CVSS: 4.3EPSS: 1%CPEs: 91EXPL: 0CVE-2010-0161
https://notcve.org/view.php?id=CVE-2010-0161
The nsAuthSSPI::Unwrap function in extensions/auth/nsAuthSSPI.cpp in Mozilla Thunderbird before 2.0.0.24 and SeaMonkey before 1.1.19 on Windows Vista, Windows Server 2008 R2, and Windows 7 allows remote SMTP, IMAP, and POP servers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via crafted data in a session that uses SSPI. La función nsAuthSSPI::Unwrap en extensions/auth/nsAuthSSPI.cpp en Mozilla Thunderbird anteriores a v2.0.0.24 y SeaMonkey anteriores a v1.1.19 en Windows Vista, Windows Server 2008 R2, y Windows 7 permite a servidores SMTP, IMAP y POP, provocar una denegación de servicio (corrupción de memoria dinámica y caída de la aplicación) o posiblemente ejecución de código remoto a través de datos manipulados en una sesión que utiliza SSPI. • http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html http://secunia.com/advisories/39001 http://www.mozilla.org/security/announce/2010/mfsa2010-07.html http://www.securityfocus.com/bid/38831 http://www.vupen.com/english/advisories/2010/0648 https://bugzilla.mozilla.org/show_bug.cgi?id=511806 https://exchange.xforce.ibmcloud.com/vulnerabilities/56992 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14159 • CWE-399: Resource Management Errors •
CVSS: 6.8EPSS: 6%CPEs: 92EXPL: 0CVE-2010-0163 – seamonkey/thunderbird: crash when indexing certain messages with attachments
https://notcve.org/view.php?id=CVE-2010-0163
Mozilla Thunderbird before 2.0.0.24 and SeaMonkey before 1.1.19 process e-mail attachments with a parser that performs casts and line termination incorrectly, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted message, related to message indexing. Mozilla Thunderbird anteriores a la v2.0.0.24 y SeaMonkey anteriores a la v1.1.19 procesa ficheros adjuntos a correos electrónicos con un analizados sintáctico que realiza repartos y terminaciones de línea de forma incorrecta, lo que permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) y posiblemente ejecución de código de su elección a través de un mensaje manipulado, relativo a la indexación de mensajes. • http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html http://secunia.com/advisories/38977 http://secunia.com/advisories/39001 http://www.mozilla.org/security/announce/2010/mfsa2010-07.html http://www.redhat.com/support/errata/RHSA-2010-0499.html http://www.securityfocus.com/bid/38831 http://www.ubuntu.com/usn/USN-915-1 http://www.vupen.com/english/advisories/2010/0648 http://www.vupen.com/english/advisories/2010/1556 https://bugzilla.mozilla.org/sh •
CVSS: 10.0EPSS: 4%CPEs: 9EXPL: 0CVE-2010-0159 – Mozilla crashes with evidence of memory corruption (MFSA 2010-01)
https://notcve.org/view.php?id=CVE-2010-0159
The browser engine in Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, Thunderbird before 3.0.2, and SeaMonkey before 2.0.3 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the nsBlockFrame::StealFrame function in layout/generic/nsBlockFrame.cpp, and unspecified other vectors. El motor de navegación en Mozilla Firefox v3.0.x anterior a la v3.0.18 y 3.5.x anterior a la v3.5.8, Thunderbird anterior a la v3.0.2, y SeaMonkey anterior a la v2.0.3 permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria y caída de la aplicación) o posiblemente ejecutar código de su elección a través de vectores relativos a la función nsBlockFrame::StealFrame en layout/generic/nsBlockFrame.cpp, ay otros vectores no específicos. • http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036097.html http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036132.html http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00001.html http://secunia.com/advisories/37242& •
CVSS: 4.3EPSS: 0%CPEs: 79EXPL: 0CVE-2008-6961
https://notcve.org/view.php?id=CVE-2008-6961
mailnews in Mozilla Thunderbird before 2.0.0.18 and SeaMonkey before 1.1.13, when JavaScript is enabled in mail, allows remote attackers to obtain sensitive information about the recipient, or comments in forwarded mail, via script that reads the (1) .documentURI or (2) .textContent DOM properties. mailnews en Mozilla Thunderbird anteriores a v2.0.0.18 y SeaMonkey anteriores a v1.1.13, cuando JavaScript es habilita en correo electrónico, permite a los atacantes remotos obtener información sensible acerca del recipiente, o comentarios en correos re-enviados, a través de una secuencia de comando que lee las propiedades (1) .documentURI or (2) .textContent DOM • http://secunia.com/advisories/32714 http://secunia.com/advisories/32715 http://www.mozilla.org/security/announce/2008/mfsa2008-59.html http://www.securityfocus.com/bid/32363 http://www.securitytracker.com/id?1021247 https://bugzilla.mozilla.org/show_bug.cgi?id=458883 https://exchange.xforce.ibmcloud.com/vulnerabilities/46734 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.8EPSS: 0%CPEs: 12EXPL: 0CVE-2009-2408 – firefox/nss: doesn't handle NULL in Common Name properly
https://notcve.org/view.php?id=CVE-2009-2408
Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5. Mozilla Firefox anterior a v3.5 y NSS anterior a v3.12.3 no tratan apropiadamente un carácter '\0' en un nombre de dominio en el campo nombre común (CN) del asunto de un certificado X.509, que permite a un atacante de hombre-en-el-medio suplantar servidores SSL arbitrarios a través de un certificado manipulado por una autoridad de certificación. • http://isc.sans.org/diary.html?storyid=7003 http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html http://marc.info/?l=oss-security&m=125198917018936&w=2 http://osvdb.org/56723 http://secunia.com/advisories/36088 http://secunia.com/advisories/36125 http://secunia.com/advisories/36139 http://secunia.com/advisories/36157 http://secunia.com/advisories/36434 http://secunia.com/advisories/36669 http://secunia.com/advisories/37098 http://sunsolve.sun.com • CWE-295: Improper Certificate Validation •