CVSS: 8.8EPSS: 6%CPEs: 8EXPL: 0CVE-2015-7175 – Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112)
https://notcve.org/view.php?id=CVE-2015-7175
23 Sep 2015 — The XULContentSinkImpl::AddText function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow." Vulnerabilidad en la función XULContentSinkImpl::AddText en Mozilla Firefox en versiones anteriores a 41.0 y Firefox ESR 38.x en versiones anteriores a 38.3, podría permitir a atacantes remotos provocar una denegación ... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-250: Execution with Unnecessary Privileges •
CVSS: 9.3EPSS: 1%CPEs: 1EXPL: 0CVE-2015-4516 – Ubuntu Security Notice USN-2743-4
https://notcve.org/view.php?id=CVE-2015-4516
23 Sep 2015 — Mozilla Firefox before 41.0 allows remote attackers to bypass certain ECMAScript 5 (aka ES5) API protection mechanisms and modify immutable properties, and consequently execute arbitrary JavaScript code with chrome privileges, via a crafted web page that does not use ES5 APIs. Vulnerabilidad en Mozilla Firefox en versiones anteriores a 41.0, permite a atacantes remotos eludir ciertos mecanismos de protección de la API ECMAScript 5 (también conocido como ES5) y modificar propiedades inmutables y, consecuente... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html • CWE-254: 7PK - Security Features •
CVSS: 9.1EPSS: 1%CPEs: 8EXPL: 0CVE-2015-4520 – Mozilla: Errors in the handling of CORS preflight request headers (MFSA 2015-111)
https://notcve.org/view.php?id=CVE-2015-4520
23 Sep 2015 — Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass CORS preflight protection mechanisms by leveraging (1) duplicate cache-key generation or (2) retrieval of a value from an incorrect HTTP Access-Control-* response header. Vulnerabilidad en Mozilla Firefox en versiones anteriores a 41.0 y Firefox ESR 38.x en versiones anteriores a 38.3, permite a atacantes remotos eludir los mecanismos de protección de verificación CORS preflight aprovechando la (1) generación de ca... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html • CWE-254: 7PK - Security Features CWE-284: Improper Access Control •
CVSS: 6.8EPSS: 18%CPEs: 8EXPL: 0CVE-2015-4506 – Mozilla: Buffer overflow in libvpx while parsing vp9 format video (MFSA 2015-101)
https://notcve.org/view.php?id=CVE-2015-4506
23 Sep 2015 — Buffer overflow in the vp9_init_context_buffers function in libvpx, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3, allows remote attackers to execute arbitrary code via a crafted VP9 file. Desbordamiento del buffer en la función vp9_init_context_buffers en libvpx, tal como se utiliza en Mozilla Firefox en versiones anteriores a 41.0 y Firefox ESR 38.x en versiones anteriores a 38.3, permite a atacantes remotos ejecutar código arbitrario a través de un archivo VP9 manipulado. Andrew... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.8EPSS: 2%CPEs: 1EXPL: 0CVE-2015-4507 – Ubuntu Security Notice USN-2743-4
https://notcve.org/view.php?id=CVE-2015-4507
23 Sep 2015 — The SavedStacks class in the JavaScript implementation in Mozilla Firefox before 41.0, when the Debugger API is enabled, allows remote attackers to cause a denial of service (getSlotRef assertion failure and application exit) or possibly execute arbitrary code via a crafted web site. Vulnerabilidad en la clase SavedStacks en la implementación JavaScript en Mozilla Firefox en versiones anteriores a 41.0, cuando la API Debugger está habilitada, permite a atacantes remotos provocar una denegación de servicio (... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html •
CVSS: 9.1EPSS: 5%CPEs: 2EXPL: 0CVE-2015-4512 – Ubuntu Security Notice USN-2743-4
https://notcve.org/view.php?id=CVE-2015-4512
23 Sep 2015 — gfx/2d/DataSurfaceHelpers.cpp in Mozilla Firefox before 41.0 on Linux improperly attempts to use the Cairo library with 32-bit color-depth surface creation followed by 16-bit color-depth surface display, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) by using a CANVAS element to trigger 2D rendering. Vulnerabilidad en gfx/2d/DataSurfaceHelpers.cpp en Mozilla Firefox en versiones anteriores a 41.0 en Linux, intenta utilizar ... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 22%CPEs: 8EXPL: 0CVE-2015-4509 – Mozilla Firefox HTMLVideoElement Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-4509
23 Sep 2015 — Use-after-free vulnerability in the HTMLVideoElement interface in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via crafted JavaScript code that modifies the URI table of a media element, aka ZDI-CAN-3176. Vulnerabilidad de uso después de liberación en la memoria en la interfaz HTMLVideoElement en Mozilla Firefox en versiones anteriores a 41.0 y Firefox ESR 38.x en versiones anteriores a 38.3, permite a atacantes remotos ejecutar código arbitr... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html • CWE-416: Use After Free •
CVSS: 8.1EPSS: 8%CPEs: 1EXPL: 0CVE-2015-4510 – Ubuntu Security Notice USN-2743-4
https://notcve.org/view.php?id=CVE-2015-4510
23 Sep 2015 — Race condition in the WorkerPrivate::NotifyFeatures function in Mozilla Firefox before 41.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) by leveraging improper interaction between shared workers and the IndexedDB implementation. Vulnerabilidad de condición de carrera en la función WorkerPrivate::NotifyFeatures en Mozilla Firefox en versiones anteriores a 41.0, permite a atacantes remotos ejecutar código arbitrario o provocar una denega... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 8.8EPSS: 6%CPEs: 8EXPL: 0CVE-2015-4521 – Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112)
https://notcve.org/view.php?id=CVE-2015-4521
23 Sep 2015 — The ConvertDialogOptions function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors. Vulnerabilidad en la función ConvertDialogOptions en Mozilla Firefox en versiones anteriores a 41.0 y Firefox ESR 38.x en versiones anteriores a 38.3, podría permitir a atacantes remotos provocar una denegación de servicio (corrupción de memoria y caí... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-250: Execution with Unnecessary Privileges •
CVSS: 8.8EPSS: 6%CPEs: 8EXPL: 0CVE-2015-4517 – Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112)
https://notcve.org/view.php?id=CVE-2015-4517
23 Sep 2015 — NetworkUtils.cpp in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors. Vulnerabilidad en NetworkUtils.cpp en Mozilla Firefox en versiones anteriores a 41.0 y Firefox ESR 38.x en versiones anteriores a 38.3, podría permitir a atacantes remotos provocar una denegación de servicio (corrupción de memoria y caída de la aplicación) o posibleme... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-250: Execution with Unnecessary Privileges •