CVSS: 10.0EPSS: 88%CPEs: 19EXPL: 1CVE-2012-0444 – Mozilla Firefox Ogg Vorbis Decoding Memory Corruption Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2012-0444
Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize nsChildView data structures, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Ogg Vorbis file. Mozilla Firefox v3.6.26 y v4.x hasta el v9.0, Thunderbird antes de v3.1.18 y v5.0 hasta la v9.0 y SeaMonkey antes de v2.7 no inicializa correctamente las estructuras de datos nsChildView, lo que permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria caida de la aplicación) o posiblemente ejecutar código de su elección a través de un archivo Ogg Vorbis debidamente manipulado. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Mozilla Firefox. • http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.html http://secunia.com/advisories/48043 http://secunia.com/advisories/48095 http://www.debian.org/security/2012/dsa-2400 http://www.debian.org/security/2012/dsa-2402 http://www.debian.org/security/2012/dsa-2406 http://www.mandriva.com/security/advisories?name=MDVSA- • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 3%CPEs: 15EXPL: 1CVE-2012-0442 – Mozilla: memory safety hazards in 10.0/1.9.2.26 (MFSA 2012-01)
https://notcve.org/view.php?id=CVE-2012-0442
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador de Mozilla Firefox antes de 3v.6.26 y v4.x hasta la v9.0, Thunderbird antes de v3.1.18 y v5.0 hasta la v9.0 y SeaMonkey antes de v2.7 permiten a atacantes remotos provocar una denegación de servicio (corrupción de memoria y bloqueo de la aplicación) o posiblemente ejecutar código de su elección a través de vectores desconocidos. • http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.html http://www.debian.org/security/2012/dsa-2400 http://www.debian.org/security/2012/dsa-2402 http://www.debian.org/security/2012/dsa-2406 http://www.mandriva.com/security/advisories?name=MDVSA-2012:013 http://www.mozilla.org/security/announce/2012/mfsa2012-01.html h •
CVSS: 10.0EPSS: 25%CPEs: 100EXPL: 0CVE-2011-3660
https://notcve.org/view.php?id=CVE-2011-3660
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors that trigger a compartment mismatch associated with the nsDOMMessageEvent::GetData function, and unknown other vectors. Múltiples vulnerabilidades no especificadas en en motor de navegación de Mozilla Firefox antes de v8.0, Thunderbird antes de v8.0, y SeaMonkey antes de v2.6, permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria y caída de la aplicacion) o posiblemente ejecutar código de su elección a través de vectores que provocan un desajuste de comportamiento con la función nsDOMMessageEvent::GetData y otros vectores desconocidos. • http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00009.html http://osvdb.org/77952 http://secunia.com/advisories/47302 http://secunia.com/advisories/47334 http://secunia.com/advisories/49055 http://www.mandriva.com/security/advisories?name=MDVSA-2011:192 http://www.mozilla.org/security/announce/2011/mfsa2011-53.html http://www.securitytracker.com/id?1026445 http://www.securitytracker.com/id?1026446 •
CVSS: 9.3EPSS: 0%CPEs: 25EXPL: 0CVE-2011-3655
https://notcve.org/view.php?id=CVE-2011-3655
Mozilla Firefox 4.x through 7.0 and Thunderbird 5.0 through 7.0 perform access control without checking for use of the NoWaiverWrapper wrapper, which allows remote attackers to gain privileges via a crafted web site. Mozilla Firefox 4.x hasta la 7.0 y Thunderbird 5.0 hasta la 7.0 realizan el control de acceso sin comprobar el uso del "wrapper" NoWaiverWrapper, lo que permite a atacantes remotos escalar privilegios a través de un sitio web modificado. • http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html http://secunia.com/advisories/49055 http://www.mozilla.org/security/announce/2011/mfsa2011-52.html https://bugzilla.mozilla.org/show_bug.cgi?id=672182 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14202 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 63%CPEs: 2EXPL: 0CVE-2011-3651
https://notcve.org/view.php?id=CVE-2011-3651
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 7.0 and Thunderbird 7.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador de Mozilla Firefox v7.0 y Thunderbird v7.0 permiten a atacantes remotos provocar una denegación de servicio (por corrupción de memoria y caída de la aplicación) o posiblemente ejecutar código de su elección a través de vectores desconocidos. • http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html http://secunia.com/advisories/49055 http://www.mozilla.org/security/announce/2011/mfsa2011-48.html https://bugzilla.mozilla.org/show_bug.cgi?id=646968 https://bugzilla.mozilla.org/show_bug.cgi?id=652054 https://bugzilla.mozilla.org/show_bug.cgi?id=665070 https://bugzilla.mozilla.org/show_bug.cgi?id=671160 https://bugzilla.mozilla.org/show_bug.cgi? •