CVSS: 10.0EPSS: 1%CPEs: 28EXPL: 0CVE-2015-2734 – Mozilla: Vulnerabilities found through code inspection (MFSA 2015-66)
https://notcve.org/view.php?id=CVE-2015-2734
03 Jul 2015 — The CairoTextureClientD3D9::BorrowDrawTarget function in the Direct3D 9 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors. La función CairoTextureClientD3D9::BorrowDrawTarget en la implementación Direct3D 9 en Mozilla Firefox anterior a 39.0, Firefox ESR 31.x anterior a 31.8 y 38.x anterior a 38.1, y Thunderbird anterior a 38.1 lee datos ... • http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html • CWE-17: DEPRECATED: Code •
CVSS: 9.8EPSS: 2%CPEs: 27EXPL: 0CVE-2015-2735 – Mozilla: Vulnerabilities found through code inspection (MFSA 2015-66)
https://notcve.org/view.php?id=CVE-2015-2735
03 Jul 2015 — nsZipArchive.cpp in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive. nsZipArchive.cpp en Mozilla Firefox anterior a 39.0, Firefox ESR 31.x anterior a 31.8 y 38.x anterior a 38.1, y Thunderbird anterior a 38.1 accede a localizaciones de memoria no intencionadas, lo que permite a atacantes remotos tener un impacto no especificad... • http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html • CWE-17: DEPRECATED: Code •
CVSS: 10.0EPSS: 2%CPEs: 18EXPL: 0CVE-2015-2731 – Mozilla: Use-after-free in Content Policy due to microtask execution error (MFSA 2015-63)
https://notcve.org/view.php?id=CVE-2015-2731
03 Jul 2015 — Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allows remote attackers to execute arbitrary code by leveraging client-side JavaScript that triggers removal of a DOM object on the basis of a Content Policy. Vulnerabilidad de uso después de liberación en la función CSPService::ShouldLoad en la implementación microtask en Mozilla Firefox anterior a 39.0, Firefox ESR 38.... • http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 20EXPL: 0CVE-2015-2728 – Mozilla: Type confusion in Indexed Database Manager (MFSA 2015-61)
https://notcve.org/view.php?id=CVE-2015-2728
03 Jul 2015 — The IndexedDatabaseManager class in the IndexedDB implementation in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 misinterprets an unspecified IDBDatabase field as a pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors, related to a "type confusion" issue. La clase IndexedDatabaseManager en la implementación IndexedDB en Mozilla Firefox anterior a 39.0 y Firefox ESR ... • http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 9.8EPSS: 0%CPEs: 21EXPL: 0CVE-2015-2743 – Mozilla: Privilege escalation through internal workers (MFSA 2015-69)
https://notcve.org/view.php?id=CVE-2015-2743
03 Jul 2015 — PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables excessive privileges for internal Workers, which might allow remote attackers to execute arbitrary code by leveraging a Same Origin Policy bypass. PDF.js en Mozilla Firefox anterior a 39.0 y Firefox ESR 31.x anterior a 31.8 y 38.x anterior a 38.1 habilita privilegios excesivos para los trabajadores internos, lo que podría permitir a atacantes remotos ejecutar código arbitrario mediante el aprovechamiento de u... • http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html • CWE-17: DEPRECATED: Code CWE-250: Execution with Unnecessary Privileges •
CVSS: 10.0EPSS: 1%CPEs: 28EXPL: 0CVE-2015-2737 – Mozilla: Vulnerabilities found through code inspection (MFSA 2015-66)
https://notcve.org/view.php?id=CVE-2015-2737
03 Jul 2015 — The rx::d3d11::SetBufferData function in the Direct3D 11 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors. La función rx::d3d11::SetBufferData en la implementación Direct3D 11 en Mozilla Firefox anterior a 39.0, Firefox ESR 31.x anterior a 31.8 y 38.x anterior a 38.1, y Thunderbird anterior a 38.1 lee datos de localizaciones de memoria n... • http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html • CWE-17: DEPRECATED: Code •
CVSS: 10.0EPSS: 4%CPEs: 28EXPL: 0CVE-2015-2740 – Mozilla: Vulnerabilities found through code inspection (MFSA 2015-66)
https://notcve.org/view.php?id=CVE-2015-2740
03 Jul 2015 — Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 might allow remote attackers to cause a denial of service or have unspecified other impact via unknown vectors. Desbordamiento de buffer en la función nsXMLHttpRequest::AppendToResponseText en Mozilla Firefox anterior a 39.0, Firefox ESR 31.x anterior a 31.8 y 38.x anterior a 38.1, y Thunderbird anterior a 38.1 podría permitir a... • http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 3%CPEs: 20EXPL: 0CVE-2015-2733 – Mozilla: Use-after-free in workers while using XMLHttpRequest (MFSA 2015-65)
https://notcve.org/view.php?id=CVE-2015-2733
03 Jul 2015 — Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a dedicated worker. Vulnerabilidad de uso después de liberación en la función CanonicalizeXPCOMParticipant en Mozilla Firefox anterior a 39.0 y Firefox ESR 31.x anterior a 31.8 y 38.x anterior a 38.1 permite a atacantes remotos ejecutar có... • http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html • CWE-416: Use After Free •
CVSS: 10.0EPSS: 1%CPEs: 22EXPL: 0CVE-2015-2725 – Mozilla: Miscellaneous memory safety hazards (rv:31.8 / rv:38.1) (MFSA 2015-59)
https://notcve.org/view.php?id=CVE-2015-2725
03 Jul 2015 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor de navegación en Mozilla Firefox anterior a 39.0, Firefox ESR 38.x anterior a 38.1, y Thunderbird anterior a 38.1 permiten a atacantes remotos causar una den... • http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 2%CPEs: 28EXPL: 0CVE-2015-2736 – Mozilla: Vulnerabilities found through code inspection (MFSA 2015-66)
https://notcve.org/view.php?id=CVE-2015-2736
03 Jul 2015 — The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive. La función nsZipArchive::BuildFileList en Mozilla Firefox anterior a 39.0, Firefox ESR 31.x anterior a 31.8 y 38.x anterior a 38.1, y Thunderbird anterior a 38.1 accede a localizaciones de memoria no intencionadas, lo que permite a ata... • http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html • CWE-17: DEPRECATED: Code •