CVSS: 7.5EPSS: 6%CPEs: 1EXPL: 0CVE-2015-0814
https://notcve.org/view.php?id=CVE-2015-0814
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador en Mozilla Firefox anterior a 37.0 permiten a atacantes remotos causar una denegación de servicio (corrupción de memoria y caída de aplicación) o posiblemente ejecutar código arbitrario a través de vectores desconocidos. • http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00006.html http://www.mozilla.org/security/announce/2015/mfsa2015-30.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securitytracker.com/id/1031996 http://www.securitytracker.com/id/1032000 http://www.ubuntu.com/usn/USN-2550-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1005991 https://bugzilla.mozilla.or •
CVSS: 7.5EPSS: 6%CPEs: 3EXPL: 0CVE-2015-0815 – Mozilla: Miscellaneous memory safety hazards (rv:31.6) (MFSA 2015-30)
https://notcve.org/view.php?id=CVE-2015-0815
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador en Mozilla Firefox anterior a 37.0, Firefox ESR 31.x anterior a 31.6, y Thunderbird anterior a 31.6 permiten a atacantes remotos causar una denegación de servicio (corrupción de memoria y caída de aplicación) o posiblemente ejecutar código arbitrario a través de vectores desconocidos. • http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html http://rhn.redhat.com/errata/RHSA-2015-0766.html http://rhn.redhat.com/errata/RHSA-2015-0771.html http://www.debian.org/security/2015/dsa-3211 http://www.debian.org/security/2015/dsa-3212 • CWE-122: Heap-based Buffer Overflow •
CVSS: 7.5EPSS: 95%CPEs: 3EXPL: 2CVE-2015-0816 – Mozilla Firefox resource: URL Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-0816
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js. Mozilla Firefox anterior a 37.0, Firefox ESR 31.x anterior a 31.6, y Thunderbird anterior a 31.6 no restringe correctamente las URLs resource:, lo que facilita a atacantes remotos ejecutar código JavaScript arbitrario con privilegios chrome mediante el aprovechamiento de la habilidad de evadir Same Origin Policy, tal y como fue demostrado por la URL resource: asociada con PDF.js. A flaw was found in the way documents were loaded via resource URLs in, for example, Mozilla's PDF.js PDF file viewer. An attacker could use this flaw to bypass certain restrictions and under certain conditions even execute arbitrary code with the privileges of the user running Firefox. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Mozilla Firefox. • https://www.exploit-db.com/exploits/37958 http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html http://rhn.redhat.com/errata/RHSA-2015-0766.html http://rhn.redhat.com/errata/RHSA-2015-0771.html http://www.debian.org/security/2015/dsa-3211 http&# • CWE-250: Execution with Unnecessary Privileges CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2015-0800
https://notcve.org/view.php?id=CVE-2015-0800
The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a related issue to CVE-2012-2808. La implementación PRNG en el solucionador (resolver) DNS en Mozilla Firefox (también conocido como Fennec) anterior a 37.0 en Android no genera correctamente números aleatorios para los valores de identificadores de consultas y los puertos de fuentes UDP, lo que facilita a atacantes remotos falsificar las respuestas DNS mediante la adivinación de estos números, un problema relacionado con CVE-2012-2808. • http://www.mozilla.org/security/announce/2015/mfsa2015-41.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securitytracker.com/id/1031996 https://bugzilla.mozilla.org/show_bug.cgi?id=1110212 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2015-0810
https://notcve.org/view.php?id=CVE-2015-0810
Mozilla Firefox before 37.0 on OS X does not ensure that the cursor is visible, which allows remote attackers to conduct clickjacking attacks via a Flash object in conjunction with DIV elements associated with layered presentation, and crafted JavaScript code that interacts with an IMG element. Mozilla Firefox anterior a 37.0 en OS X no asegura que el cursor esté visible, lo que permite a atacantes remotos realizar ataques de clickjacking a través de un objeto Flash en conjunto con elementos DIV asociados a la presentación estatificada y código JavaScript manipulado que interactúa con un elemento IMG. • http://www.mozilla.org/security/announce/2015/mfsa2015-35.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securitytracker.com/id/1031996 https://bugzilla.mozilla.org/show_bug.cgi?id=1125013 https://security.gentoo.org/glsa/201512-10 • CWE-20: Improper Input Validation •