CVSS: 9.3EPSS: 2%CPEs: 26EXPL: 0CVE-2012-5839 – Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2012-105)
https://notcve.org/view.php?id=CVE-2012-5839
Heap-based buffer overflow in the gfxShapedWord::CompressedGlyph::IsClusterStart function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code via unspecified vectors. Desbordamiento de búfer basado en memoria dinámica en la función gfxShapedWord::CompressedGlyph::IsClusterStart en Mozilla Firefox antes de 17.0, Firefox ESR 10.x antes de 10.0.11, Thunderbird antes de 17,0, Thunderbird ESR 10.x antes de 10.0.11, y SeaMonkey antes de 2.14 permite a atacantes remotos ejecutar código arbitrario a través de vectores no especificados. • http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.html http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html http://osvdb.org/87607 http://rhn.redhat.com/errata/RHSA-2012-1482.html http://rhn.redhat.com/errata/RHSA-2012-1483.html http://secunia.com&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 4.3EPSS: 0%CPEs: 28EXPL: 1CVE-2012-4201 – Mozilla: evalInSanbox location context incorrectly applied (MFSA 2012-93)
https://notcve.org/view.php?id=CVE-2012-4201
The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect context during the handling of JavaScript code that sets the location.href property, which allows remote attackers to conduct cross-site scripting (XSS) attacks or read arbitrary files by leveraging a sandboxed add-on. La implementación evalInSandbox en Mozilla Firefox antes de v17.0, v10.x Firefox ESR antes de v10.0.11, Thunderbird antes de v17.0, Thunderbird ESR v10.x antes de v10.0.11, y SeaMonkey antes de v2.14 usa un contexto incorrecto durante la manipulación de código JavaScript que establece la propiedad location.href, lo que permite a atacantes remotos realizar ataques de ejecución de comandos en sitios cruzados (XSS) o leer archivos de su elección aprovechándose de un espacio complemento aislado ("sandboxed"). • http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.html http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html http://osvdb.org/87594 http://rhn.redhat.com/errata/RHSA-2012-1482.html http://rhn.redhat.com/errata/RHSA-2012-1483.html http://secunia.com&# • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 3%CPEs: 28EXPL: 1CVE-2012-4216 – Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2012-105)
https://notcve.org/view.php?id=CVE-2012-4216
Use-after-free vulnerability in the gfxFont::GetFontEntry function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. Uso después de liberación en la función gfxFont::GetFontEntry en Mozilla Firefox antes de 17.0, Firefox ESR 10.x antes de 10.0.11, Thunderbird antes de 17.0, Thunderbird ESR 10.x antes de 10.0.11, y SeaMonkey antes de 2.14 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria dinámica) a través de vectores no especificados. • http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.html http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html http://osvdb.org/87609 http://rhn.redhat.com/errata/RHSA-2012-1482.html http://rhn.redhat.com/errata/RHSA-2012-1483.html http://secunia.com&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-416: Use After Free •
CVSS: 9.3EPSS: 3%CPEs: 28EXPL: 1CVE-2012-5829 – Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2012-105)
https://notcve.org/view.php?id=CVE-2012-5829
Heap-based buffer overflow in the nsWindow::OnExposeEvent function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code via unspecified vectors. Desbordamiento de búfer basado en memoria dinámica en la función nsWindow::OnExposeEvent en Mozilla Firefox antes de v17.0, Firefox ESR v10.x antes de v10.0.11, Thunderbird antes de v17.0, Thunderbird ESR v10.x antes de v10.0.11, y SeaMonkey antes de v2.14 permite a atacantes remotos ejecutar código arbitrario a través de vectores no especificados. • http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html http://lists.opensuse.org/opensuse-updates/2012-11/msg00090. • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 2%CPEs: 28EXPL: 1CVE-2012-5830 – Mozilla: Use-after-free, buffer overflow, and memory corruption issues found using Address Sanitizer (MFSA 2012-106)
https://notcve.org/view.php?id=CVE-2012-5830
Use-after-free vulnerability in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 on Mac OS X allows remote attackers to execute arbitrary code via an HTML document. Vulnerabilidad de uso después de liberación en Mozilla Firefox antes de 17.0, Firefox ESR 10.x antes de 10.0.11, Thunderbird antes de 17.0, Thunderbird ESR 10.x antes de 10.0.11, y SeaMonkey antes de 2.14 en Mac OS X permite a atacantes remotos ejecutar código arbitrario a través de un documento HTML. • http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.html http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html http://osvdb.org/87598 http://rhn.redhat.com/errata/RHSA-2012-1482.html http://rhn.redhat.com/errata/RHSA-2012-1483.html http://secunia.com&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-416: Use After Free •