CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5962
https://notcve.org/view.php?id=CVE-2015-5962
Integer signedness error in the SharedBufferManagerParent::RecvAllocateGrallocBuffer function in the buffer-management implementation in the graphics layer in Mozilla Firefox OS before 2.2 might allow attackers to cause a denial of service (memory corruption) via a negative value of a size parameter. Vulnerabilidad de error de entero sin signo en la función SharedBufferManagerParent::RecvAllocateGrallocBuffer en la implementación de la gestión de buffer en la capa de gráficos en Mozilla Firefox OS en versiones anteriores a 2.2, podría permitir a atacantes provocar una denegación de servicio (corrupción de memoria) a través de un valor negativo de un parámetro de tamaño. • http://www.mozilla.org/security/announce/2015/mfsa2015-77.html http://www.securityfocus.com/bid/76253 https://bugzilla.mozilla.org/show_bug.cgi?id=1145389 • CWE-189: Numeric Errors •
CVSS: 1.9EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5960
https://notcve.org/view.php?id=CVE-2015-5960
Mozilla Firefox OS before 2.2 allows physically proximate attackers to bypass the pass-code protection mechanism and access USB Mass Storage (UMS) media volumes by using the USB interface for a mount operation. Vulnerabilidad en Mozilla Firefox OS en versiones anteriores a 2.2, permite a atacantes físicamente próximos eludir el mecanismo de protección de código de acceso y acceder a volúmenes multimedia USB Mass Storage (UMS) por medio de la interfaz USB para una operación de montaje. • http://www.mozilla.org/security/announce/2015/mfsa2015-74.html http://www.securityfocus.com/bid/76254 https://bugzilla.mozilla.org/show_bug.cgi?id=1111725 • CWE-284: Improper Access Control •
CVSS: 8.8EPSS: 89%CPEs: 49EXPL: 2CVE-2015-4495 – Mozilla Firefox Security Feature Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2015-4495
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015. Vulnerabilidad en el lector de PDF en Mozilla Firefox en versiones anteriores a 39.0.3, Firefox ESR 38.x en versiones anteriores a 38.1.1 y Firefox OS en versiones anteriores a 2.2, permite a atacantes remotos eludir la Same Origin Policy y leer archivos arbitrarios u obtener privilegios a través de vectores que implican código JavaScript manipulado y un setter nativo, tal como se explotó activamente en agosto de 2015. A flaw was discovered in Mozilla Firefox that could be used to violate the same-origin policy and inject web script into a non-privileged part of the built-in PDF file viewer (PDF.js). An attacker could create a malicious web page that, when viewed by a victim, could steal arbitrary files (including private SSH keys, the /etc/passwd file, and other potentially sensitive files) from the system running Firefox. Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges. • https://www.exploit-db.com/exploits/37772 https://github.com/vincd/CVE-2015-4495 http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html http://lists.opensuse.org/opensuse-security- •