obtain sensitive information or conduct cross-site scripting (XSS) attacks, via a crafted web site. Las APIs WebExtension en Mozilla Firefox en versiones anteriores a 43.0 permite a atacantes remotos obtener privilegios y posiblemente obtener información sensible o llevar a cabo ataques de cross-site scripting (XSS) a través de un sitio web manipulado. Andrei Vaida, Jesse Ruderman, Bob Clary, Christi... • http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html • CWE-264: Permissions, Privileges, and Access Controls •