CVSS: 8.8EPSS: 6%CPEs: 8EXPL: 0CVE-2015-7177 – Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112)
https://notcve.org/view.php?id=CVE-2015-7177
23 Sep 2015 — The InitTextures function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors. Vulnerabilidad en la función InitTextures en Mozilla Firefox en versiones anteriores a 41.0 y Firefox ESR 38.x en versiones anteriores a 38.3, podría permitir a atacantes remotos provocar una denegación de servicio (corrupción de memoria y caída de la aplicac... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-250: Execution with Unnecessary Privileges •
CVSS: 8.8EPSS: 6%CPEs: 8EXPL: 0CVE-2015-7180 – Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112)
https://notcve.org/view.php?id=CVE-2015-7180
23 Sep 2015 — The ReadbackResultWriterD3D11::Run function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 misinterprets the return value of a function call, which might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors. Vulnerabiliad en la función ReadbackResultWriterD3D11:Run en Mozilla Firefox en versiones anteriores a 41.0 y Firefox ESR 38.x en versiones anteriores a 38.3, malinterpreta el valor de... • http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-250: Execution with Unnecessary Privileges •
CVSS: 8.1EPSS: 2%CPEs: 6EXPL: 0CVE-2015-4498 – Mozilla: Add-on notification bypass through data URLs (MFSA 2015-95)
https://notcve.org/view.php?id=CVE-2015-4498
27 Aug 2015 — The add-on installation feature in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to bypass an intended user-confirmation requirement by constructing a crafted data: URL and triggering navigation to an arbitrary http: or https: URL at a certain early point in the installation process. Vulnerabilidad en la funcionalidad de instalación de complemento en Mozilla Firefox en versiones anteriores a 40.0.3 y Firefox ESR 38.x en versiones anteriores a 38.2.1, permite a atac... • http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00013.html • CWE-254: 7PK - Security Features •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2015-4482 – Gentoo Linux Security Advisory 201605-06
https://notcve.org/view.php?id=CVE-2015-4482
16 Aug 2015 — mar_read.c in the Updater in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows local users to gain privileges or cause a denial of service (out-of-bounds write) via a crafted name of a Mozilla Archive (aka MAR) file. Vulnerabilidad en mar_read.c en el Updater en Mozilla Firefox en versiones anteriores a 40.0 y Firefox ESR 38.x en versiones anteriores a 38.2, permite a usuarios locales obtener privilegios o provocar una denegación de servicio (escritura fuera de rango) a través de un nombre... • http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.1EPSS: 0%CPEs: 4EXPL: 0CVE-2015-4483 – Gentoo Linux Security Advisory 201605-06
https://notcve.org/view.php?id=CVE-2015-4483
16 Aug 2015 — Mozilla Firefox before 40.0 allows man-in-the-middle attackers to bypass a mixed-content protection mechanism via a feed: URL in a POST request. Vulnerabilidad en Mozilla Firefox en versiones anteriores a 40.0, permite a atacantes man-in-the-middle evadir el mecanismo de protección de contenido mixto a través de una fuente: URL en una petición POST. Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which ... • http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 0%CPEs: 2EXPL: 0CVE-2015-4496 – Mozilla: Integer overflows in libstagefright while processing MP4 video metadata (MFSA 2015-93)
https://notcve.org/view.php?id=CVE-2015-4496
16 Aug 2015 — Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file, a related issue to CVE-2015-1538. Múltiples desbordamientos de entero en libstagefright en Mozilla Firefox en versiones anteriores a 38.0 permite a atacantes remotos ejecutar código arbitrario a través de una muestra de metadatos manipulados en un archivo de vídeo MPEG-4, un caso relacionado con CVE-2015-1538. • http://www.mozilla.org/security/announce/2015/mfsa2015-93.html • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •
CVSS: 7.0EPSS: 0%CPEs: 9EXPL: 2CVE-2015-4481 – Mozilla - Maintenance Service Log File Overwrite Privilege Escalation
https://notcve.org/view.php?id=CVE-2015-4481
16 Aug 2015 — Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update. Vulnerabilidad de condición de carrera en el Servicio de Mantenimiento de Mozilla en Mozilla Firefox en versiones anteriores a 40.0 y Firefox ESR 38.x en versiones anteriores a 38.2 en Windows, permite a usuarios locales escribir en archivos... • https://packetstorm.news/files/id/133226 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 9.8EPSS: 1%CPEs: 11EXPL: 0CVE-2015-4493 – Mozilla: Overflow issues in libstagefright (MFSA 2015-83)
https://notcve.org/view.php?id=CVE-2015-4493
11 Aug 2015 — Heap-based buffer overflow in the stagefright::ESDS::parseESDescriptor function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via an invalid size field in an esds chunk in MPEG-4 video data, a related issue to CVE-2015-1539. Desbordamiento de buffer basado en memoria dinámica en la función stagefright::ESDS::parseESDescriptor en libstagefright en Mozilla Firefox en versiones anteriores a 40.0 y Firefox ESR 38.x en versione... • http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 4%CPEs: 10EXPL: 0CVE-2015-4480 – Mozilla: Overflow issues in libstagefright (MFSA 2015-83)
https://notcve.org/view.php?id=CVE-2015-4480
11 Aug 2015 — Integer overflow in the stagefright::SampleTable::isValid function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via crafted MPEG-4 video data with H.264 encoding. Vulnerabilidad de desbordamiento de entero en la función stagefright::SampleTable::isValid de libstagefright en Mozilla Firefox en versiones anteriores a 40.0 y Firefox ESR 38.x en versiones anteriores a 38.2, permite a atacantes remotos ejecutar código arbitrar... • http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-189: Numeric Errors •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2015-4490 – Gentoo Linux Security Advisory 201605-06
https://notcve.org/view.php?id=CVE-2015-4490
11 Aug 2015 — The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not implement the Content Security Policy Level 2 exceptions for the blob, data, and filesystem URL schemes during wildcard source-expression matching, which might make it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging unexpected policy-enforcement behavior. Vulnerabilidad en la función nsCSPHostSrc::permits en dom/security/nsCSPUtils.cpp en Mozilla Firefox en versio... • http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •