CVSS: 9.3EPSS: 1%CPEs: 21EXPL: 1CVE-2013-0770
https://notcve.org/view.php?id=CVE-2013-0770
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 18.0, Thunderbird before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades sin especificar en el motor de búsqueda de Mozilla Firefox anterior a v18.0, Thunderbird anterior a v17.0.2, y SeaMonkey anterior a v2.15 permite ataques remotos que provocan una denegación de servicios (corrupción de memoria y caída de la aplicación) o posiblemente ejecutar código arbitrario a través de vectores sin especificar. • http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.html http://www.mozilla.org/security/announce/2013/mfsa2013-01.html http://www.palemoon.org/releasenotes-ng.shtml http://www.ubuntu.com/usn/USN-1681-1 http://www.ubuntu.com/usn/USN-1681-2 http: •
CVSS: 5.8EPSS: 0%CPEs: 332EXPL: 0CVE-2013-0751
https://notcve.org/view.php?id=CVE-2013-0751
Mozilla Firefox before 18.0 on Android and SeaMonkey before 2.15 do not restrict a touch event to a single IFRAME element, which allows remote attackers to obtain sensitive information or possibly conduct cross-site scripting (XSS) attacks via a crafted HTML document. Mozilla Firefox anterior a 18.0 en Android y SeaMonkey anterior a 2.15 no restringen los eventos de "tap" (tocar la pantalla) a un único elemento IFRAME, lo que permite a atacantes remotos obtener información sensible o posiblemente llevar a cabo ataques XSS a través de un documento HTML. • http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.html http://www.mozilla.org/security/announce/2013/mfsa2013-06.html https://bugzilla.mozilla.org/show_bug.cgi?id=790454 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16616 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 2%CPEs: 21EXPL: 0CVE-2013-0761
https://notcve.org/view.php?id=CVE-2013-0761
Use-after-free vulnerability in the mozilla::TrackUnionStream::EndTrack implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. Vulnerabilidad de uso después de liberación en la implementación mozilla::TrackUnionStream::EndTrack en Mozilla Firefox anterior a v18.0, Firefox ESR v17.x anterior a v17.0.1, Thunderbird anterior a v17.0.2, Thunderbird ESR v17.x anterior a v17.0.1, y SeaMonkey anterior a v2.15 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicios (corrupción en la memoria dinámica) a través de vectores sin especificar. • http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.html http://www.mozilla.org/security/announce/2013/mfsa2013-02.html http://www.ubuntu.com/usn/USN-1681-1 http://www.ubuntu.com/usn/USN-1681-2 http://www.ubuntu.com/usn/USN-1681-4 https:&# • CWE-416: Use After Free •
CVSS: 9.3EPSS: 5%CPEs: 19EXPL: 0CVE-2013-0756 – Mozilla Firefox obj_toSource Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-0756
Use-after-free vulnerability in the obj_toSource function in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted web page referencing JavaScript Proxy objects that are not properly handled during garbage collection. Vulnerabilidad en la gestión de recursos en la función obj_toSource en Mozilla Firefox anterior a v18.0, Firefox ESR 17.x anterior a v17.0.2, Thunderbird anterior a v17.0.2, Thunderbird ESR v17.x anterior a v17.0.2, y SeaMonkey anterior a v2.15 permite a atacantes remotos ejecutar código arbitrario a través de una página web manipulada haciendo referencia a objetos de JavaScript proxy que no están bien manejados durante la recolección de basura. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Mozilla Firefox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the obj_toSource function of jsobj.cpp. When crafting a javascript proxy object, an attacker can specially craft Handler methods to cause a use-after-free vulnerability. • http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.html http://www.mozilla.org/security/announce/2013/mfsa2013-19.html http://www.ubuntu.com/usn/USN-1681-1 http://www.ubuntu.com/usn/USN-1681-2 http://www.ubuntu.com/usn/USN-1681-4 https:&# • CWE-416: Use After Free •
CVSS: 6.8EPSS: 1%CPEs: 19EXPL: 1CVE-2013-0747
https://notcve.org/view.php?id=CVE-2013-0747
The gPluginHandler.handleEvent function in the plugin handler in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not properly enforce the Same Origin Policy, which allows remote attackers to conduct clickjacking attacks via crafted JavaScript code that listens for a mutation event. La función gPluginHandler.handleEvent en el maenjador de plugins en Mozilla Firefox anterior a 18.0, Firefox ESR 10.x anterior a 10.0.12 y 17.x anterior a 17.0.2, Thunderbird anterior a 17.0.2, Thunderbird ESR 10.x anterior a 10.0.12 y 17.x anterior a 17.0.2, y SeaMonkey anterior a 2.15, no refuerza adecuadamente el "Same Origin Policy", lo que permite a atacantes remotos llevar a cabo ataques de clickjacking a través de un código JavaScript manipulado que se mantiene a la escucha de un evento "mutation". • http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.html http://www.mozilla.org/security/announce/2013/mfsa2013-10.html http://www.ubuntu.com/usn/USN-1681-1 http://www.ubuntu.com/usn/USN-1681-2 http://www.ubuntu.com/usn/USN-1681-4 https:&# • CWE-20: Improper Input Validation •