CVSS: 6.8EPSS: 1%CPEs: 157EXPL: 0CVE-2009-3984 – Mozilla SSL spoofing with document.location and empty SSL response page
https://notcve.org/view.php?id=CVE-2009-3984
Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to spoof an SSL indicator for an http URL or a file URL by setting document.location to an https URL corresponding to a site that responds with a No Content (aka 204) status code and an empty body. Mozilla Firefox en versiones anteriores a v3.0.16 y v3.5.x antes de v3.5.6, y SeaMonkey antes de v2.0.1, permite a atacantes remotos suplantar un indicador de SSL para una URL o fichero HTTP URL estableciendo el valor de document.location a una URL https correspondiente a un sitio que responde con un código de estado "No Content" (Código 204) y un cuerpo vacío. • http://secunia.com/advisories/37699 http://secunia.com/advisories/37703 http://secunia.com/advisories/37704 http://secunia.com/advisories/37785 http://secunia.com/advisories/37813 http://secunia.com/advisories/37856 http://secunia.com/advisories/37881 http://securitytracker.com/id?1023342 http://securitytracker.com/id?1023343 http://www.debian.org/security/2009/dsa-1956 http://www.mozilla.org/security/announce/2009/mfsa2009-69.html http://www.novell.com/linux/security/advis •
CVSS: 6.8EPSS: 1%CPEs: 156EXPL: 0CVE-2009-3985 – Mozilla URL spoofing via invalid document.location
https://notcve.org/view.php?id=CVE-2009-3985
Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to associate spoofed content with an invalid URL by setting document.location to this URL, and then writing arbitrary web script or HTML to the associated blank document, a related issue to CVE-2009-2654. Mozilla Firefox en versiones anteriores a v3.0.16 y v3.5.x antes de v3.5.6, y SeaMonkey antes de v2.0.1, permite a atacantes remotos asociar contenido falsificado con una URL inválida estableciendo el valor de document.location a esta URL, y a continuación escribiendo secuencias de HTML o scripts web arbitrarios al documento en blanco asociado. Se trata de un asunto relacionado con CVE-2009-2654. • http://secunia.com/advisories/37699 http://secunia.com/advisories/37704 http://secunia.com/advisories/37785 http://secunia.com/advisories/37813 http://secunia.com/advisories/37856 http://secunia.com/advisories/37881 http://securitytracker.com/id?1023342 http://securitytracker.com/id?1023343 http://www.debian.org/security/2009/dsa-1956 http://www.mozilla.org/security/announce/2009/mfsa2009-69.html http://www.novell.com/linux/security/advisories/2009_63_firefox.html http:// •
CVSS: 4.3EPSS: 1%CPEs: 70EXPL: 0CVE-2009-3978
https://notcve.org/view.php?id=CVE-2009-3978
The nsGIFDecoder2::GifWrite function in decoders/gif/nsGIFDecoder2.cpp in libpr0n in Mozilla Firefox before 3.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an animated GIF file with a large image size, a different vulnerability than CVE-2009-3373. la función nsGIFDecoder2::GifWrite en decoders/gif/nsGIFDecoder2.cpp en libpr0n en Mozilla Firefox anterior a v3.5.5, permite a atacantes remotos provocar una denegación de servicio (deferencia puntero nulo y caída de la aplicación) a través de un archivo GIF animado con un tamaño de imagen grande. Vulnerabilidad distinta de CVE-2009-3373. • http://hg.mozilla.org/releases/mozilla-1.9.1/rev/edf189567edc http://www.h-online.com/open/news/item/Mozilla-fixes-critical-bugs-with-Firefox-3-5-5-852070.html http://www.mozilla.com/en-US/firefox/3.5.5/releasenotes https://bugzilla.mozilla.org/show_bug.cgi?id=525326 https://wiki.mozilla.org/Releases/Firefox_3.5.5/Test_Plan •
CVSS: 10.0EPSS: 42%CPEs: 17EXPL: 0CVE-2009-3380 – Firefox crashes with evidence of memory corruption
https://notcve.org/view.php?id=CVE-2009-3380
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades inespecíficas en el motor del navegador en Mozilla Firefox v3.0.x anteriores a v3.0.15 y v3.5.x anteriores a v3.5.4 permite a atacantes remotos producir una denegación de servicio (corrupción de memoria y caída de aplicación) o posiblemente la ejecución de código arbitrario a través de vectores desconocidos. • http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1 http://www.mandriva.com/security/advisories?name=MDVSA-2009:294 http://www.mozilla.org/security/announce/2009/mfsa2009-64.html http://www.redhat.com/support/errata/RHSA-2010-0153.html http://www.redhat.com/support/errata/RHSA-2010-0154.html http://www.vupen.com/english/advisories/2009/3334 http://www.vupen.com/english/advisories/2010/0650 https://bugzilla.mozilla.org/show_bug.cgi?id=454872 https://bugzilla •
CVSS: 9.3EPSS: 1%CPEs: 52EXPL: 0CVE-2009-3376 – Firefox download filename spoofing with RTL override
https://notcve.org/view.php?id=CVE-2009-3376
Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as demonstrated by displaying a non-executable extension for an executable file. Mozilla Firefox anteriores a v3.0.15 y v3.5.x anteriores a v3.5.4, y SeaMonkey anteriores a v2.0, no maneja adecuadamente una anulación de carácter Unicode "right-to-left" (también conocido como RLO o U+202E) en un nombre de fichero de descarga, lo que permite a atacantes remotos falsificar las extensiones de fichero a través de un nombre de fichero manipulado como se demuestra en una extensión no ejecutable de un fichero ejecutable. • http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html http://secunia.com/advisories/38977 http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1 http://www.mandriva.com/security/advisories?name=MDVSA-2009:294 http://www.mozilla.org/security/announce/2009/mfsa2009-62.html http://www.redhat.com/support/errata/RHSA-2010-0153.html http://www.redhat.com/support/errata/RHSA-2010-0154.html http://www.ubuntu.com/usn/USN-915-1 http://www.vupen.co • CWE-16: Configuration •