CVSS: 10.0EPSS: 19%CPEs: 157EXPL: 0CVE-2011-0054 – Mozilla Buffer overflow in JavaScript upvarMap (MFSA 2011-04)
https://notcve.org/view.php?id=CVE-2011-0054
Buffer overflow in the JavaScript engine in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, might allow remote attackers to execute arbitrary code via vectors involving non-local JavaScript variables, aka an "upvarMap" issue. Desbordamiento de búfer en el motor JavaScript de Mozilla Firefox antes de v3.5.17 y v3.6.x antes de v3.6.14, y SeaMonkey antes de v2.0.12, podría permitir a atacantes remotos ejecutar código arbitrario a través de vectores con variables JavaScript no locales. • http://downloads.avaya.com/css/P8/documents/100133195 http://www.mandriva.com/security/advisories?name=MDVSA-2011:041 http://www.mozilla.org/security/announce/2011/mfsa2011-04.html http://www.securityfocus.com/bid/46648 https://bugzilla.mozilla.org/show_bug.cgi?id=615657 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14018 https://access.redhat.com/security/cve/CVE-2011-0054 https://bugzilla.redhat.com/show_bug.cgi?id=675091 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 19%CPEs: 157EXPL: 0CVE-2011-0056 – Mozilla Buffer overflow in JavaScript atom map (MFSA 2011-05)
https://notcve.org/view.php?id=CVE-2011-0056
Buffer overflow in the JavaScript engine in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, might allow remote attackers to execute arbitrary code via vectors involving exception timing and a large number of string values, aka an "atom map" issue. Vulnerabilidad de desbordamiento de buffer en el motor Javascript de Mozilla Firefox antes de v3.5.17 y v3.6.x antes de v3.6.14, y SeaMonkey antes de v2.0.12, podría permitir a atacantes remotos ejecutar código de su elección a través de vectores relacionados con la temporización de las excepciones y un gran número de valores de cadena. • http://downloads.avaya.com/css/P8/documents/100133195 http://www.mandriva.com/security/advisories?name=MDVSA-2011:041 http://www.mozilla.org/security/announce/2011/mfsa2011-05.html http://www.securityfocus.com/bid/46650 https://bugzilla.mozilla.org/show_bug.cgi?id=622015 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14013 https://access.redhat.com/security/cve/CVE-2011-0056 https://bugzilla.redhat.com/show_bug.cgi?id=675092 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 10%CPEs: 157EXPL: 0CVE-2011-0055 – Mozilla Firefox JSON.stringify Dangling Pointer Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-0055
Use-after-free vulnerability in the JSON.stringify method in js3250.dll in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, might allow remote attackers to execute arbitrary code via unspecified vectors related to the js_HasOwnProperty function and garbage collection. Vulnerabilidad de uso después de liberación de memoria en el método JSON.stringify en js3250.dll en Mozilla Firefox en versiones anteriores a 3.5.17 y 3.6.x en versiones anteriores a 3.6.14 y SeaMonkey en versiones anteriores a 2.0.12, podría permitir a atacantes remotos ejecutar código arbitrario a través de vectores inespecificos relacionados con la función js_HasOwnProperty y garbage collection. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Firefox. • http://downloads.avaya.com/css/P8/documents/100133195 http://www.mandriva.com/security/advisories?name=MDVSA-2011:041 http://www.mozilla.org/security/announce/2011/mfsa2011-03.html http://www.securityfocus.com/archive/1/516802 http://www.securityfocus.com/bid/46661 http://www.zerodayinitiative.com/advisories/ZDI-11-103 https://bugzilla.mozilla.org/show_bug.cgi?id=616009 https://bugzilla.mozilla.org/show_bug.cgi?id=619255 https://oval.cisecurity.org/repository/search/definition/oval% • CWE-399: Resource Management Errors CWE-416: Use After Free •
CVSS: 9.3EPSS: 20%CPEs: 258EXPL: 0CVE-2010-3769
https://notcve.org/view.php?id=CVE-2010-3769
The line-breaking implementation in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11 on Windows does not properly handle long strings, which allows remote attackers to execute arbitrary code via a crafted document.write call that triggers a buffer over-read. La implementación de line-breaking en Mozilla Firefox en versiones anteriores a la 3.5.16 y 3.6.x en versiones anteriores a la 3.6.13, Thunderbird en versiones anteriores a la 3.0.11 y 3.1.x en versiones anteriores a la 3.1.7 y SeaMonkey en versiones anteriores a la 2.0.11 en Windows, no maneja de manera apropiada cadenas largas, lo que permite a atacantes remotos ejecutar código de su elección mediante una llamada document.write debidamente preparada que dispara una sobrelectura del búfer. • http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052502.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052504.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00002.html http://osvdb.org/69771 http://secunia.com/advisories/42716 http://secunia.com/advisories/42818 http://www.debian.org/security/2010/dsa-2132 http://www.mandriva.com/security/advisories?name=MDVSA-2010:251 http://www.mandriva.com/security/advisories?name=MDV • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 0%CPEs: 6EXPL: 0CVE-2010-4508
https://notcve.org/view.php?id=CVE-2010-4508
The WebSockets implementation in Mozilla Firefox 4 through 4.0 Beta 7 does not properly perform proxy upgrade negotiation, which has unspecified impact and remote attack vectors, related to an "inherent problem" with the WebSocket specification. La implementación WebSockets en Mozilla Firefox v4 hasta v4.0 Beta v7 no realiza adecuadamente la negociación de actualización de proxy, lo que provoca un impacto no especificados y ataque a vectores, relacionado con un problema inherente con la especificación WebSocket. • http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html http://osvdb.org/69758 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12251 https://wiki.mozilla.org/Platform/2010-12-07 •