CVSS: 10.0EPSS: 35%CPEs: 98EXPL: 0CVE-2009-2467 – Mozilla remote code execution during Flash player unloading
https://notcve.org/view.php?id=CVE-2009-2467
Mozilla Firefox before 3.0.12 and 3.5 before 3.5.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving a Flash object, a slow script dialog, and the unloading of the Flash plugin, which triggers attempted use of a deleted object. Mozilla Firefox before v3.0.12 y v3.5 anterior a v3.5.1, permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) o posiblemente la ejecución de código de su elección a través de vectores que involucran un objeto Flash, un dialogo de ejecución de comandos muy lento y la descarga de un complemento Flash, lo que provoca el uso de un objeto eliminado. • http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html http://rhn.redhat.com/errata/RHSA-2009-1162.html http://secunia.com/advisories/35914 http://secunia.com/advisories/35944 http://secunia.com/advisories/36005 http://secunia.com/advisories/36145 http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1 http://www.mozilla.org/security/announce/2009/mfsa2009-35.html http://www •
CVSS: 10.0EPSS: 82%CPEs: 96EXPL: 0CVE-2009-2469 – Mozilla remote code execution using watch and __defineSetter__ on SVG element
https://notcve.org/view.php?id=CVE-2009-2469
Mozilla Firefox before 3.0.12 does not properly handle an SVG element that has a property with a watch function and an __defineSetter__ function, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted document, related to a certain pointer misinterpretation. Mozilla Firefox anterior a la v3.0.12 no maneja adecuadamente un elemento SVG que posee una propiedad con una función "watch" y una función "__defineSetter__", lo que permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria y caída de aplicación) o posiblemente, la ejecución de código de su elección a través de un documento manipulado. Relacionado con la mal interpretación de ciertos punteros. • http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html http://rhn.redhat.com/errata/RHSA-2009-1162.html http://secunia.com/advisories/35914 http://secunia.com/advisories/35944 http://secunia.com/advisories/36005 http://secunia.com/advisories/36145 http://sunsolve.sun.com/search/document.do?assetkey=1-26-265068-1 http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020800.1-1 http: • CWE-399: Resource Management Errors •
CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 0CVE-2009-2472 – Mozilla multiple cross origin wrapper bypasses
https://notcve.org/view.php?id=CVE-2009-2472
Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required during object construction, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted document, related to a "cross origin wrapper bypass." Mozilla Firefox anteriores a v3.0.12 no usa siempre XPCCrossOriginWrapper cuando es requerido durante la construcción del objeto, lo que permite a atacantes remotos eludir la "Same Origin Policy" y realizar ataques de secuencias de comandos en sitios cruzados (XSS) mediante un documento manipulado, relacionado con una "cross origin wrapper bypass." • http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html http://rhn.redhat.com/errata/RHSA-2009-1162.html http://secunia.com/advisories/35914 http://secunia.com/advisories/35944 http://secunia.com/advisories/36005 http://secunia.com/advisories/36145 http://sunsolve.sun.com/search/document.do?assetkey=1-26-265068-1 http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020800.1-1 http: • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 8%CPEs: 124EXPL: 0CVE-2009-2463 – Mozilla Base64 decoding crash
https://notcve.org/view.php?id=CVE-2009-2463
Multiple integer overflows in the (1) PL_Base64Decode and (2) PL_Base64Encode functions in nsprpub/lib/libc/src/base64.c in Mozilla Firefox before 3.0.12, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors that trigger buffer overflows. Desbordamiento de enteros en una función base64 decoding en Mozilla Firefox anteriores a v.3.0.12 y Thunderbird permite a atacantes remotos causar una denegación de servicio (consumo de memoria y caída de aplicación) o posiblemente ejecutar código a su elección a través de vectores no especificados. • http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html http://rhn.redhat.com/errata/RHSA-2009-1162.html http://rhn.redhat.com/errata/RHSA-2009-1163.html http://secunia.com/advisories/35914 http://secunia.com/advisories/35943 http://secunia.com/advisories/35944 http://secunia.com/advisories/35947 http://secunia.com&# • CWE-189: Numeric Errors •
CVSS: 10.0EPSS: 8%CPEs: 95EXPL: 0CVE-2009-2468
https://notcve.org/view.php?id=CVE-2009-2468
Integer overflow in Apple CoreGraphics, as used in Safari before 4.0.3, Mozilla Firefox before 3.0.12, and Mac OS X 10.4.11 and 10.5.8, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long text run that triggers a heap-based buffer overflow during font glyph rendering, a related issue to CVE-2009-1194. Desbordamiento de enteros en Apple CoreGraphics en Apple Mac OS X, usado en Mozilla Firefox anteriores a v3.0.12, permite a atacantes remotos causar una denegación de servicio (caída de aplicación) o posiblemente ejecutar código a su elección a través de un texto largo que desencadena en un desbordamiento de búfer basado en memoria dinámica durante el renderizado de la fuente glyph, siendo un asunto relacionado con CVE-2009-1194. • http://lists.apple.com/archives/security-announce/2009/Aug/msg00002.html http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html http://secunia.com/advisories/35914 http://secunia.com/advisories/36701 http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1 http://support.apple.com/kb/HT3733 http://support.apple.com/kb/HT3865 http://www.mozilla.org/security/announce/2009/mfsa2009-36.html http://www.securityfocus.com/bid/35758 http://www.securitytra • CWE-189: Numeric Errors •