CVSS: 8.8EPSS: 1%CPEs: 12EXPL: 1CVE-2016-9905 – Mozilla: Crash in EnumerateSubDocuments (MFSA 2016-94, MFSA 2016-95)
https://notcve.org/view.php?id=CVE-2016-9905
A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability affects Firefox ESR < 45.6 and Thunderbird < 45.6. Cierre inesperado potencialmente explotable en "EnumerateSubDocuments" al añadir o eliminar subdocumentos. La vulnerabilidad afecta a Firefox ESR en versiones anteriores a la 45.6 y Thunderbird en versiones anteriores a la 45.6. • http://rhn.redhat.com/errata/RHSA-2016-2946.html http://rhn.redhat.com/errata/RHSA-2016-2973.html http://www.securityfocus.com/bid/94884 http://www.securitytracker.com/id/1037462 https://bugzilla.mozilla.org/show_bug.cgi?id=1293985 https://security.gentoo.org/glsa/201701-15 https://www.debian.org/security/2017/dsa-3757 https://www.mozilla.org/security/advisories/mfsa2016-95 https://www.mozilla.org/security/advisories/mfsa2016-96 https://access.redhat.com/security/cve/C • CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2016-9904 – Mozilla: Cross-origin information leak in shared atoms (MFSA 2016-94, MFSA 2016-95)
https://notcve.org/view.php?id=CVE-2016-9904
An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6. Un atacante podría utilizar un ataque de sincronización por JavaScript Map/Set para determinar si un atom está siendo empleado por otro compartimento/zona en determinados contextos. Esto podría emplearse para filtrar información, como nombres de usuario embebidos en código JavaScript, en sitios web. • http://rhn.redhat.com/errata/RHSA-2016-2946.html http://www.securityfocus.com/bid/94885 http://www.securitytracker.com/id/1037461 https://bugzilla.mozilla.org/show_bug.cgi?id=1317936 https://security.gentoo.org/glsa/201701-15 https://www.debian.org/security/2017/dsa-3757 https://www.mozilla.org/security/advisories/mfsa2016-94 https://www.mozilla.org/security/advisories/mfsa2016-95 https://www.mozilla.org/security/advisories/mfsa2016-96 https://access.redhat.com/security/cve&#x • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 1CVE-2016-9636 – gstreamer-plugins-good: Heap buffer overflow in FLIC decoder
https://notcve.org/view.php?id=CVE-2016-9636
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by providing a 'write count' that goes beyond the initialized buffer. Desbordamiento de búfer basado en memoria dinámica en la función flx_decode_delta_fli en gst/flx/gstflxdec.c en el decoder FLIC en GStreamer en versiones anteriores a 1.10.2 permite a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (caída de la aplicación) proporcionando un "recuento de escritura" que va más allá del búfer inicializado. Multiple flaws were discovered in GStreamer's FLC/FLI/FLX media file format decoding plug-in. A remote attacker could use these flaws to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application. • http://rhn.redhat.com/errata/RHSA-2016-2975.html http://rhn.redhat.com/errata/RHSA-2017-0019.html http://rhn.redhat.com/errata/RHSA-2017-0020.html http://www.debian.org/security/2016/dsa-3723 http://www.debian.org/security/2016/dsa-3724 http://www.openwall.com/lists/oss-security/2016/11/24/2 http://www.securityfocus.com/bid/94499 https://bugzilla.gnome.org/show_bug.cgi?id=774834 https://gstreamer.freedesktop.org/releases/1.10/#1.10.2 https://scaryb • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 1CVE-2016-9634 – gstreamer-plugins-good: Heap buffer overflow in FLIC decoder
https://notcve.org/view.php?id=CVE-2016-9634
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via the start_line parameter. Desbordamiento de búfer basado en memoria dinámica en la función flx_decode_delta_fli en gst/flx/gstflxdec.c en el decoder FLIC en GStreamer en versiones anteriores a 1.10.2 permite a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (caída de la aplicación) a través del parámetro start_line. Multiple flaws were discovered in GStreamer's FLC/FLI/FLX media file format decoding plug-in. A remote attacker could use these flaws to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application. • http://rhn.redhat.com/errata/RHSA-2016-2975.html http://rhn.redhat.com/errata/RHSA-2017-0019.html http://rhn.redhat.com/errata/RHSA-2017-0020.html http://www.debian.org/security/2016/dsa-3723 http://www.debian.org/security/2016/dsa-3724 http://www.openwall.com/lists/oss-security/2016/11/24/2 http://www.securityfocus.com/bid/94499 https://bugzilla.gnome.org/show_bug.cgi?id=774834 https://gstreamer.freedesktop.org/releases/1.10/#1.10.2 https://scaryb • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 1CVE-2016-9635 – gstreamer-plugins-good: Heap buffer overflow in FLIC decoder
https://notcve.org/view.php?id=CVE-2016-9635
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by providing a 'skip count' that goes beyond initialized buffer. Desbordamiento de búfer basado en memoria dinámica en la función flx_decode_delta_fli en gst/flx/gstflxdec.c en el decoder FLIC en GStreamer en versiones anteriores a 1.10.2 permite a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (caída de la aplicación) proporcionando un 'recuento de saltos' que va más allá del búfer inicializado. Multiple flaws were discovered in GStreamer's FLC/FLI/FLX media file format decoding plug-in. A remote attacker could use these flaws to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application. • http://rhn.redhat.com/errata/RHSA-2016-2975.html http://rhn.redhat.com/errata/RHSA-2017-0019.html http://rhn.redhat.com/errata/RHSA-2017-0020.html http://www.debian.org/security/2016/dsa-3723 http://www.debian.org/security/2016/dsa-3724 http://www.openwall.com/lists/oss-security/2016/11/24/2 http://www.securityfocus.com/bid/94499 https://bugzilla.gnome.org/show_bug.cgi?id=774834 https://gstreamer.freedesktop.org/releases/1.10/#1.10.2 https://scaryb • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •