CVSS: 9.8EPSS: 4%CPEs: 164EXPL: 0CVE-2012-0472 – Mozilla: Potential memory corruption during font rendering using cairo-dwrite (MFSA 2012-25)
https://notcve.org/view.php?id=CVE-2012-0472
25 Apr 2012 — The cairo-dwrite implementation in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9, when certain Windows Vista and Windows 7 configurations are used, does not properly restrict font-rendering attempts, which allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors. La implementación de cairo-dwrite en Mozilla Firefox v4.x hast... • http://secunia.com/advisories/48972 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 165EXPL: 0CVE-2012-0473 – Mozilla: WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error (MFSA 2012-26)
https://notcve.org/view.php?id=CVE-2012-0473
25 Apr 2012 — The WebGLBuffer::FindMaxUshortElement function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 calls the FindMaxElementInSubArray function with incorrect template arguments, which allows remote attackers to obtain sensitive information from video memory via a crafted WebGL.drawElements call. La función WebGLBuffer::FindMaxUshortElement en Mozilla Firefox v4.x hasta v11.0, Firefox ESR v10.x antes d... • http://secunia.com/advisories/48972 • CWE-189: Numeric Errors •
CVSS: 6.1EPSS: 0%CPEs: 165EXPL: 0CVE-2012-0477 – Mozilla: Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues (MFSA 2012-29)
https://notcve.org/view.php?id=CVE-2012-0477
25 Apr 2012 — Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to inject arbitrary web script or HTML via the (1) ISO-2022-KR or (2) ISO-2022-CN character set. Múltiples vulnerabilidades de ejcución de secuencias de comandos en sitios cruzados (XSS) en Mozilla Firefox v4.x hasta v11.0, Firefox ESR v10.x antes de v10.0.4, Thunderbird v5.0 ... • http://secunia.com/advisories/48920 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 20%CPEs: 166EXPL: 0CVE-2012-0470 – Mozilla: Invalid frees causes heap corruption in gfxImageSurface (MFSA 2012-23)
https://notcve.org/view.php?id=CVE-2012-0470
25 Apr 2012 — Heap-based buffer overflow in the nsSVGFEDiffuseLightingElement::LightPixel function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to cause a denial of service (invalid gfxImageSurface free operation) or possibly execute arbitrary code by leveraging the use of "different number systems." Desbordamiento de búfer basado en memoria dinámica en Mozilla Firefox v4.x hasta v11.... • http://secunia.com/advisories/48920 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.1EPSS: 0%CPEs: 165EXPL: 0CVE-2012-0471 – Mozilla: Potential XSS via multibyte content processing errors (MFSA 2012-24)
https://notcve.org/view.php?id=CVE-2012-0471
25 Apr 2012 — Cross-site scripting (XSS) vulnerability in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via a multibyte character set. Ejecución de secuencias de comandos en sitios cruzados (XSS) en Mozilla Firefox v4.x hasta v11.0, Firefox ESR v10.x antes de v10.0.4, Thunderbird v5.0 hasta v11.0, Thunderbird ESR v10.x antes de v10.0.4, y SeaMonkey a... • http://secunia.com/advisories/48920 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2011-3062 – Mozilla: Off-by-one error in OpenType Sanitizer (MFSA 2012-31)
https://notcve.org/view.php?id=CVE-2011-3062
30 Mar 2012 — Off-by-one error in the OpenType Sanitizer in Google Chrome before 18.0.1025.142 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted OpenType file. Error de tipo "Off-by-one" en OpenType Sanitizer en Google Chrome anterior a v18.0.1025.142 permite a atacantes remotos causar una denegación de servicio o posiblemente tener un impacto no especificado a través de un archivo modificado de OpenType. • http://code.google.com/p/chromium/issues/detail?id=116524 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-682: Incorrect Calculation •
CVSS: 8.8EPSS: 0%CPEs: 114EXPL: 0CVE-2012-0456 – Mozilla: SVG issues found with Address Sanitizer (MFSA 2012-14)
https://notcve.org/view.php?id=CVE-2012-0456
14 Mar 2012 — The SVG Filters implementation in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 might allow remote attackers to obtain sensitive information from process memory via vectors that trigger an out-of-bounds read. La implementación de filtros SVG en Mozilla Firefox antes de v3.6.28 y v4.x hasta v10.0, Firefox ESR v10.x antes de v10.0.3, Thunderbird antes de v3.1.20 y ... • http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 1%CPEs: 114EXPL: 1CVE-2012-0458 – Mozilla: Escalation of privilege with Javascript: URL as home page (MFSA 2012-16)
https://notcve.org/view.php?id=CVE-2012-0458
14 Mar 2012 — Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict setting the home page through the dragging of a URL to the home button, which allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a javascript: URL that is later interpreted in the about:sessionrestore context. Mozilla Firefox antes de v3.6.28 ... • http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 6%CPEs: 114EXPL: 0CVE-2012-0464 – Mozilla: Miscellaneous memory safety hazards (rv:11.0/ rv:10.0.3 / rv:1.9.2.28) (MFSA 2012-19)
https://notcve.org/view.php?id=CVE-2012-0464
14 Mar 2012 — Use-after-free vulnerability in the browser engine in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allows remote attackers to execute arbitrary code via vectors involving an empty argument to the array.join function in conjunction with the triggering of garbage collection. Vulnerabilidad en la gestión de recursos en el motor del navegador de Mozilla Firefox v3.6... • http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html • CWE-399: Resource Management Errors •
CVSS: 6.1EPSS: 0%CPEs: 140EXPL: 0CVE-2012-0451 – Mozilla: XSS with multiple Content Security Policy headers (MFSA 2012-15)
https://notcve.org/view.php?id=CVE-2012-0451
14 Mar 2012 — CRLF injection vulnerability in Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allows remote web servers to bypass intended Content Security Policy (CSP) restrictions and possibly conduct cross-site scripting (XSS) attacks via crafted HTTP headers. Vulnerabilidad de inyección de falsificación de peticiones en sitios cruzados en Mozilla Firefox v4.x hasta v10.0, Firefox ESR v10.x antes de v10.0.3, Th... • http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-94: Improper Control of Generation of Code ('Code Injection') •