CVSS: 9.8EPSS: 0%CPEs: 10EXPL: 0CVE-2015-4505
https://notcve.org/view.php?id=CVE-2015-4505
24 Sep 2015 — updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allows local users to write to arbitrary files by conducting a junction attack and waiting for an update operation by the Mozilla Maintenance Service. Vulnerabilidad en updater.exe en Mozilla Firefox en versiones anteriores a 41.0 y Firefox ESR 38.x en versiones anteriores a 38.3 en Windows, permite a usuarios locales escribir en archivos arbitrarios mediante la realización de un ataque de unión y esperando por una operac... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2015-4476
https://notcve.org/view.php?id=CVE-2015-4476
24 Sep 2015 — Mozilla Firefox before 41.0 on Android allows user-assisted remote attackers to spoof address-bar attributes by leveraging lack of navigation after a paste of a URL with a nonstandard scheme, as demonstrated by spoofing an SSL attribute. Vulnerabilidad en Mozilla Firefox en versiones anteriores a 41.0 en Android, permite a atacantes remotos asistidos por usuario suplantar los atributos de la barra de direcciones para aprovechar la falta de navegación después de pegar una URL con un esquema no estándar, como... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html • CWE-254: 7PK - Security Features •
CVSS: 8.8EPSS: 1%CPEs: 10EXPL: 0CVE-2015-7178
https://notcve.org/view.php?id=CVE-2015-7178
24 Sep 2015 — The ProgramBinary::linkAttributes function in libGLES in ANGLE, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows, mishandles shader access, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted (1) OpenGL or (2) WebGL content. La función ProgramBinary::linkAttributes en libGLES en ANGLE, tal como se utiliza en Mozilla Firefox en versiones anteriores a 41.0 y Firefox ESR 38.x en versiones an... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 1%CPEs: 10EXPL: 0CVE-2015-7179
https://notcve.org/view.php?id=CVE-2015-7179
24 Sep 2015 — The VertexBufferInterface::reserveVertexSpace function in libGLES in ANGLE, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows, incorrectly allocates memory for shader attribute arrays, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via crafted (1) OpenGL or (2) WebGL content. Vulnerabilidad en la función VertexBufferInterface::reserveVertexSpace en libGLES en ANGLE, tal como se utiliza en Mozilla F... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-4503
https://notcve.org/view.php?id=CVE-2015-4503
24 Sep 2015 — The TCP Socket API implementation in Mozilla Firefox before 41.0 mishandles array boundaries that were established with a navigator.mozTCPSocket.open method call and send method calls, which allows remote TCP servers to obtain sensitive information from process memory by reading packet data, as demonstrated by availability of this API in a Firefox OS application. Vulnerabilidad en la implementación de la API TCP Socket en Mozilla Firefox en versiones anteriores a 41.0, no maneja correctamente los límites de... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 3%CPEs: 8EXPL: 0CVE-2015-4511 – Mozilla: Buffer overflow while decoding WebM video (MFSA 2015-105)
https://notcve.org/view.php?id=CVE-2015-4511
24 Sep 2015 — Heap-based buffer overflow in the nestegg_track_codec_data function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via a crafted header in a WebM video. Vulnerabilidad de desbordamiento del buffer basado en memoria dinámica en la función nestegg_track_codec_data en Mozilla Firefox en versiones anteriores a 41.0 y Firefox EXR 38.x en versiones anteriores a 38.3, permite a atacantes remotos ejecutar código arbitrario a través de una cabecera m... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.8EPSS: 4%CPEs: 8EXPL: 0CVE-2015-7174 – Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112)
https://notcve.org/view.php?id=CVE-2015-7174
23 Sep 2015 — The nsAttrAndChildArray::GrowBy function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow." Vulnerabilidad en la función nsAttrAndChildArray::GrowBy en Mozilla Firefox en versiones anteriores a 41.0 y Firefox ESR 38.x en versiones anteriores a 38.3, podría permitir a atacantes remotos provocar una denegación ... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-250: Execution with Unnecessary Privileges •
CVSS: 8.1EPSS: 3%CPEs: 1EXPL: 0CVE-2015-4510 – Ubuntu Security Notice USN-2743-4
https://notcve.org/view.php?id=CVE-2015-4510
23 Sep 2015 — Race condition in the WorkerPrivate::NotifyFeatures function in Mozilla Firefox before 41.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) by leveraging improper interaction between shared workers and the IndexedDB implementation. Vulnerabilidad de condición de carrera en la función WorkerPrivate::NotifyFeatures en Mozilla Firefox en versiones anteriores a 41.0, permite a atacantes remotos ejecutar código arbitrario o provocar una denega... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 8.8EPSS: 4%CPEs: 8EXPL: 0CVE-2015-4522 – Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112)
https://notcve.org/view.php?id=CVE-2015-4522
23 Sep 2015 — The nsUnicodeToUTF8::GetMaxLength function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow." Vulnerabilidad en la función nsUnicodeToUTF8::GetMaxLength en Mozilla Firefox en versiones anteriores a 41.0 y Firefox ESR 38.x en versiones anteriores a 38.3, podría permitir a atacantes remotos provocar una denegac... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-250: Execution with Unnecessary Privileges •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2015-4507 – Ubuntu Security Notice USN-2743-4
https://notcve.org/view.php?id=CVE-2015-4507
23 Sep 2015 — The SavedStacks class in the JavaScript implementation in Mozilla Firefox before 41.0, when the Debugger API is enabled, allows remote attackers to cause a denial of service (getSlotRef assertion failure and application exit) or possibly execute arbitrary code via a crafted web site. Vulnerabilidad en la clase SavedStacks en la implementación JavaScript en Mozilla Firefox en versiones anteriores a 41.0, cuando la API Debugger está habilitada, permite a atacantes remotos provocar una denegación de servicio (... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html •