CVSS: 10.0EPSS: 2%CPEs: 28EXPL: 4CVE-2013-5609 – Mozilla: Miscellaneous memory safety hazards (rv:24.2) (MFSA 2013-104)
https://notcve.org/view.php?id=CVE-2013-5609
11 Dec 2013 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades sin especificar en el motor del navegador Mozilla Firefox anterior a la versión 26.0, Firefox ESR 24.x anterior a 24.2, Thunderbird anterior a la versión 24.2, y S... • http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.html •
CVSS: 10.0EPSS: 6%CPEs: 28EXPL: 2CVE-2013-5613 – Mozilla: Use-after-free in synthetic mouse movement (MFSA 2013-114)
https://notcve.org/view.php?id=CVE-2013-5613
11 Dec 2013 — Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving synthetic mouse movement, related to the RestyleManager::GetHoverGeneration function. Vulnerabilidad de liberación despues de uso en la función PresShell :: DispatchSynthMouseMove en Mozilla Fir... • http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.html • CWE-416: Use After Free •
CVSS: 9.8EPSS: 2%CPEs: 28EXPL: 1CVE-2013-5616 – Mozilla: Use-after-free in event listeners (MFSA 2013-108)
https://notcve.org/view.php?id=CVE-2013-5616
11 Dec 2013 — Use-after-free vulnerability in the nsEventListenerManager::HandleEventSubType function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to mListeners event listeners. Vulnerabilidad de liberación despues de uso en la función nsEventListenerManager :: HandleEventSubType en Mozilla Firefox anterior a 26.0, Firefox ESR 24.x ... • http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.html • CWE-416: Use After Free •
CVSS: 10.0EPSS: 5%CPEs: 28EXPL: 1CVE-2013-5618 – Mozilla: Use-after-free during Table Editing (MFSA 2013-109)
https://notcve.org/view.php?id=CVE-2013-5618
11 Dec 2013 — Use-after-free vulnerability in the nsNodeUtils::LastRelease function in the table-editing user interface in the editor component in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code by triggering improper garbage collection. Vulnerabilidad de uso despues de liberación en la función nsNodeUtils::LastRelease en la interfaz de usuario en el editor de componentes en Mozilla Firefox anterior a 26.0, Fir... • http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.html • CWE-416: Use After Free •
CVSS: 9.1EPSS: 0%CPEs: 4EXPL: 0CVE-2013-4419 – libguestfs: insecure temporary directory handling for guestfish's network socket
https://notcve.org/view.php?id=CVE-2013-4419
05 Nov 2013 — The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance. El comando guestfish en libguestfs 1.20.12, 1.22.7 y anteriores versiones, cuando se usa la opción --remote o --listen, no comprueba adecuadamente la propied... • http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00001.html • CWE-264: Permissions, Privileges, and Access Controls CWE-377: Insecure Temporary File •
CVSS: 7.8EPSS: 79%CPEs: 109EXPL: 0CVE-2013-4854 – ISC BIND rdata Denial Of Service Vulnerability
https://notcve.org/view.php?id=CVE-2013-4854
26 Jul 2013 — The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013. La implementación RFC en rdata.c en ISC BIND 9.7.x y 9.8.x anterior a 9.8.5-P2, ... • http://archives.neohapsis.com/archives/bugtraq/2013-08/0030.html •
CVSS: 7.5EPSS: 6%CPEs: 41EXPL: 0CVE-2013-3567 – puppet: remote code execution on master from unauthenticated clients
https://notcve.org/view.php?id=CVE-2013-3567
19 Jun 2013 — Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call. Puppet 2.7.x anterior a 2.7.22 y 3.2.x anterior a 3.2.2, y Puppet Enterprise anterior a 2.8.2, deserializa YAML sin confianza, lo que permite a atacantes remotos la instanciación de clases de Ruby y ejecutar código arbitrario a través de una llamada RESTAPI manipulada. Pu... • http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 8.8EPSS: 1%CPEs: 28EXPL: 1CVE-2012-5830 – Mozilla: Use-after-free, buffer overflow, and memory corruption issues found using Address Sanitizer (MFSA 2012-106)
https://notcve.org/view.php?id=CVE-2012-5830
21 Nov 2012 — Use-after-free vulnerability in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 on Mac OS X allows remote attackers to execute arbitrary code via an HTML document. Vulnerabilidad de uso después de liberación en Mozilla Firefox antes de 17.0, Firefox ESR 10.x antes de 10.0.11, Thunderbird antes de 17.0, Thunderbird ESR 10.x antes de 10.0.11, y SeaMonkey antes de 2.14 en Mac OS X permite a atacantes remotos e... • http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-416: Use After Free •
CVSS: 8.8EPSS: 29%CPEs: 11EXPL: 2CVE-2011-3026 – libpng: Heap buffer overflow in png_decompress_chunk (MFSA 2012-11)
https://notcve.org/view.php?id=CVE-2011-3026
16 Feb 2012 — Integer overflow in libpng, as used in Google Chrome before 17.0.963.56, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an integer truncation. Desbordamiento de entero en libpng, tal como se utiliza en Google Chrome antes de v17.0.963.56, permite a atacantes remotos causar una denegación de servicio o posiblemente tener un impacto no especificado a través de vectores desconocidos que provocan el truncado de enteros. • https://github.com/argp/cve-2011-3026-firefox • CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2010-3881 – kvm: arch/x86/kvm/x86.c: reading uninitialized stack memory
https://notcve.org/view.php?id=CVE-2010-3881
23 Dec 2010 — arch/x86/kvm/x86.c in the Linux kernel before 2.6.36.2 does not initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory via read operations on the /dev/kvm device. arch/x86/kvm/x86.c en el kernel de Linux v2.6.36.2 no inicializa ciertos miembros de estructura, lo que permite a usuarios locales obtener información potencialmente sensible del la pila de la pila de memoria del kernel a través de operaciones de lectura en el dispositivo... • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=97e69aa62f8b5d338d6cff49be09e37cc1262838 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •