CVSS: 9.3EPSS: 5%CPEs: 186EXPL: 0CVE-2011-3005
https://notcve.org/view.php?id=CVE-2011-3005
Use-after-free vulnerability in Mozilla Firefox 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OGG headers in a .ogg file. Vulnerabilidad use-after-free en Mozilla Firefox v4.x hasta v6, Thunderbird antes de v7.0 y antes de SeaMonkey v2.4, permite a atacantes remotos causar una denegación de servicio (caída de aplicación) o posiblemente ejecutar código de su elección a través de encabezados OGG modificados en un archivo .ogg. • http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html http://secunia.com/advisories/46315 http://secunia.com/advisories/49055 http://www.mandriva.com/security/advisories?name=MDVSA-2011:141 http://www.mandriva.com/security/advisories?name=MDVSA-2011:142 http://www.mozilla.org/security/announce/2011/mfsa2011-44.html https://bugzilla.mozilla.org/show_bug.cgi?id=675747 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14352 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2011-3866
https://notcve.org/view.php?id=CVE-2011-3866
Mozilla Firefox before 7.0 and SeaMonkey before 2.4 do not properly restrict availability of motion data events, which makes it easier for remote attackers to read keystrokes by leveraging JavaScript code running in a background tab. Mozilla Firefox antes de v7.0 y SeaMonkey antes de v2.4 no restringe correctamente la disponibilidad de los datos de movimiento de eventos, lo que hace que sea más fácil para los atacantes remotos leer las pulsaciones de teclado mediante el aprovechamiento de código JavaScript que se ejecuta en una pestaña en segundo plano. • http://www.mozilla.org/security/announce/2011/mfsa2011-45.html http://www.usenix.org/events/hotsec11/tech/tech.html#Cai https://bugzilla.mozilla.org/show_bug.cgi?id=682562 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13954 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 86EXPL: 0CVE-2011-3004
https://notcve.org/view.php?id=CVE-2011-3004
The JSSubScriptLoader in Mozilla Firefox 4.x through 6 and SeaMonkey before 2.4 does not properly handle XPCNativeWrappers during calls to the loadSubScript method in an add-on, which makes it easier for remote attackers to gain privileges via a crafted web site that leverages certain unwrapping behavior. JSSubScriptLoader en Mozilla Firefox 4.x hasta la versión 6 y SeaMonkey anteriores a la 2.4 no maneja apropiadamente XPCNativeWrappers durante llamadas al método loadSubScript en un complemento, lo que facilita a atacantes remotos escalar privilegios a través de una web modificada que utiliza "unwrapping behavior". • http://www.mandriva.com/security/advisories?name=MDVSA-2011:141 http://www.mozilla.org/security/announce/2011/mfsa2011-43.html https://bugzilla.mozilla.org/show_bug.cgi?id=653926 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14121 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 0%CPEs: 207EXPL: 0CVE-2011-2372 – Mozilla: Code installation through holding down Enter (MFSA 2011-40)
https://notcve.org/view.php?id=CVE-2011-2372
Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent the starting of a download in response to the holding of the Enter key, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site. Mozilla Firefox anteriores a v3.6.23 y 4.x anteriores a v6, Thunderbird anteriores a v7.0 y SeaMonkey anteriores a v2.4, no impiden la puesta en marcha de una descarga en respuesta a la pulsación de la tecla Enter, lo que permite a atacantes remotos asistidos por el usuario evitar las restricciones de acceso previstas a través de un sitio web manipulado. • http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html http://secunia.com/advisories/46315 http://www.debian.org/security/2011/dsa-2312 http://www.debian.org/security/2011/dsa-2313 http://www.debian.org/security/2011/dsa-2317 http://www.mandriva.com/security/advisories?name=MDVSA-2011:139 http://www.mandriva.com/security/advisories?name=MDVSA-2011:140 http://www.mandriva.com/security/advisories? • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 59%CPEs: 207EXPL: 0CVE-2011-2995 – Mozilla: Miscellaneous memory safety hazards (MFSA 2011-36)
https://notcve.org/view.php?id=CVE-2011-2995
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador de Mozilla Firefox anteriores a v3.6.23 y 4.x hasta v6, Thunderbird anteriores a v7.0 y SeaMonkey anteriores a v2.4, permiten a atacantes remotos causar una denegación de servicio (corrupción de memoria y caída de la aplicación) o posiblemente ejecutar código arbitrario a través de vectores desconocidos. • http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html http://secunia.com/advisories/46315 http://www.debian.org/security/2011/dsa-2312 http://www.debian.org/security/2011/dsa-2313 http://www.debian.org/security/2011/dsa-2317 http://www.mandriva.com/security/advisories?name=MDVSA-2011:139 http://www.mandriva.com/security/advisories?name=MDVSA-2011:140 http://www.mandriva.com/security/advisories?name=MDVSA-2011:141 http://www.mandriva.com/security/advisories?name=MDVSA&# •