CVSS: 7.5EPSS: 7%CPEs: 2EXPL: 0CVE-2016-1978 – nss: Use-after-free in NSS during SSL connections in low memory (MFSA 2016-15)
https://notcve.org/view.php?id=CVE-2016-1978
Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time of high memory consumption. Vulnerabilidad de uso después de liberación de memoria en la función ssl3_HandleECDHServerKeyExchange en Mozilla Network Security Services (NSS) en versiones anteriores a 3.21, como se utiliza en Mozilla Firefox en versiones anteriores a 44.0, permite a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto no especificado llevando a cabo un apretón de manos SSL (1) DHE o (2) ECDHE en un momento de alto consumo de memoria. A use-after-free flaw was found in the way NSS handled DHE (Diffie–Hellman key exchange) and ECDHE (Elliptic Curve Diffie-Hellman key exchange) handshake messages. A remote attacker could send a specially crafted handshake message that, when parsed by an application linked against NSS, would cause that application to crash or, under certain special conditions, execute arbitrary code using the permissions of the user running the application. • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.html http://rhn.redhat.com/errata/RHSA-2016-0591.html http://rhn.redhat.com/errata/RHSA-2016-0684.html http://rhn.redhat.com/errata/RHSA-2016-0685.html http://www.debian.org/security/2016/dsa- •
CVSS: 8.8EPSS: 1%CPEs: 2EXPL: 0CVE-2016-1970
https://notcve.org/view.php?id=CVE-2016-1970
Integer underflow in the srtp_unprotect function in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors. Desbordamiento inferior de entero en la función srtp_unprotect en la implementación de WebRTC en Mozilla Firefox en versiones anteriores a 45.0 en Windows podría permitir a atacantes remotos causar una denegación de servicio (corrupción de memoria) o posiblemente tener otro impacto no especificado a través de vectores desconocidos. • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html http://www.mozilla.org/security/announce/2016/mfsa2016-32.html http://www.securityfocus.com/bid/84220 http://www.securitytracker.com/id/1035215 https://bugzilla.mozilla.org/show_bug.cgi?id=1216837 https://security.gentoo.org/glsa/201605-06 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2016-1976
https://notcve.org/view.php?id=CVE-2016-1976
Use-after-free vulnerability in the DesktopDisplayDevice class in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. Vulnerabilidad de uso después de liberación de memoria en la clase DesktopDisplayDevice en la implementación de WebRTC en Mozilla Firefox en versiones anteriores a 45.0 en Windows podría permitir a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto no especificado a través de vectores desconocidos. • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html http://www.mozilla.org/security/announce/2016/mfsa2016-32.html http://www.securityfocus.com/bid/84220 http://www.securitytracker.com/id/1035215 https://bugzilla.mozilla.org/show_bug.cgi?id=1176340 https://security.gentoo.org/glsa/201605-06 •
CVSS: 8.8EPSS: 3%CPEs: 1EXPL: 0CVE-2016-1959
https://notcve.org/view.php?id=CVE-2016-1959
The ServiceWorkerManager class in Mozilla Firefox before 45.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via unspecified use of the Clients API. La clase ServiceWorkerManager en Mozilla Firefox en versiones anteriores a 45.0 permite a atacantes remotos ejecutar código arbitrario o causar una denegación del servicio (lectura fuera de rango y corrupción de memoria) a través del uso no especificado de la API Clients. • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html http://www.mozilla.org/security/announce/2016/mfsa2016-22.html http://www.securitytracker.com/id/1035215 http://www.ubuntu.com/usn/USN-2917-1 http://www.ubuntu.com/usn/USN-2917-2 http://www.ubuntu.com/usn/USN-2917-3 https://bugzilla.mozilla.org/show_bug.cgi?id=1234949 https://security.gentoo.org/glsa/201605-06 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 4%CPEs: 1EXPL: 0CVE-2016-1968
https://notcve.org/view.php?id=CVE-2016-1968
Integer underflow in Brotli, as used in Mozilla Firefox before 45.0, allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted data with brotli compression. Desbordamiento inferior de entero en Brotli, como se utiliza en Mozilla Firefox en versiones anteriores a 45.0, permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (desbordamiento de buffer) a través de datos manipulados con compresión brotli. • http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html http://www.mozilla.org/security/announce/2016/mfsa2016-30.html http://www.securitytracker.com/id/1035215 http://www.ubuntu.com/usn/USN-2917-1 http://www.ubuntu.com/usn/USN-2917-2 http://www.ubuntu.com/usn/USN-2917-3 https://bugzilla.mozilla.org/show_bug.cgi?id=1246742 https://security.gentoo.org/glsa/201605-06 • CWE-189: Numeric Errors •