CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2015-6247 – Debian Security Advisory 3367-1
https://notcve.org/view.php?id=CVE-2015-6247
24 Aug 2015 — The dissect_openflow_tablemod_v5 function in epan/dissectors/packet-openflow_v5.c in the OpenFlow dissector in Wireshark 1.12.x before 1.12.7 does not validate a certain offset value, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. Vulnerabilidad en la función dissect_openflow_tablemod_v5 en epan/dissectors/packet-openflow_v5.c en el disector OpenFlow en Wireshark 1.12.x en versiones anteriores a 1.12.7, no valida un cierto valor de desplazamiento, lo que per... • http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168837.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2015-6248 – wireshark: Ptvcursor crash (wnpa-sec-2015-28)
https://notcve.org/view.php?id=CVE-2015-6248
24 Aug 2015 — The ptvcursor_add function in the ptvcursor implementation in epan/proto.c in Wireshark 1.12.x before 1.12.7 does not check whether the expected amount of data is available, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Vulnerabilidad en la función ptvcursor_add en la implementación ptvcursor en epan/proto.c en Wireshark 1.12.x en versiones anteriores a 1.12.7, no comprueba si la cantidad de datos esperada está disponible, lo que permite a atacantes rem... • http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168837.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2015-6249 – Debian Security Advisory 3367-1
https://notcve.org/view.php?id=CVE-2015-6249
24 Aug 2015 — The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.12.x before 1.12.7 does not prevent the conflicting use of a table for both IPv4 and IPv6 addresses, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Vulnerabilidad en la función dissect_wccp2r1_address_table_info en epan/dissectors/packet-wccp.c en el disector WCCP en Wireshark 1.12.x en versiones anteriores a 1.12.7, no impide el uso conf... • http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168837.html • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 5%CPEs: 43EXPL: 0CVE-2015-5963 – python-django: Denial-of-service possibility in logout() view by filling session store
https://notcve.org/view.php?id=CVE-2015-5963
18 Aug 2015 — contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record. Vulnerabilidad en contrib.sessions.middleware.SessionMiddleware en Django 1.8.x en versiones anteriores a 1.8.4, 1.7.x en versiones anteriores... • http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html • CWE-399: Resource Management Errors CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.3EPSS: 2%CPEs: 43EXPL: 0CVE-2015-5964 – python-django: Denial-of-service possibility in logout() view by filling session store
https://notcve.org/view.php?id=CVE-2015-5964
18 Aug 2015 — The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors. Vulnerabilidad en las funciones (1) contrib.sessions.backends.base.SessionBase.flush y (2) cache_db.SessionStore.flush en Django 1.7.x en versiones anteriores a 1.7.10, ... • http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html • CWE-399: Resource Management Errors CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2015-4482 – Gentoo Linux Security Advisory 201605-06
https://notcve.org/view.php?id=CVE-2015-4482
16 Aug 2015 — mar_read.c in the Updater in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows local users to gain privileges or cause a denial of service (out-of-bounds write) via a crafted name of a Mozilla Archive (aka MAR) file. Vulnerabilidad en mar_read.c en el Updater en Mozilla Firefox en versiones anteriores a 40.0 y Firefox ESR 38.x en versiones anteriores a 38.2, permite a usuarios locales obtener privilegios o provocar una denegación de servicio (escritura fuera de rango) a través de un nombre... • http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.0EPSS: 0%CPEs: 9EXPL: 2CVE-2015-4481 – Mozilla - Maintenance Service Log File Overwrite Privilege Escalation
https://notcve.org/view.php?id=CVE-2015-4481
16 Aug 2015 — Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update. Vulnerabilidad de condición de carrera en el Servicio de Mantenimiento de Mozilla en Mozilla Firefox en versiones anteriores a 40.0 y Firefox ESR 38.x en versiones anteriores a 38.2 en Windows, permite a usuarios locales escribir en archivos... • https://packetstorm.news/files/id/133226 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 9.3EPSS: 2%CPEs: 2EXPL: 0CVE-2015-4496 – Mozilla: Integer overflows in libstagefright while processing MP4 video metadata (MFSA 2015-93)
https://notcve.org/view.php?id=CVE-2015-4496
16 Aug 2015 — Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file, a related issue to CVE-2015-1538. Múltiples desbordamientos de entero en libstagefright en Mozilla Firefox en versiones anteriores a 38.0 permite a atacantes remotos ejecutar código arbitrario a través de una muestra de metadatos manipulados en un archivo de vídeo MPEG-4, un caso relacionado con CVE-2015-1538. • http://www.mozilla.org/security/announce/2015/mfsa2015-93.html • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •
CVSS: 9.1EPSS: 0%CPEs: 4EXPL: 0CVE-2015-4483 – Gentoo Linux Security Advisory 201605-06
https://notcve.org/view.php?id=CVE-2015-4483
16 Aug 2015 — Mozilla Firefox before 40.0 allows man-in-the-middle attackers to bypass a mixed-content protection mechanism via a feed: URL in a POST request. Vulnerabilidad en Mozilla Firefox en versiones anteriores a 40.0, permite a atacantes man-in-the-middle evadir el mecanismo de protección de contenido mixto a través de una fuente: URL en una petición POST. Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which ... • http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2015-4490 – Gentoo Linux Security Advisory 201605-06
https://notcve.org/view.php?id=CVE-2015-4490
11 Aug 2015 — The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not implement the Content Security Policy Level 2 exceptions for the blob, data, and filesystem URL schemes during wildcard source-expression matching, which might make it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging unexpected policy-enforcement behavior. Vulnerabilidad en la función nsCSPHostSrc::permits en dom/security/nsCSPUtils.cpp en Mozilla Firefox en versio... • http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •