CVSS: 10.0EPSS: 18%CPEs: 132EXPL: 0CVE-2011-2989
https://notcve.org/view.php?id=CVE-2011-2989
18 Aug 2011 — The browser engine in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, Thunderbird before 6, and possibly other products does not properly implement WebGL, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors. El motor del navegador en Firefox versiones 4.x hasta 5, SeaMonkey versiones 2.x anteriores a 2.3, Thunderbird anterior a versión 6, y posiblemente otros productos de Mozilla, no implemen... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.1EPSS: 0%CPEs: 271EXPL: 0CVE-2011-2983 – Mozilla: Private data leakage using RegExp.input
https://notcve.org/view.php?id=CVE-2011-2983
18 Aug 2011 — Mozilla Firefox before 3.6.20, Thunderbird 2.x and 3.x before 3.1.12, SeaMonkey 1.x and 2.x, and possibly other products does not properly handle the RegExp.input property, which allows remote attackers to bypass the Same Origin Policy and read data from a different domain via a crafted web site, possibly related to a use-after-free. Firefox anterior a versión 3.6.20, Thunderbird versiones 2.x y versiones 3.x anteriores a 3.1.12, SeaMonkey versiones 1.x y 2.x, y posiblemente otros productos de Mozilla, no m... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 156EXPL: 0CVE-2011-2986
https://notcve.org/view.php?id=CVE-2011-2986
18 Aug 2011 — Mozilla Firefox 4.x through 5, Thunderbird before 6, SeaMonkey 2.x before 2.3, and possibly other products, when the Direct2D (aka D2D) API is used on Windows, allows remote attackers to bypass the Same Origin Policy, and obtain sensitive image data from a different domain, by inserting this data into a canvas. Firefox versiones 4.x hasta 5, Thunderbird anterior a versión 6, SeaMonkey versiones 2.x anteriores a 2.3, y posiblemente otros productos de Mozilla, cuando la API Direct2D (también se conoce como D2... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 10%CPEs: 214EXPL: 0CVE-2011-2982 – Mozilla: Miscellaneous memory safety hazards
https://notcve.org/view.php?id=CVE-2011-2982
18 Aug 2011 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.20, Thunderbird 2.x and 3.x before 3.1.12, SeaMonkey 1.x and 2.x, and possibly other products allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador en Firefox anterior a versión 3.6.20, Thunderbird versiones 2.x y versiones 3.x anteriores a 3.1.12, SeaMonke... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html •
CVSS: 9.8EPSS: 1%CPEs: 159EXPL: 0CVE-2011-2981 – Mozilla: Privilege escalation using event handlers
https://notcve.org/view.php?id=CVE-2011-2981
18 Aug 2011 — The event-management implementation in Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly select the context for script to run in, which allows remote attackers to bypass the Same Origin Policy or execute arbitrary JavaScript code with chrome privileges via a crafted web site. La implementación de gestión de eventos en Firefox anterior a versión 3.6.20, SeaMonkey versiones 2.x, Thunderbird versiones 3.x anteriores a 3.1.12, y posiblemen... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html • CWE-16: Configuration •
CVSS: 10.0EPSS: 22%CPEs: 156EXPL: 0CVE-2011-2987
https://notcve.org/view.php?id=CVE-2011-2987
18 Aug 2011 — Heap-based buffer overflow in Almost Native Graphics Layer Engine (ANGLE), as used in the WebGL implementation in Mozilla Firefox 4.x through 5, Thunderbird before 6, SeaMonkey 2.x before 2.3, and possibly other products might allow remote attackers to execute arbitrary code via unspecified vectors. Desbordamiento de búfer en la región heap de la memoria en Almost Native Graphics Layer Engine (ANGLE), como es usado en la implementación de WebGL en Firefox versiones 4.x hasta 5, Thunderbird anterior a versió... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 1%CPEs: 210EXPL: 0CVE-2011-2984 – Mozilla: Privilege escalation dropping a tab element in content area
https://notcve.org/view.php?id=CVE-2011-2984
18 Aug 2011 — Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly handle the dropping of a tab element, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by establishing a content area and registering for drop events. Firefox anterior a versión 3.6.20, SeaMonkey versiones 2.x, Thunderbird versiones 3.x anteriores a 3.1.12, y posiblemente otros productos de Mozilla, no manejan apropiadamente la caída de un elemen... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 52%CPEs: 208EXPL: 0CVE-2011-2378 – Mozilla Firefox appendChild DOM Tree Inconsistency Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-2378
17 Aug 2011 — The appendChild function in Mozilla Firefox before 3.6.20, Thunderbird 3.x before 3.1.12, SeaMonkey 2.x, and possibly other products does not properly handle DOM objects, which allows remote attackers to execute arbitrary code via unspecified vectors that lead to dereferencing of a "dangling pointer." La función appendChild en Firefox anterior a versión 3.6.20, Thunderbird versiones 3.x anteriores a 3.1.12, SeaMonkey versiones 2.x, y posiblemente otros productos de Mozilla, no maneja apropiadamente objetos ... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 68%CPEs: 174EXPL: 0CVE-2011-0084 – Mozilla Firefox SVGTextElement.getCharNumAtPosition Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-0084
17 Aug 2011 — The SVGTextElement.getCharNumAtPosition function in Mozilla Firefox before 3.6.20, and 4.x through 5; Thunderbird 3.x before 3.1.12 and other versions before 6; SeaMonkey 2.x before 2.3; and possibly other products does not properly handle SVG text, which allows remote attackers to execute arbitrary code via unspecified vectors that lead to a "dangling pointer." La función SVGTextElement.getCharNumAtPosition en Firefox anterior a versión 3.6.20, y versiones 4.x hasta 5; Thunderbird versiones 3.x anteriores ... • http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 11%CPEs: 265EXPL: 0CVE-2011-2373 – Mozilla Use-after-free vulnerability when viewing XUL document with script disabled (MFSA 2011-20)
https://notcve.org/view.php?id=CVE-2011-2373
30 Jun 2011 — Use-after-free vulnerability in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14, when JavaScript is disabled, allows remote attackers to execute arbitrary code via a crafted XUL document. Vulnerabilidad use-after-free en Mozilla Firefox antes de v3.6.18 y v4.x hasta v4.0.1, Thunderbird antes de v3.1.11, y SeaMonkey hasta v2.0.14, cuando JavaScript está deshabilitado, permite a atacantes remotos ejecutar código de su elección a través de un documen... • http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html • CWE-399: Resource Management Errors CWE-416: Use After Free •