CVSS: 6.1EPSS: 0%CPEs: 20EXPL: 2CVE-2009-3012
https://notcve.org/view.php?id=CVE-2009-3012
31 Aug 2009 — Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location header that contains JavaScript sequences in a data:text/html URI or (2) entering a data:text/html URI with JavaScript sequences when specifying the content of a Location header. NOTE: the JavaScript executes outside of the context of the HTTP si... • http://websecurity.com.ua/3323 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 60EXPL: 2CVE-2009-3014
https://notcve.org/view.php?id=CVE-2009-3014
31 Aug 2009 — Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly handle javascript: URIs in HTML links within 302 error documents sent from web servers, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location HTTP response header or (2) specifying the content of a Location HTTP response header. Mozilla Firefox v3.0.13 y anteriores, v3.5, v3.6 a1 pre, y v3.7 a1... • http://websecurity.com.ua/3373 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 7%CPEs: 11EXPL: 0CVE-2009-2662
https://notcve.org/view.php?id=CVE-2009-2662
04 Aug 2009 — The browser engine in Mozilla Firefox 3.5.x before 3.5.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the TraceRecorder::snapshot function in js/src/jstracer.cpp, and unspecified other vectors. El motor de búsqueda en Mozilla Firefox anteriores v3.0.13 , y v3.5.x anteriores v3.5.2, permite a atacantes remotos causar una denegación de servicio (consumo de memoria y caída de aplicación) o probablemente ... • http://secunia.com/advisories/36126 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 2%CPEs: 103EXPL: 0CVE-2009-2663 – libvorbis: Improper codec headers processing (DoS, ACE)
https://notcve.org/view.php?id=CVE-2009-2663
04 Aug 2009 — libvorbis before r16182, as used in Mozilla Firefox 3.5.x before 3.5.2 and other products, allows context-dependent attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted .ogg file. libvorbis anterior a r16182, usado en Mozilla Firefox anterior a v3.0.13 y v3.5.x anterior a v3.5.2 y otros productos, permite a atacantes dependientes de contexto, provocar una denegación de servicio (corrupción de memoria y caída de aplicación) o posibl... • http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html • CWE-399: Resource Management Errors •
CVSS: 9.8EPSS: 3%CPEs: 103EXPL: 0CVE-2009-2664
https://notcve.org/view.php?id=CVE-2009-2664
04 Aug 2009 — The js_watch_set function in js/src/jsdbgapi.cpp in the JavaScript engine in Mozilla Firefox before 3.0.12 allows remote attackers to cause a denial of service (assertion failure and application exit) or possibly execute arbitrary code via a crafted .js file, related to a "memory safety bug." NOTE: this was originally reported as affecting versions before 3.0.13. la función js_watch_set en js/src/jsdbgapi.cpp en el motor JavaScript de Mozilla Firefox anterior a v3.0.13, y v3.5.x anterior a v3.5.2, permite a... • http://secunia.com/advisories/36126 • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 2%CPEs: 103EXPL: 0CVE-2009-2470 – Mozilla data corruption with SOCKS5 reply
https://notcve.org/view.php?id=CVE-2009-2470
04 Aug 2009 — Mozilla Firefox before 3.0.12, and 3.5.x before 3.5.2, allows remote SOCKS5 proxy servers to cause a denial of service (data stream corruption) via a long domain name in a reply. Mozilla Firefox en versiones anteriores a la 3.0.12 y 3.5.x en versiones anteriores a la 3.5.2 permite a servidores proxy SOCKS5 remotos provocar una denegación de servicio (corrupción del flujo de datos) mediante un nombre de dominio largo en una respuesta. • http://secunia.com/advisories/36126 • CWE-20: Improper Input Validation •
CVSS: 7.4EPSS: 13%CPEs: 108EXPL: 3CVE-2009-2654 – Mozilla Firefox 3.5.1 - Error Page Address Bar URI Spoofing
https://notcve.org/view.php?id=CVE-2009-2654
03 Aug 2009 — Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to spoof the address bar, and possibly conduct phishing attacks, via a crafted web page that calls window.open with an invalid character in the URL, makes document.write calls to the resulting object, and then calls the stop method during the loading of the error page. Firefox de Mozilla anterior a versión 3.0.13, y versiones 3.5.x anteriores a 3.5.2, permite a atacantes remotos falsificar la barra de direcciones y posiblemente r... • https://www.exploit-db.com/exploits/33103 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 1%CPEs: 12EXPL: 0CVE-2009-2408 – firefox/nss: doesn't handle NULL in Common Name properly
https://notcve.org/view.php?id=CVE-2009-2408
30 Jul 2009 — Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5. Mozilla Firefox anterior a v3.5 y NSS anterior a v... • http://isc.sans.org/diary.html?storyid=7003 • CWE-295: Improper Certificate Validation •
CVSS: 10.0EPSS: 4%CPEs: 124EXPL: 0CVE-2009-2463 – Mozilla Base64 decoding crash
https://notcve.org/view.php?id=CVE-2009-2463
22 Jul 2009 — Multiple integer overflows in the (1) PL_Base64Decode and (2) PL_Base64Encode functions in nsprpub/lib/libc/src/base64.c in Mozilla Firefox before 3.0.12, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors that trigger buffer overflows. Desbordamiento de enteros en una función base64 decoding en Mozilla Firefox anteriores a v.3.0.12 y Thunderbird perm... • http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html • CWE-189: Numeric Errors •
CVSS: 10.0EPSS: 19%CPEs: 117EXPL: 1CVE-2009-2464 – Mozilla Firefox 3.0.11 and Thunderbird 2.0.9 - RDF File Handling Remote Memory Corruption
https://notcve.org/view.php?id=CVE-2009-2464
22 Jul 2009 — The nsXULTemplateQueryProcessorRDF::CheckIsSeparator function in Mozilla Firefox before 3.0.12, SeaMonkey 2.0a1pre, and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to loading multiple RDF files in a XUL tree element. El nsXULTemplateQueryProcessorRDF::CheckIsSeparator function en Mozilla Firefox anteriores a v3.0.12, SeaMonkey v2.0a1pre, y Thunderbird permite a atacantes remotos causar una d... • https://www.exploit-db.com/exploits/33101 • CWE-399: Resource Management Errors •