CVSS: 5.8EPSS: 1%CPEs: 7EXPL: 1CVE-2010-3399
https://notcve.org/view.php?id=CVE-2010-3399
The js_InitRandom function in the JavaScript implementation in Mozilla Firefox 3.5.10 through 3.5.11, 3.6.4 through 3.6.8, and 4.0 Beta1 uses a context pointer in conjunction with its successor pointer for seeding of a random number generator, which makes it easier for remote attackers to guess the seed value via a brute-force attack, a different vulnerability than CVE-2010-3171. La función js_InitRandom en la implementación JavaScript de Mozilla Firefox v3.5.10 hasta v3.5.11, v3.6.4 hasta v3.6.8 y v4.0 Beta1 utiliza un puntero de contexto en en relación con su puntero sucesor para utilizar como semilla de de un generador de números aleatorios, lo cual les facilita a los atacantes remotos adivinar el valor de la semilla a través de un ataque de fuerza bruta, una vulneravilidad diferente de CVE-2010-3171. • http://archives.neohapsis.com/archives/bugtraq/2010-09/0117.html http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox http://secunia.com/advisories/42867 http://www.trusteer.com/sites/default/files/Cross_domain_Math_Random_leakage_in_FF_3.6.4-3.6.8.pdf http://www.vupen.com/english/advisories/2011/0061 https://bugzilla.mozilla.org/show_bug.cgi?id=475585 https://bugzilla.mozilla.org/show_bug.cgi?id=577512 https://oval.cisecurity.org/repository/search/de • CWE-310: Cryptographic Issues •
CVSS: 5.8EPSS: 2%CPEs: 7EXPL: 3CVE-2010-3171 – Mozilla Firefox 3.6.8 - 'Math.random()' Cross Domain Information Disclosure
https://notcve.org/view.php?id=CVE-2010-3171
The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.10 through 3.5.11, 3.6.4 through 3.6.8, and 4.0 Beta1 uses a random number generator that is seeded only once per document object, which makes it easier for remote attackers to track a user, or trick a user into acting upon a spoofed pop-up message, by calculating the seed value, related to a "temporary footprint" and an "in-session phishing attack." NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-5913. La función Math.random en la implementación JavaScript en Mozilla Firefox v3.5.10 hasta v3.5.11, v3.6.4 hasta v3.6.8, y v4.0 Beta1 usa un generador de números aleatorios que se siembra una sola vez por documento objeto, lo cual facilita a los atacantes remotos el seguimiento de un usuario, o engañar a un usuario a que actúe sobre un mensaje pop-up falso, mediante el cálculo del valor de la semilla, relacionado con una "temporary footprint" y una "in-session phishing attack". NOTA: esta vulnerabilidad existe debido a una solución incompleta de CVE-2008-5913. • https://www.exploit-db.com/exploits/34621 http://archives.neohapsis.com/archives/bugtraq/2010-09/0117.html http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox http://secunia.com/advisories/42867 http://www.securityfocus.com/bid/43222 http://www.trusteer.com/sites/default/files/Cross_domain_Math_Random_leakage_in_FF_3.6.4-3.6.8.pdf http://www.vupen.com/english/advisories/2011/0061 https://bugzilla.mozilla.org/show_bug.cgi?id=577512 https://oval& • CWE-310: Cryptographic Issues •
CVSS: 9.3EPSS: 7%CPEs: 229EXPL: 0CVE-2010-2770
https://notcve.org/view.php?id=CVE-2010-2770
Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 on Mac OS X allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted font in a data: URL. Mozilla Firefox anterior a v3.5.12 y v3.6.x anterior a v3.6.9, Thunderbird anterior a v3.0.7 y v3.1.x anterior a v3.1.3, y SeaMonkey anterior a v2.0.7 en Mac OS X permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria y caída de la aplicación) o posiblemente ejecutar código arbitrario a través de una fuente manipulada en un dato: URL. • http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html http://www.mozilla.org/security/announce/2010/mfsa2010-58.html http://www.vupen.com/english/advisories/2010/2323 https://bugzilla.mozilla.org/show_bug.cgi?id=583520 https://exchange.xforce.ibmcloud.com/vulnerabilities/61663 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11550 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 37%CPEs: 212EXPL: 0CVE-2010-3166 – nsTextFrameUtils:: TransformText (MFSA 2010-53)
https://notcve.org/view.php?id=CVE-2010-3166
Heap-based buffer overflow in the nsTextFrameUtils::TransformText function in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 might allow remote attackers to execute arbitrary code via a bidirectional text run. Desbordamiento de búfer basado en memoria dinámica en la función nsTextFrameUtils::TransformText en Mozilla Firefox anterior a v3.5.12 y v3.6.x anterior a v3.6.9, Thunderbird anterior a v3.0.7 y v3.1.x anterior a v3.1.3, y SeaMonkey anterior a v2.0.7 podría permitir a atacantes remotos ejecutar código arbitrario a través de un recorrido de texto bidireccional. • http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html http://secunia.com/advisories/42867 http://support.avaya.com/css/P8/documents/100112690 http://www.mandriva.com/security/advisories?name=MDVSA-2010:173 http://www.mozilla.org/security/announce/2010/mfsa2010-53.html http://www.securityfocus.com/bid/43102 http:/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 4.3EPSS: 1%CPEs: 212EXPL: 0CVE-2010-2764 – Mozilla Information leak via XMLHttpRequest statusText (MFSA 2010-63)
https://notcve.org/view.php?id=CVE-2010-2764
Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict read access to the statusText property of XMLHttpRequest objects, which allows remote attackers to discover the existence of intranet web servers via cross-origin requests. Mozilla Firefox anterior a v3.5.12 y v3.6.x anterior a v3.6.9, Thunderbird anterior a v3.0.7 y v3.1.x anterior a v3.1.3, SeaMonkey anterior a v2.0.7 no restringe correctamente el acceso de lectura a la propiedad statusText de los objetos XMLHttpRequest, permitiendo a atacantes remotos descubrir la existencia de servidores Web de Intranet a través de peticiones cruzadas de origen. • http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html http://secunia.com/advisories/42867 http://support.avaya.com/css/P8/documents/100112690 http://www.mandriva.com/security/advisories?name=MDVSA-2010:173 http://www.mozilla.org/security/announce/2010/mfsa2010-63.html http://www.securityfocus.com/bid/43104 http:/ • CWE-264: Permissions, Privileges, and Access Controls •