CVSS: 9.8EPSS: 6%CPEs: 3EXPL: 0CVE-2015-0815 – Mozilla: Miscellaneous memory safety hazards (rv:31.6) (MFSA 2015-30)
https://notcve.org/view.php?id=CVE-2015-0815
01 Apr 2015 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador en Mozilla Firefox anterior a 37.0, Firefox ESR 31.x anterior a 31.6, y Thunderbird anterior a 31.6 permiten a atacantes remotos causar una den... • http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html • CWE-122: Heap-based Buffer Overflow •
CVSS: 9.1EPSS: 1%CPEs: 6EXPL: 0CVE-2015-0808 – Gentoo Linux Security Advisory 201512-10
https://notcve.org/view.php?id=CVE-2015-0808
01 Apr 2015 — The webrtc::VPMContentAnalysis::Release function in the WebRTC implementation in Mozilla Firefox before 37.0 uses incompatible approaches to the deallocation of memory for simple-type arrays, which might allow remote attackers to cause a denial of service (memory corruption) via unspecified vectors. La función webrtc::VPMContentAnalysis::Release en la implementación WebRTC en Mozilla Firefox anterior a 37.0 utiliza acercamientos incompatibles para quitar la reserva de memoria para arrays de un tipo simple, ... • http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html • CWE-17: DEPRECATED: Code •
CVSS: 9.8EPSS: 4%CPEs: 4EXPL: 0CVE-2015-0813 – Mozilla: Use-after-free when using the Fluendo MP3 GStreamer plugin (MFSA 2015-31)
https://notcve.org/view.php?id=CVE-2015-0813
01 Apr 2015 — Use-after-free vulnerability in the AppendElements function in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 on Linux, when the Fluendo MP3 plugin for GStreamer is used, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted MP3 file. Vulnerabilidad de uso después de liberación en la función AppendElements en Mozilla Firefox anterior a 37.0, Firefox ESR 31.x anterior a 31.6, y Thunderbird anterior a 31.6 ... • http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html • CWE-416: Use After Free •
CVSS: 8.1EPSS: 2%CPEs: 6EXPL: 0CVE-2015-0811 – Gentoo Linux Security Advisory 201512-10
https://notcve.org/view.php?id=CVE-2015-0811
01 Apr 2015 — The QCMS implementation in Mozilla Firefox before 37.0 allows remote attackers to obtain sensitive information from process heap memory or cause a denial of service (out-of-bounds read) via an image that is improperly handled during transformation. La implementación QCMS en Mozilla Firefox anterior a 37.0 permite a atacantes remotos obtener información sensible de la memoria dinámica de procesos o causar una denegación de servicio (lectura fuera de rango) a través de una imagen que no se maneja correctament... • http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 48%CPEs: 3EXPL: 3CVE-2015-0816 – Mozilla Firefox resource: URL Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-0816
01 Apr 2015 — Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js. Mozilla Firefox anterior a 37.0, Firefox ESR 31.x anterior a 31.6, y Thunderbird anterior a 31.6 no restringe correctamente las URLs resource:, lo que facilita ... • https://packetstorm.news/files/id/133271 • CWE-250: Execution with Unnecessary Privileges CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 5%CPEs: 13EXPL: 0CVE-2015-0818 – Mozilla Firefox SVG DOMAttrModified Same-Origin Policy Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2015-0818
23 Mar 2015 — Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving SVG hash navigation. Mozilla Firefox anterior a 36.0.4, Firefox ESR 31.x anterior a 31.5.3, y SeaMonkey anterior a 2.33.1 permiten a atacantes remotos evadir Same Origin Policy y ejecutar código JavaScript arbitrario con privilegios chrome a través de vectores que involucran la nav... • http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00026.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 23%CPEs: 12EXPL: 0CVE-2015-0817 – Mozilla Firefox Bounds Check Elimination Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-0817
23 Mar 2015 — The asm.js implementation in Mozilla Firefox before 36.0.3, Firefox ESR 31.x before 31.5.2, and SeaMonkey before 2.33.1 does not properly determine the cases in which bounds checking may be safely skipped during JIT compilation and heap access, which allows remote attackers to read or write to unintended memory locations, and consequently execute arbitrary code, via crafted JavaScript. La implementación asm.js en Mozilla Firefox anterior a 36.0.3, Firefox ESR 31.x anterior a 31.5.2, y SeaMonkey anterior a 2... • http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00026.html • CWE-17: DEPRECATED: Code CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 1%CPEs: 235EXPL: 0CVE-2015-0828 – Gentoo Linux Security Advisory 201504-01
https://notcve.org/view.php?id=CVE-2015-0828
25 Feb 2015 — Double free vulnerability in the nsXMLHttpRequest::GetResponse function in Mozilla Firefox before 36.0, when a nonstandard memory allocator is used, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted JavaScript code that makes an XMLHttpRequest call with zero bytes of data. Vulnerabilidad de doble liberación en la función nsXMLHttpRequest::GetResponse en Mozilla Firefox anterior a 36.0, cuando un asignador de memoria no estándar está utilizado... • http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00000.html •
CVSS: 7.3EPSS: 0%CPEs: 250EXPL: 0CVE-2015-0833 – Gentoo Linux Security Advisory 201504-01
https://notcve.org/view.php?id=CVE-2015-0833
25 Feb 2015 — Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 on Windows, when the Maintenance Service is not used, allow local users to gain privileges via a Trojan horse DLL in (1) the current working directory or (2) a temporary directory, as demonstrated by bcrypt.dll. Múltiples vulnerabilidades de rutas de búsqueda no confiables en updater.exe en Mozilla Firefox anterior a 36.0, Firefox ESR 31.x anterior a 31.5, y... • http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00026.html •
CVSS: 6.5EPSS: 1%CPEs: 237EXPL: 0CVE-2015-0830 – Ubuntu Security Notice USN-2505-2
https://notcve.org/view.php?id=CVE-2015-0830
25 Feb 2015 — The WebGL implementation in Mozilla Firefox before 36.0 does not properly allocate memory for copying an unspecified string to a shader's compilation log, which allows remote attackers to cause a denial of service (application crash) via crafted WebGL content. La implementación WebGL en Mozilla Firefox anterior a 36.0 no reserva correctamente memoria para copiar una cadena no especificada en el registro de la compilación de un sombreado, lo que permite a atacantes remotos causar una denegación de servicio (... • http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00000.html • CWE-399: Resource Management Errors •