CVSS: 10.0EPSS: 7%CPEs: 1EXPL: 1CVE-2010-0164 – Mozilla Firefox libpr0n imgContainer Bits-Per-Pixel Change Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-0164
Use-after-free vulnerability in the imgContainer::InternalAddFrameHelper function in src/imgContainer.cpp in libpr0n in Mozilla Firefox 3.6 before 3.6.2 allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a multipart/x-mixed-replace animation in which the frames have different bits-per-pixel (bpp) values. Vulnerabilidad uso después de la liberación (use-after-free) en la función imgContainer::InternalAddFrameHelper en src/imgContainer.cpp en libpr0n en Mozilla Firefox v3.6 anterior a v3.6.2 permite a atacantes remotos producir una denegación de servicio (corrupción de la memoria de la pila y caída de la aplicación) o posiblemente ejecución arbitraria de código a través de una animación multipart/x-mixed-replace en el que los frames tienen valores diferentes de bit por pixel (bpp). This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Mozilla Firefox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the libpr0n library which is responsible for handling image caching and animation and is due to the way the application handles animations received from the server via the multipart/x-mixed-replace mimetype. During a case where the bits-per-pixel changes, the application will free a pointer and then can be made to reuse the freed pointer later. • http://www.mandriva.com/security/advisories?name=MDVSA-2010:070 http://www.mozilla.org/security/announce/2010/mfsa2010-09.html http://www.securityfocus.com/archive/1/510535/100/0/threaded http://www.securityfocus.com/bid/38918 http://www.securityfocus.com/bid/38921 http://www.vupen.com/english/advisories/2010/0692 http://www.zerodayinitiative.com/advisories/ZDI-10-047 https://bugzilla.mozilla.org/show_bug.cgi?id=547143 https://oval.cisecurity.org/repository/search/definition/oval • CWE-399: Resource Management Errors •
CVSS: 4.3EPSS: 0%CPEs: 85EXPL: 0CVE-2010-0171 – firefox/thunderbird/seamonkey: XSS using addEventListener and setTimeout on a wrapped object (MFSA 2010-12)
https://notcve.org/view.php?id=CVE-2010-0171
Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allow remote attackers to perform cross-origin keystroke capture, and possibly conduct cross-site scripting (XSS) attacks, by using the addEventListener and setTimeout functions in conjunction with a wrapped object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2007-3736. Mozilla Firefox v3.0.x anterior a v3.0.18, v3.5.x anterior a v3.5.8 y v3.6.x anterior a v3.6.2; Thunderbird anterior a v3.0.2 y SeaMonkey anterior a v2.0.3 permiten a atacantes remotos realizar capturas de pulsaciones de teclado de origen cruzado y puede que realizar ataques de secuencias de comandos en sitios cruzados (XSS), utilizando las funciones addEventListener y setTimeout junto con un objeto embebido. NOTA: La existencia de esta vulnerabilidad se debe a una incompleta solución de CVE-2007-3736. • http://www.mozilla.org/security/announce/2010/mfsa2010-12.html http://www.securityfocus.com/bid/38918 http://www.vupen.com/english/advisories/2010/0692 https://bugzilla.mozilla.org/show_bug.cgi?id=531364 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10773 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7743 https://access.redhat.com/security/cve/CVE-2010-0171 https://bugzilla.redhat.com/show_bug.cgi?id=576696 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 86%CPEs: 8EXPL: 0CVE-2010-1028 – Mozilla Firefox WOFF Font Format dirEntry Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-1028
Integer overflow in the decompression functionality in the Web Open Fonts Format (WOFF) decoder in Mozilla Firefox 3.6 before 3.6.2 and 3.7 before 3.7 alpha 3 allows remote attackers to execute arbitrary code via a crafted WOFF file that triggers a buffer overflow, as demonstrated by the vd_ff module in VulnDisco 9.0. Un desbordamiento de enteros en la funcionalidad de descompresión en el decodificador Web Open Fonts Format (WOFF) en Firefox de Mozilla versiones 3.6 anteriores a 3.6.2 y versiones 3.7 anteriores a 3.7 alpha 3, permite a atacantes remotos ejecutar código arbitrario por medio de un archivo WOFF especialmente diseñado que desencadena un desbordamiento de búfer, como es demostrado por el módulo vd_ff en VulnDisco versión 9.0. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Mozilla Firefox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the way the browser loads a WOFF-based font. Upon calculating the length of some data read from the file, the application will miscalculate a size used for an allocation, and then copy an incorrect amount of data into that buffer. • http://blog.mozilla.com/security/2010/02/22/secunia-advisory-sa38608 http://blog.mozilla.com/security/2010/03/18/update-on-secunia-advisory-sa38608 http://blog.psi2.de/en/2010/02/20/going-commercial-with-firefox-vulnerabilities http://secunia.com/advisories/38608 http://secunia.com/community/forum/thread/show/3592 http://www.h-online.com/security/news/item/Zero-day-exploit-for-Firefox-3-6-936124.html http://www.kb.cert.org/vuls/id/964549 http://www.mozilla.org/security& • CWE-189: Numeric Errors •
CVSS: 4.3EPSS: 0%CPEs: 78EXPL: 1CVE-2010-0648
https://notcve.org/view.php?id=CVE-2010-0648
Mozilla Firefox, possibly before 3.6, allows remote attackers to discover a redirect's target URL, for the session of a specific user of a web site, by placing the site's URL in the HREF attribute of a stylesheet LINK element, and then reading the document.styleSheets[0].href property value, related to an IFRAME element. Mozilla Firefox, probablemente anterior v3.6, permite a atacantes remotos descubrir una redirección de URL, para la sesión de un usuario específico de un sitio web, por sustición de la URL en el atributo HREF de un elemento LINK de una hoja de cálculo, y luego leer el valor de la propiedad document.styleSheets[0].href property, relacionado con un elemento IFRAME. • http://code.google.com/p/chromium/issues/detail?id=32309 http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041383.html http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041432.html http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041436.html http://nomoreroot.blogspot.com/2010/01/little-bug-in-safari-and-google-chrome.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12665 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 71EXPL: 1CVE-2010-0654 – firefox: cross-domain information disclosure
https://notcve.org/view.php?id=CVE-2010-0654
Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 permit cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which allows remote attackers to obtain sensitive information via a crafted document. Mozilla Firefox versiones 3.5.x anteriores a 3.5.11 y versiones 3.6.x anteriores a 3.6.7, Thunderbird versiones 3.0.x anteriores a 3.0.6 y versiones 3.1.x anteriores a 3.1.1, y SeaMonkey anterior a versión 2.0.6, permiten la carga de hojas de estilo CSS de origen cruzado incluso cuando la descarga de hojas de estilo tiene un tipo MIME incorrecto y el documento de stylesheet está malformado, lo que permite a los atacantes remotos obtener información confidencial por medio de un documento especialmente diseñado. • http://code.google.com/p/chromium/issues/detail?id=9877 http://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html http://websec.sv.cmu.edu/css/css.pdf http://www.mozilla.org/security/announce/2010/mfsa2010-46.html https://bugzilla.mozilla.org/show_bug.cgi?id=524223 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11811 https://access.redhat.com/security/cve/CVE-2010-0654 https://bugzilla.redhat.com/show_bug.cgi?id&# • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •