CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2015-4483
https://notcve.org/view.php?id=CVE-2015-4483
Mozilla Firefox before 40.0 allows man-in-the-middle attackers to bypass a mixed-content protection mechanism via a feed: URL in a POST request. Vulnerabilidad en Mozilla Firefox en versiones anteriores a 40.0, permite a atacantes man-in-the-middle evadir el mecanismo de protección de contenido mixto a través de una fuente: URL en una petición POST. • http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html http://www.mozilla.org/security/announce/2015/mfsa2015-86.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securityfocus.com/bid/76510 http://www.securitytracker.com/id/1033247 https://bugzilla.mozilla.org/show_bug.cgi?id=1148732 https://security.gentoo.org/glsa/201605-06 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 0%CPEs: 2EXPL: 0CVE-2015-4496 – Mozilla: Integer overflows in libstagefright while processing MP4 video metadata (MFSA 2015-93)
https://notcve.org/view.php?id=CVE-2015-4496
Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file, a related issue to CVE-2015-1538. Múltiples desbordamientos de entero en libstagefright en Mozilla Firefox en versiones anteriores a 38.0 permite a atacantes remotos ejecutar código arbitrario a través de una muestra de metadatos manipulados en un archivo de vídeo MPEG-4, un caso relacionado con CVE-2015-1538. • http://www.mozilla.org/security/announce/2015/mfsa2015-93.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html https://bugzilla.mozilla.org/show_bug.cgi?id=1149605 https://hg.mozilla.org/mozilla-central/rev/87277085561a https://access.redhat.com/security/cve/CVE-2015-4496 https://bugzilla.redhat.com/show_bug.cgi?id=1253550 • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 2%CPEs: 12EXPL: 0CVE-2015-4488 – Mozilla: Vulnerabilities found through code inspection (MFSA 2015-90)
https://notcve.org/view.php?id=CVE-2015-4488
Use-after-free vulnerability in the StyleAnimationValue class in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 allows remote attackers to have an unspecified impact by leveraging a StyleAnimationValue::operator self assignment. Vulnerabilidad de uso después de liberación en la memoria en la clase StyleAnimationValue en Mozilla Firefox en versiones anteriores a 40.0, Firefox ESR 38.x en versiones anteriores a 38.2 y Firefox OS en versiones anteriores a 2.2, permite a atacantes remotos tener un impacto desconocido mediante el aprovechamiento de una autoasignación de StyleAnimationValue::operator. • http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html http://lists.opensuse.org/opensuse-updates/2015-08/msg00030.html http://lists.opensuse.org/opensuse-updates/2015-08/msg00031.html http •
CVSS: 6.8EPSS: 1%CPEs: 17EXPL: 0CVE-2015-4491 – Mozilla: Heap overflow in gdk-pixbuf when scaling bitmap images (MFSA 2015-88)
https://notcve.org/view.php?id=CVE-2015-4491
Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5, as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux, Google Chrome on Linux, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via crafted bitmap dimensions that are mishandled during scaling. Vulnerabilidad de desbordamiento de entero en la función make_filter_table en pixops/pixops.c en gdk-pixbuf en versiones anteriores a 2.31.5, tal como es usado en Mozilla Firefox en versiones anteriores a 40.0 y Firefox ESR 38.x en versiones anteriores a 38.2 en Linux, Google Chrome en Linux y otros productos, permite a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (desbordamiento de buffer basado en memoria dinámica y caída de aplicación) a través de dimensiones bitmap manipuladas que no son manejadas correctamente durante el escalado.. An integer overflow, leading to a heap-based buffer overflow, was found in the way gdk-pixbuf, an image loading library for GNOME, scaled certain bitmap format images. An attacker could use a specially crafted BMP image file that, when processed by an application compiled against the gdk-pixbuf library, would cause that application to crash or execute arbitrary code with the permissions of the user running the application. • http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165701.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165703.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165730.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165732.html http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html http://lists.opensuse.org/opensuse • CWE-122: Heap-based Buffer Overflow CWE-189: Numeric Errors •
CVSS: 9.3EPSS: 3%CPEs: 10EXPL: 0CVE-2015-4480 – Mozilla: Overflow issues in libstagefright (MFSA 2015-83)
https://notcve.org/view.php?id=CVE-2015-4480
Integer overflow in the stagefright::SampleTable::isValid function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via crafted MPEG-4 video data with H.264 encoding. Vulnerabilidad de desbordamiento de entero en la función stagefright::SampleTable::isValid de libstagefright en Mozilla Firefox en versiones anteriores a 40.0 y Firefox ESR 38.x en versiones anteriores a 38.2, permite a atacantes remotos ejecutar código arbitrario a través de los datos manipulados de vídeo MPEG-4 con la codificación H.264. • http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html http://lists.opensuse.org/opensuse-updates/2015-08/msg00030.html http://lists.opensuse.org/opensuse-updates/2015-08/msg00031.html http://rhn.redhat.com/errata/RHSA-2015-1586.html http://www.debian.org/security/2015/dsa-3333 http://www.mozilla.org/security/announce/2015/mfsa2015-83.html http://www.oracle.com/technetwork/topics/security/bull • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-189: Numeric Errors •