CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2016-5297 – Mozilla: Incorrect argument length checking in Javascript (MFSA 2016-89, MFSA 2016-90)
https://notcve.org/view.php?id=CVE-2016-5297
An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50. Un error en la comprobación de lógica de argumentos en JavaScript conduce a potenciales desbordamientos de enteros u otros problemas de comprobación de límites. La vulnerabilidad afecta a Thunderbird en versiones anteriores a la 45.5, Firefox ESR en versiones anteriores a la 45.5 y Firefox en versiones anteriores a la 50. • http://rhn.redhat.com/errata/RHSA-2016-2780.html http://www.securityfocus.com/bid/94336 http://www.securitytracker.com/id/1037298 https://bugzilla.mozilla.org/show_bug.cgi?id=1303678 https://security.gentoo.org/glsa/201701-15 https://www.debian.org/security/2016/dsa-3730 https://www.mozilla.org/security/advisories/mfsa2016-89 https://www.mozilla.org/security/advisories/mfsa2016-90 https://www.mozilla.org/security/advisories/mfsa2016-93 https://access.redhat.com/security/cve&#x • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 5%CPEs: 5EXPL: 0CVE-2016-5274 – Mozilla: use-after-free in nsFrameManager::CaptureFrameState (MFSA 2016-85, MFSA 2016-86)
https://notcve.org/view.php?id=CVE-2016-5274
Use-after-free vulnerability in the nsFrameManager::CaptureFrameState function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between restyling and the Web Animations model implementation. Vulnerabilidad de uso de memoria previamente liberada en la función nsFrameManager::CaptureFrameState en Mozilla Firefox en versiones 45.x anteriores a la 49.0, Firefox ESR en versiones anteriores a la 45.4 y Thunderbird en versiones anteriores a la 45.4 permite que los atacantes remotos ejecuten código arbitrario utilizando la interacción errónea entre el restyling y la implementación del modelo Web Animations. • http://rhn.redhat.com/errata/RHSA-2016-1912.html http://www.debian.org/security/2016/dsa-3674 http://www.mozilla.org/security/announce/2016/mfsa2016-85.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html http://www.securityfocus.com/bid/93049 http://www.securitytracker.com/id/1036852 https://bugzilla.mozilla.org/show_bug.cgi?id=1282076 https://security.gentoo.org/glsa/201701-15 https://www.mozilla.org/security/advisories/mfsa2016-86 https:// • CWE-416: Use After Free •
CVSS: 9.8EPSS: 8%CPEs: 5EXPL: 0CVE-2016-5276 – Mozilla: Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList (MFSA 2016-85, MFSA 2016-86)
https://notcve.org/view.php?id=CVE-2016-5276
Use-after-free vulnerability in the mozilla::a11y::DocAccessible::ProcessInvalidationList function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an aria-owns attribute. Vulnerabilidad de uso de memoria previamente liberada en la función mozilla::a11y::DocAccessible::ProcessInvalidationList en Mozilla Firefox en versiones anteriores a la 49.0, Firefox ESR en versiones 45.x anteriores a la 45.4 y Thunderbird en versiones anteriores a la 45.4 permite que los atacantes remotos ejecuten código arbitrario o provoquen una denegación de servicio (corrupción de la memoria dinámica o heap) mediante un atributo aria-owns. • http://rhn.redhat.com/errata/RHSA-2016-1912.html http://www.debian.org/security/2016/dsa-3674 http://www.mozilla.org/security/announce/2016/mfsa2016-85.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html http://www.securityfocus.com/bid/93049 http://www.securitytracker.com/id/1036852 https://bugzilla.mozilla.org/show_bug.cgi?id=1287721 https://security.gentoo.org/glsa/201701-15 https://www.mozilla.org/security/advisories/mfsa2016-86 https:// • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 5EXPL: 0CVE-2016-5272 – Mozilla: Bad cast in nsImageGeometryMixin (MFSA 2016-85, MFSA 2016-86)
https://notcve.org/view.php?id=CVE-2016-5272
The nsImageGeometryMixin class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements, which allows remote attackers to execute arbitrary code via a crafted web site. La clase nsImageGeometryMixin en Mozilla Firefox en versiones anteriores a la 49.0, Firefox ESR en versiones 45.x anteriores a la 45.4 y Thunderbird en versiones anteriores a la 45.4 no devuelve correctamente una variable no especificada durante el manejo de los elementos INPUT, lo que permite que los atacantes remotos ejecuten código arbitrario mediante un sitio web manipulado. • http://rhn.redhat.com/errata/RHSA-2016-1912.html http://www.debian.org/security/2016/dsa-3674 http://www.mozilla.org/security/announce/2016/mfsa2016-85.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html http://www.securityfocus.com/bid/93049 http://www.securitytracker.com/id/1036852 https://bugzilla.mozilla.org/show_bug.cgi?id=1297934 https://security.gentoo.org/glsa/201701-15 https://www.mozilla.org/security/advisories/mfsa2016-86 https:// • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 5%CPEs: 7EXPL: 0CVE-2016-5280 – Mozilla: Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap (MFSA 2016-85, MFSA 2016-86)
https://notcve.org/view.php?id=CVE-2016-5280
Use-after-free vulnerability in the mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via bidirectional text. Vulnerabilidad de uso de memoria previamente liberada en la función mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap en Mozilla Firefox en versiones anteriores a la 49.0, Firefox ESR en versiones 45.x anteriores a la 45.4 y Thunderbird en versiones anteriores a la 45.4 permite que los atacantes remotos ejecuten código arbitrario mediante texto bidireccional. • http://rhn.redhat.com/errata/RHSA-2016-1912.html http://www.debian.org/security/2016/dsa-3674 http://www.mozilla.org/security/announce/2016/mfsa2016-85.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html http://www.securityfocus.com/bid/93049 http://www.securitytracker.com/id/1036852 https://bugzilla.mozilla.org/show_bug.cgi?id=1289970 https://security.gentoo.org/glsa/201701-15 https://www.mozilla.org/security/advisories/mfsa2016-86 https:// • CWE-416: Use After Free •