CVSS: 9.3EPSS: 1%CPEs: 18EXPL: 0CVE-2009-1840 – Firefox XUL scripts skip some security checks
https://notcve.org/view.php?id=CVE-2009-1840
Mozilla Firefox before 3.0.11, Thunderbird, and SeaMonkey do not check content policy before loading a script file into a XUL document, which allows remote attackers to bypass intended access restrictions via a crafted HTML document, as demonstrated by a "web bug" in an e-mail message, or web script or an advertisement in a web page. Mozilla Firefox anterior a v3.0.11, Thunderbird, y SeaMonkey no comprueban la politica de contenidos antes de cargar un fichero de secuencia de comandos que este en un documento XUL, lo que permite a atacantes remotos evitar las restricciones de acceso previstas a través de un documento HTML manipulado, como se demostró mediante un "web bug" en un mensaje de correo electrónico, o secuencias de comandos web o un anuncio en una página. • http://osvdb.org/55158 http://secunia.com/advisories/35331 http://secunia.com/advisories/35415 http://secunia.com/advisories/35431 http://secunia.com/advisories/35439 http://secunia.com/advisories/35440 http://secunia.com/advisories/35468 http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.372468 http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1 http://www.debian.org/security/2009/dsa-1820 http://www.mandriva.com/securi • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.4EPSS: 1%CPEs: 16EXPL: 1CVE-2009-1839 – Mozilla Firefox - Location Bar Spoofing
https://notcve.org/view.php?id=CVE-2009-1839
Mozilla Firefox 3 before 3.0.11 associates an incorrect principal with a file: URL loaded through the location bar, which allows user-assisted remote attackers to bypass intended access restrictions and read files via a crafted HTML document, aka a "file-URL-to-file-URL scripting" attack. Mozilla Firefox v3 anteriores a v3.0.11 asocia incorrectamente un principal con un fichero: URL cargada a través de la barra de direcciones, lo que permite a atacantes remotos con la colaboración del usuario evitar la restricciones de acceso previstas y leer ficheros a través de un documento HTML manipulado, también conocido como ataque de "secuencia de comandos fichero-URL-a-fichero-URL". • https://www.exploit-db.com/exploits/10544 http://osvdb.org/55163 http://secunia.com/advisories/35331 http://secunia.com/advisories/35415 http://secunia.com/advisories/35431 http://secunia.com/advisories/35468 http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.372468 http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1 http://www.debian.org/security/2009/dsa-1820 http://www.mozilla.org/security/announce/2009/mfsa2009-30.htm • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 3%CPEs: 15EXPL: 1CVE-2009-1837 – Firefox Race condition while accessing the private data of a NPObject JS wrapper class object
https://notcve.org/view.php?id=CVE-2009-1837
Race condition in the NPObjWrapper_NewResolve function in modules/plugin/base/src/nsJSNPRuntime.cpp in xul.dll in Mozilla Firefox 3 before 3.0.11 might allow remote attackers to execute arbitrary code via a page transition during Java applet loading, related to a use-after-free vulnerability for memory associated with a destroyed Java object. Condición de carrera en la función NPObjWrapper_NewResolve en modules/plugin/base/src/nsJSNPRuntime.cpp en xul.dll en Mozilla Firefox v3 anteriores a v3.0.11 podría permitir a atacantes remotos ejecutar código arbitrario a través de una pagina de transición durante la carga de un applet de Java, relacionado con una vulnerabilidad uso-después-de-liberación para asociar memoria con un objeto Java destrozado. • http://secunia.com/advisories/34241 http://secunia.com/advisories/35331 http://secunia.com/advisories/35415 http://secunia.com/advisories/35431 http://secunia.com/advisories/35468 http://secunia.com/secunia_research/2009-19 http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.372468 http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1 http://www.debian.org/security/2009/dsa-1820 http://www.mozilla.org/security/announce/2009/mfs • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 5.0EPSS: 9%CPEs: 1EXPL: 4CVE-2009-1827 – Mozilla Firefox - unclamped loop Denial of Service
https://notcve.org/view.php?id=CVE-2009-1827
The SVG component in Mozilla Firefox 3.0.4 allows remote attackers to cause a denial of service (application hang) via a large value in the r (aka Radius) attribute of a circle element, related to an "unclamped loop." El componente SVG en Mozilla Firefox v3.0.4 permite a atacantes remotos provocar una denegación de servicio (cuelgue de aplicación) a través de un valor largo en el r (también conocido como Radius) atributo de un elemnto "circle", relacionado con un "bucle sin fijado" • https://www.exploit-db.com/exploits/8794 http://archives.neohapsis.com/archives/bugtraq/2009-05/0270.html http://archives.neohapsis.com/archives/bugtraq/2009-05/0271.html http://archives.neohapsis.com/archives/bugtraq/2009-05/0272.html http://blog.zoller.lu/2009/04/advisory-firefox-dos-condition.html http://www.securityfocus.com/archive/1/503825/100/0/threaded https://bugzilla.mozilla.org/show_bug.cgi?id=393832 https://bugzilla.mozilla.org/show_bug.cgi?id=465615 https://ex • CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 6%CPEs: 1EXPL: 4CVE-2009-1828 – Mozilla Firefox 3.0.10 - 'KEYGEN' Remote Denial of Service
https://notcve.org/view.php?id=CVE-2009-1828
Mozilla Firefox 3.0.10 allows remote attackers to cause a denial of service (infinite loop, application hang, and memory consumption) via a KEYGEN element in conjunction with (1) a META element specifying automatic page refresh or (2) a JavaScript onLoad event handler for a BODY element. NOTE: it was later reported that earlier versions are also affected. Mozilla Firefox v3.0.10 permite a atacantes remotos provocar una denegación de servicio (bucle infinito, cuelgue de aplicación y consumo de memoria) a través de un elemento KEYGEN en conjunción con (1) un elemento META especificando página de refresco automático o (2) un gestor de evento onLoad JavaScript para un elemento BODY. • https://www.exploit-db.com/exploits/8822 http://archives.neohapsis.com/archives/fulldisclosure/2009-05/0247.html http://archives.neohapsis.com/archives/fulldisclosure/2009-05/0263.html http://blog.zoller.lu/2009/04/advisory-firefox-denial-of-service.html http://websecurity.com.ua/3194 http://www.securityfocus.com/archive/1/503876/100/0/threaded http://www.securityfocus.com/archive/1/506328/100/100/threaded http://www.securityfocus.com/bid/35132 https://bugzilla.mozilla.org/show • CWE-399: Resource Management Errors •