CVSS: 4.3EPSS: 1%CPEs: 70EXPL: 0CVE-2009-3978
https://notcve.org/view.php?id=CVE-2009-3978
The nsGIFDecoder2::GifWrite function in decoders/gif/nsGIFDecoder2.cpp in libpr0n in Mozilla Firefox before 3.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an animated GIF file with a large image size, a different vulnerability than CVE-2009-3373. la función nsGIFDecoder2::GifWrite en decoders/gif/nsGIFDecoder2.cpp en libpr0n en Mozilla Firefox anterior a v3.5.5, permite a atacantes remotos provocar una denegación de servicio (deferencia puntero nulo y caída de la aplicación) a través de un archivo GIF animado con un tamaño de imagen grande. Vulnerabilidad distinta de CVE-2009-3373. • http://hg.mozilla.org/releases/mozilla-1.9.1/rev/edf189567edc http://www.h-online.com/open/news/item/Mozilla-fixes-critical-bugs-with-Firefox-3-5-5-852070.html http://www.mozilla.com/en-US/firefox/3.5.5/releasenotes https://bugzilla.mozilla.org/show_bug.cgi?id=525326 https://wiki.mozilla.org/Releases/Firefox_3.5.5/Test_Plan •
CVSS: 4.4EPSS: 0%CPEs: 42EXPL: 0CVE-2009-3274 – Firefox: Predictable /tmp pathname use
https://notcve.org/view.php?id=CVE-2009-3274
Mozilla Firefox 3.6a1, 3.5.3, 3.5.2, and earlier 3.5.x versions, and 3.0.14 and earlier 2.x and 3.x versions, on Linux uses a predictable /tmp pathname for files selected from the Downloads window, which allows local users to replace an arbitrary downloaded file by placing a file in a /tmp location before the download occurs, related to the Download Manager component. NOTE: some of these details are obtained from third party information. Mozilla Firefox v3.6a1, v3.5.2, y versiones anteriores a v2.x y v3.x en Linux usa una ruta predecible al directorio /tmp para los ficheros seleccionados en la ventana de descargas, permitiendo a usuarios locales reemplazar un fichero descargado de su elección al poner un fichero en la localización /tmp antes de que la descarga ocurra, posiblemente relacionado con el componente Archive Manager. NOTA: algunos de estos detalles se han obtenido de información de terceros. • http://jbrownsec.blogspot.com/2009/09/vamos-updates.html http://secunia.com/advisories/36649 http://securitytube.net/Zero-Day-Demos-%28Firefox-Vulnerability-Discovered%29-video.aspx http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1 http://www.mandriva.com/security/advisories?name=MDVSA-2009:294 http://www.mozilla.org/security/announce/2009/mfsa2009-53.html http://www.redhat.com/support/errata/RHSA-2010-0153.html http://www.redhat.com/support/errata/RHSA-2010-0154.html •
CVSS: 5.0EPSS: 0%CPEs: 59EXPL: 2CVE-2008-7244 – Multiple Browsers - 'window.print()' Denial of Service
https://notcve.org/view.php?id=CVE-2008-7244
Mozilla Firefox 3.0.1 and earlier allows remote attackers to cause a denial of service (browser hang) by calling the window.print function in a loop, aka a "printing DoS attack," possibly a related issue to CVE-2009-0821. Mozilla Firefox v3.0.1 y anteriores permite a atacantes remotos producir una denegación de servicio (navegador colgado) mediante una llamada en bucle a la función window.print, también conocido como "ataque DoS de impresión", posiblemente relacionado con CVE-2009-0821. • https://www.exploit-db.com/exploits/12509 http://websecurity.com.ua/2456 http://www.securityfocus.com/archive/1/506328/100/100/threaded • CWE-399: Resource Management Errors •
CVSS: 10.0EPSS: 74%CPEs: 107EXPL: 0CVE-2009-3072 – Firefox 3.5.3 3.0.14 browser engine crashes
https://notcve.org/view.php?id=CVE-2009-3072
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.14 and 3.5.x before 3.5.3, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the BinHex decoder in netwerk/streamconv/converters/nsBinHexDecoder.cpp, and unknown vectors. Múltiples vulnerabilidades no especificadas en el motor de navegación de Mozilla Firefox anterior a v3.0.14 y v3.5.x anterior a v3.5.3; permiten a atacantes remotos provocar una denegación de servicio (corrupción de memoria y caída de la aplicación) o puede que ejecutar código de su elección a través de vectores desconocidos. • http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html http://secunia.com/advisories/36669 http://secunia.com/advisories/36670 http://secunia.com/advisories/36671 http://secunia.com/advisories/36692 http://secunia.com/advisories/37098 http://secunia.com/advisories/38977 http://secunia.com/advisories/39001 http://www.debian.org/security/2009/dsa-1885 http://www.mozilla.org/security/announce/2009/mfsa2009-47.html http://www.mozilla.org/security/announce/2010&#x •
CVSS: 5.0EPSS: 0%CPEs: 107EXPL: 0CVE-2009-3078 – Firefox 3.5.3 3.0.14 Location bar spoofing via tall line-height Unicode characters
https://notcve.org/view.php?id=CVE-2009-3078
Visual truncation vulnerability in Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.3, allows remote attackers to trigger a vertical scroll and spoof URLs via unspecified Unicode characters with a tall line-height property. Vulnerabilidad de truncado visual en Mozilla Firefox anteriores a v3.0.14, y v3.5.x anteriores a v3.5.3, permite a atacantes remotos iniciar un scroll vertical y falsificar URLs a traves de caracteres Unicode con una propiedad "line-height" alta. • http://secunia.com/advisories/36670 http://secunia.com/advisories/36671 http://secunia.com/advisories/36692 http://secunia.com/advisories/37098 http://www.debian.org/security/2009/dsa-1885 http://www.mozilla.org/security/announce/2009/mfsa2009-50.html http://www.novell.com/linux/security/advisories/2009_48_firefox.html http://www.redhat.com/support/errata/RHSA-2009-1430.html http://www.securityfocus.com/bid/36343 http://www.securitytracker.com/id?1022875 https://bugzilla&# • CWE-20: Improper Input Validation •