CVSS: 5.0EPSS: 3%CPEs: 21EXPL: 0CVE-2009-3370 – Firefox form history vulnerable to stealing
https://notcve.org/view.php?id=CVE-2009-3370
Mozilla Firefox before 3.0.15, and 3.5.x before 3.5.4, allows remote attackers to read form history by forging mouse and keyboard events that leverage the auto-fill feature to populate form fields, in an attacker-readable form, with history entries. Mozilla Firefox anteriores a v3.0.15, y v3.5.x anteriores a v3.5.4, permite a atacantes remotos leer la historia de un formulario mediante la falsificación de los eventos de teclado y ratón, que la característica de auto completado rellena los campos del formulario, en un formulario de ataque con entradas del historial. • http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1 http://www.mandriva.com/security/advisories?name=MDVSA-2009:294 http://www.mozilla.org/security/announce/2009/mfsa2009-52.html http://www.vupen.com/english/advisories/2009/3334 https://bugzilla.mozilla.org/show_bug.cgi?id=511615 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10836 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6455 https://access& •
CVSS: 10.0EPSS: 32%CPEs: 56EXPL: 1CVE-2009-3373 – Mozilla Firefox 3.5.3 / SeaMonkey 1.1.17 - 'libpr0n' .GIF Parser Heap Buffer Overflow
https://notcve.org/view.php?id=CVE-2009-3373
Heap-based buffer overflow in the GIF image parser in Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, allows remote attackers to execute arbitrary code via unspecified vectors. Desbordamiento de búfer basado en memoria dinámica en el parseador de imágenes GIF en Mozilla Firefox anteriores a v3.0.15 y v3.5.x anteriores a v3.5.4, y SeaMonkey anteriores a v2.0, permite a atacantes remotos ejecutar código arbitrario a través de vectores desconocidos. • https://www.exploit-db.com/exploits/33313 http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1 http://www.mandriva.com/security/advisories?name=MDVSA-2009:294 http://www.mozilla.org/security/announce/2009/mfsa2009-56.html http://www.vupen.com/english/advisories/2009/3334 https://bugzilla.mozilla.org/show_bug.cgi?id=511689 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10684 https://oval.cisecurity.org/repository/search/definition/oval&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 4.4EPSS: 0%CPEs: 42EXPL: 0CVE-2009-3274 – Firefox: Predictable /tmp pathname use
https://notcve.org/view.php?id=CVE-2009-3274
Mozilla Firefox 3.6a1, 3.5.3, 3.5.2, and earlier 3.5.x versions, and 3.0.14 and earlier 2.x and 3.x versions, on Linux uses a predictable /tmp pathname for files selected from the Downloads window, which allows local users to replace an arbitrary downloaded file by placing a file in a /tmp location before the download occurs, related to the Download Manager component. NOTE: some of these details are obtained from third party information. Mozilla Firefox v3.6a1, v3.5.2, y versiones anteriores a v2.x y v3.x en Linux usa una ruta predecible al directorio /tmp para los ficheros seleccionados en la ventana de descargas, permitiendo a usuarios locales reemplazar un fichero descargado de su elección al poner un fichero en la localización /tmp antes de que la descarga ocurra, posiblemente relacionado con el componente Archive Manager. NOTA: algunos de estos detalles se han obtenido de información de terceros. • http://jbrownsec.blogspot.com/2009/09/vamos-updates.html http://secunia.com/advisories/36649 http://securitytube.net/Zero-Day-Demos-%28Firefox-Vulnerability-Discovered%29-video.aspx http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1 http://www.mandriva.com/security/advisories?name=MDVSA-2009:294 http://www.mozilla.org/security/announce/2009/mfsa2009-53.html http://www.redhat.com/support/errata/RHSA-2010-0153.html http://www.redhat.com/support/errata/RHSA-2010-0154.html •
CVSS: 5.0EPSS: 0%CPEs: 59EXPL: 2CVE-2008-7244 – Multiple Browsers - 'window.print()' Denial of Service
https://notcve.org/view.php?id=CVE-2008-7244
Mozilla Firefox 3.0.1 and earlier allows remote attackers to cause a denial of service (browser hang) by calling the window.print function in a loop, aka a "printing DoS attack," possibly a related issue to CVE-2009-0821. Mozilla Firefox v3.0.1 y anteriores permite a atacantes remotos producir una denegación de servicio (navegador colgado) mediante una llamada en bucle a la función window.print, también conocido como "ataque DoS de impresión", posiblemente relacionado con CVE-2009-0821. • https://www.exploit-db.com/exploits/12509 http://websecurity.com.ua/2456 http://www.securityfocus.com/archive/1/506328/100/100/threaded • CWE-399: Resource Management Errors •
CVSS: 10.0EPSS: 25%CPEs: 3EXPL: 0CVE-2009-3069
https://notcve.org/view.php?id=CVE-2009-3069
Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.3 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Vulnerabilidad sin especificar en el motor del navegador en Mozilla Firefox v3.5.x anterior a v3.5.3, permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria y caída de aplicación) o posiblemente la ejecución remota de código a través de vectores desconocidos. • http://secunia.com/advisories/36671 http://secunia.com/advisories/37098 http://www.mozilla.org/security/announce/2009/mfsa2009-47.html http://www.novell.com/linux/security/advisories/2009_48_firefox.html http://www.securityfocus.com/bid/36343 https://bugzilla.mozilla.org/show_bug.cgi?id=506838 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5989 •