CVSS: 7.5EPSS: 95%CPEs: 3EXPL: 1CVE-2011-3658 – Mozilla Firefox nsSVGValue Out-of-Bounds Access Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-3658
The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via vectors involving removal of SVG elements. La implementación de SVG en Mozilla Firefox v8.0, Thunderbird v8.0, y SeaMonkey v2.6, no interactua correctamente con los manejadores de eventos DOMAttrModified, lo que permite a atacantes remotos provocar una denegación de servicio (acceso fuera de límites de memoria) o posiblemente tener otro impacto no especificado a través de vectores que implican la eliminación de elementos SVG. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Mozilla Firefox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of nsSVGValue observers. A certain method call can be made to loop excessively causing an out-of-bounds memory access. • https://www.exploit-db.com/exploits/18847 http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00009.html http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html http://osvdb.org/77953 http://secunia.com/advisories/47302 http://secunia.com/advisories/47334 http://secunia.com/advisories/48495 http://secunia.com/advisories/48553 http://secunia.com/advisories/48823 http://secunia.com/advi • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 5%CPEs: 100EXPL: 0CVE-2011-3665
https://notcve.org/view.php?id=CVE-2011-3665
Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an Ogg VIDEO element that is not properly handled after scaling. Mozilla Firefox v4.x hasta v8.0, Thunderbird v5.0 hasta v8.0, y SeaMonkey antes de v2.6, permiten a atacantes remotos provocar una denegación de servicio (caída de la aplicación) o posiblemente tener otro impacto no especificado a través de un elemento VIDEO Ogg que no sea manipulado apropiadamente despues del escalado. • http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00009.html http://osvdb.org/77956 http://secunia.com/advisories/47302 http://secunia.com/advisories/47334 http://www.mandriva.com/security/advisories?name=MDVSA-2011:192 http://www.mozilla.org/security/announce/2011/mfsa2011-58.html http://www.securitytracker.com/id?1026445 http://www.securitytracker.com/id?1026446 http://www.securitytracker.com/id • CWE-399: Resource Management Errors •
CVSS: 10.0EPSS: 25%CPEs: 100EXPL: 0CVE-2011-3660
https://notcve.org/view.php?id=CVE-2011-3660
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors that trigger a compartment mismatch associated with the nsDOMMessageEvent::GetData function, and unknown other vectors. Múltiples vulnerabilidades no especificadas en en motor de navegación de Mozilla Firefox antes de v8.0, Thunderbird antes de v8.0, y SeaMonkey antes de v2.6, permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria y caída de la aplicacion) o posiblemente ejecutar código de su elección a través de vectores que provocan un desajuste de comportamiento con la función nsDOMMessageEvent::GetData y otros vectores desconocidos. • http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00009.html http://osvdb.org/77952 http://secunia.com/advisories/47302 http://secunia.com/advisories/47334 http://secunia.com/advisories/49055 http://www.mandriva.com/security/advisories?name=MDVSA-2011:192 http://www.mozilla.org/security/announce/2011/mfsa2011-53.html http://www.securitytracker.com/id?1026445 http://www.securitytracker.com/id?1026446 •
CVSS: 7.5EPSS: 21%CPEs: 100EXPL: 0CVE-2011-3661
https://notcve.org/view.php?id=CVE-2011-3661
YARR, as used in Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted JavaScript. YARR, como se usa en Mozilla Firefox antes de v9.0, Thunderbird antes de v9.0, y SeaMonkey antes de v2.6 en Mac OS X, permite a atacantes remotos provocar una denegación de servicio (caída de la aplicación) o posiblemente ejecutar código de su elección a través de un JavaScript modificado. • http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00009.html http://secunia.com/advisories/47302 http://secunia.com/advisories/47334 http://secunia.com/advisories/49055 http://www.mandriva.com/security/advisories?name=MDVSA-2011:192 http://www.mozilla.org/security/announce/2011/mfsa2011-54.html http://www.securitytracker.com/id?1026445 http://www.securitytracker.com/id?1026446 http://www.securitytracker& • CWE-399: Resource Management Errors •
CVSS: 4.3EPSS: 0%CPEs: 116EXPL: 0CVE-2011-3663
https://notcve.org/view.php?id=CVE-2011-3663
Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to capture keystrokes entered on a web page, even when JavaScript is disabled, by using SVG animation accessKey events within that web page. Mozilla Firefox versiones 4.x hasta 8.0, Thunderbird versiones 5.0 hasta 8.0, y SeaMonkey anterior a versión 2.6, Permitir a los atacantes remotos capturar las pulsaciones de teclas (keystrokes) introducidas en una página web, incluso cuando JavaScript está deshabilitado, mediante el uso de eventos accessKey de animación SVG dentro de esa página web. • http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00009.html http://osvdb.org/77954 http://secunia.com/advisories/47302 http://secunia.com/advisories/47334 http://secunia.com/advisories/49055 http://www.mandriva.com/security/advisories?name=MDVSA-2011:192 http://www.mozilla.org/security/announce/2011/mfsa2011-56.html http://www.securitytracker.com/id?1026445 http://www.securitytracker.com/id?1026446 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •