CVSS: 9.8EPSS: 95%CPEs: 99EXPL: 2CVE-2009-1169 – Mozilla Firefox XSL - Parsing Remote Memory Corruption (PoC)
https://notcve.org/view.php?id=CVE-2009-1169
27 Mar 2009 — The txMozillaXSLTProcessor::TransformToDoc function in Mozilla Firefox before 3.0.8 and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XML file with a crafted XSLT transform. La función txMozillaXSLTProcessor::TransformToDoc en Firefox anterior a versión 3.0.8 y SeaMonkey anterior a versión 1.1.16, de Mozilla, permite a los atacantes remotos causar una denegación de servicio (bloqueo) y posiblemente ejecute código arbitrario po... • https://www.exploit-db.com/exploits/8285 • CWE-399: Resource Management Errors •
CVSS: 9.8EPSS: 66%CPEs: 2EXPL: 0CVE-2009-1044 – Mozilla Firefox XUL _moveToEdgeShift() Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2009-1044
23 Mar 2009 — Mozilla Firefox 3.0.7 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors related to the _moveToEdgeShift XUL tree method, which triggers garbage collection on objects that are still in use, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009. Mozilla Firefox versión 3.0.7 en Windows 7, permite a los atacantes remotos ejecutar código arbitrario por medio de vectores desconocidos relacionados con el método de árbol _moveToEdgeShift XUL, que desencadena un ga... • http://blogs.zdnet.com/security/?p=2934 • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 1%CPEs: 4EXPL: 2CVE-2009-0723 – LittleCms integer overflow
https://notcve.org/view.php?id=CVE-2009-0723
23 Mar 2009 — Multiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information. Múltiples desbordamientos de enteros en LittleCMS (también conocido como lcms o liblcms) anteriores a v1.18beta2, como el utilizado en Firefox v3.1beta, OpenJDK, y GIMP, permiten a atac... • http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.3EPSS: 0%CPEs: 4EXPL: 2CVE-2009-0733 – LittleCms lack of upper-bounds check on sizes
https://notcve.org/view.php?id=CVE-2009-0733
23 Mar 2009 — Multiple stack-based buffer overflows in the ReadSetOfCurves function in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file associated with a large integer value for the (1) input or (2) output channel, related to the ReadLUT_A2B and ReadLUT_B2A functions. Múltiples desbordamientos de búfer basados en pila en la función ReadSetOfCurves en LittleCMS (alias LCMS o liblcms) antes d... • http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 2CVE-2009-0581 – LittleCms memory leak
https://notcve.org/view.php?id=CVE-2009-0581
23 Mar 2009 — Memory leak in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted image file. Fuga de memoria en versiones de LittleCMS (alias LCMS o liblcms) anteriores a la 1.18beta2, tal como se utiliza en Firefox 3.1beta, OpenJDK, y el GIMP, permite causar, a atacantes dependientes de contexto, una denegación de servicio (mediante consumo de memoria y cai... • http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 6.5EPSS: 7%CPEs: 86EXPL: 3CVE-2009-0821 – Mozilla Firefox 2.0.x - Nested 'window.print()' Denial of Service
https://notcve.org/view.php?id=CVE-2009-0821
05 Mar 2009 — Mozilla Firefox 2.0.0.20 and earlier allows remote attackers to cause a denial of service (application crash) via nested calls to the window.print function, as demonstrated by a window.print(window.print()) in the onclick attribute of an INPUT element. Mozilla Firefox v2.0.0.20 y anteriores, permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) a través de llamadas anidadas a la función window.print, como se ha demostrado con window.print(window.print()) en el atributo onclic... • https://www.exploit-db.com/exploits/32836 • CWE-399: Resource Management Errors •
CVSS: 9.8EPSS: 22%CPEs: 88EXPL: 0CVE-2009-0772 – Firefox 2 and 3 - Layout engine crashes
https://notcve.org/view.php?id=CVE-2009-0772
05 Mar 2009 — The layout engine in Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to nsCSSStyleSheet::GetOwnerNode, events, and garbage collection, which triggers memory corruption. El motor en Mozilla Firefox 2 y 3 anteriores v3.0.7, Thunderbird anteriores a v2.0.0.21, y SeaMonkey v1.1.15 permite a los atacantes remotos causar una denegación de servicios (caída) y ... • http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00002.html • CWE-399: Resource Management Errors •
CVSS: 7.1EPSS: 0%CPEs: 88EXPL: 0CVE-2009-0776 – Firefox XML data theft via RDFXMLDataSource and cross-domain redirect
https://notcve.org/view.php?id=CVE-2009-0776
05 Mar 2009 — nsIRDFService in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to bypass the same-origin policy and read XML data from another domain via a cross-domain redirect. nsIRDFService de Mozilla Firefox anterior a v3.0.7, Thunderbird anterior a v2.0.0.21 y SeaMonkey anterior a v1.1.15; permite a atacantes remotos evitar la política de same-origin -mismo origen- y leer datos XML desde otro dominio a través de una redirección de dominio cruzado. • http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00002.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 79%CPEs: 88EXPL: 0CVE-2009-0771 – Firefox 3 Layout Engine Crashes
https://notcve.org/view.php?id=CVE-2009-0771
05 Mar 2009 — The layout engine in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain vectors that trigger memory corruption and assertion failures. El motor de diseño en Mozilla Firefox anterior a v3.0.7, Thunderbird anterior a v2.0.0.21, y SeaMonkey v1.1.15, permite a atacantes remotos provocar una denegación de servicio (caída) y posiblemente la ejecución de código de su elección a ... • http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00002.html • CWE-399: Resource Management Errors •
CVSS: 5.8EPSS: 1%CPEs: 88EXPL: 0CVE-2009-0777 – Firefox URL spoofing with invisible control characters
https://notcve.org/view.php?id=CVE-2009-0777
05 Mar 2009 — Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 decode invisible characters when they are displayed in the location bar, which causes an incorrect address to be displayed and makes it easier for remote attackers to spoof URLs and conduct phishing attacks. Mozilla Firefox en versiones anteriores a 3.0.7, Thunderbird en versiones anteriores 2.0.0.21 y SeaMonkey en versiones anteriores a 1.1.15, decodifican caracteres invisibles cuando son desplegados en la barra de ubica... • http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00002.html • CWE-20: Improper Input Validation •