CVSS: 7.5EPSS: 56%CPEs: 114EXPL: 0CVE-2012-0463
https://notcve.org/view.php?id=CVE-2012-0463
The nsWindow implementation in the browser engine in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 does not check the validity of an instance after event dispatching, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, as demonstrated by Mobile Firefox on Android. La implementación nsWindow en el motor del navegador de Mozilla Firefox 3.6.28 y antes de 4.x través de 10.0, Firefox ESR 10.x antes de 10.0.3, Thunderbird antes de 3.1.20 y 5.0 hasta 10.0, Thunderbird ESR 10.x antes de 10.0.3 , y SeaMonkey antes de 2.8 no comprueba la validez de una instancia después de distribución de eventos, que permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria y caída de aplicación) o posiblemente ejecutar código arbitrario a través de vectores desconocidos, como lo demuestra el Firefox Mobile en Android . • http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html http://secunia.com/advisories/48402 http://secunia.com/advisories/48553 http://secunia.com/advisories/48561 http://secunia.com/advisories/48624 http://secunia.com/advisories/48629 http://www.mozilla.org/security/announce/2012/mfsa2012-19.html http://www.securityfocus.com/bid&# • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 41EXPL: 0CVE-2012-0455 – Mozilla: XSS with Drag and Drop and Javascript: URL (MFSA 2012-13)
https://notcve.org/view.php?id=CVE-2012-0455
Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict drag-and-drop operations on javascript: URLs, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web page, related to a "DragAndDropJacking" issue. Mozilla Firefox antes de v3.6.28 y v4.x hasta v10.0, Firefox ESR v10.x antes de v10.0.3, Thunderbird antes de v3.1.20 y v5.0 hasta v10.0, Thunderbird ESR v10.x antes de v10.0.3, y SeaMonkey antes de v2.8 no restringen adecuadamente arrastrar y soltar en javascript: URLs, lo que permite a atacantes remotos asistidos por el usuario realizar ataques de ejecución de secuencias de comandos en sitios cruzados a través de una página web modificada, relacionado con un problema "DragAndDropJacking". • http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html http://rhn.redhat.com/errata/RHSA-2012-0387.html http://rhn.redhat.com/errata/RHSA-2012-0388.html http://secunia.com/advisories/48359 http://secunia.com/advisories/48402 http://secunia.com/advisories/48414 http://secunia.com/advisories/48495 http://secunia.com/advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 24%CPEs: 140EXPL: 0CVE-2012-0462 – Mozilla: Miscellaneous memory safety hazards (rv:11.0/ rv:10.0.3 / rv:1.9.2.28) (MFSA 2012-19)
https://notcve.org/view.php?id=CVE-2012-0462
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador de Mozilla Firefox v4.x hasta v10.0, Firefox ESR v10.x antes de v10.0.3, Thunderbird v5.0 a v10.0, Thunderbird ESR v10.x antes de v10.0.3, y SeaMonkey antes de v2.8 permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria y caída de aplicación) o posiblemente ejecutar código arbitrario a través de vectores desconocidos. • http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html http://rhn.redhat.com/errata/RHSA-2012-0387.html http://rhn.redhat.com/errata/RHSA-2012-0388.html http://secunia.com/advisories/48359 http://secunia.com/advisories/48402 http://secunia.com/advisories/48496 http://secunia.com/advisories/48513 http://secunia.com/advisories •
CVSS: 6.8EPSS: 1%CPEs: 114EXPL: 1CVE-2012-0458 – Mozilla: Escalation of privilege with Javascript: URL as home page (MFSA 2012-16)
https://notcve.org/view.php?id=CVE-2012-0458
Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict setting the home page through the dragging of a URL to the home button, which allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a javascript: URL that is later interpreted in the about:sessionrestore context. Mozilla Firefox antes de v3.6.28 y v4.x hasta v10.0, Firefox ESR v10.x antes de v10.0.3, Thunderbird antes de v3.1.20 y v5.0 hasta v10.0, Thunderbird ESR v10.x antes de v10.0.3, y SeaMonkey antes de v2.8 no restringen adecuadamente establecer la página principal a través del arrastre de una dirección URL hacia el botón de inicio, lo que permite a atacantes remotos asistidos por el usuario ejecutar código JavaScript arbitrario con privilegios de chrome a través de un javascript: URL que luego se interpreta en el ??contexto about:sessionrestore. • http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html http://rhn.redhat.com/errata/RHSA-2012-0387.html http://rhn.redhat.com/errata/RHSA-2012-0388.html http://secunia.com/advisories/48359 http://secunia.com/advisories/48402 http://secunia.com/advisories/48414 http://secunia.com/advisories/48495 http://secunia.com/advisories • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 12%CPEs: 145EXPL: 0CVE-2012-0454
https://notcve.org/view.php?id=CVE-2012-0454
Use-after-free vulnerability in Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 on 32-bit Windows 7 platforms allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving use of the file-open dialog in a child window, related to the IUnknown_QueryService function in the Windows shlwapi.dll library. Vulnerabilidad en la gestión de recursos en Mozilla Firefox v4.x hasta v10.0, Firefox ESR v10.x antes de v10.0.3, Thunderbird v5.0 a v10.0, Thunderbird ESR v10.x antes de v10.0.3, y SeaMonkey antes de v2.8 en plataformas 32-bit de Windows 7, permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) o posiblemente ejecutar código arbitrario a través de vectores relacionados con el uso del cuadro de diálogo abrir archivo en una ventana secundaria, relacionada con la función IUnknown_QueryService en la librería de Windows shlwapi.dll. • http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html http://secunia.com/advisories/48402 http://secunia.com/advisories/48561 http://secunia.com/advisories/48629 http://www.mandriva.com/security/advisories?name=MDVSA-2012:032 http://www.mozilla.org/security/announce/2012/mfsa2012-12.html http://www.securitytracker.com/id?1026801 http://www.securitytracker.com/id?1026803 http://www.securitytracker.com/id?1026804 https://bugzilla.mozilla.org/show_bug.cgi? • CWE-399: Resource Management Errors •