CVSS: 6.1EPSS: 1%CPEs: 28EXPL: 1CVE-2012-4207 – Mozilla: Improper character decoding in HZ-GB-2312 charset (MFSA 2012-101)
https://notcve.org/view.php?id=CVE-2012-4207
21 Nov 2012 — The HZ-GB-2312 character-set implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 does not properly handle a ~ (tilde) character in proximity to a chunk delimiter, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document. La implementación del juego de caracteres HZ-GB-2312 en Mozilla Firefox anterior a v17.0, Firefox ESR v10.x anterior a v10.0.11, Thun... • http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 1%CPEs: 26EXPL: 0CVE-2012-4209 – Mozilla: Frames can shadow top.location (MFSA 2012-103)
https://notcve.org/view.php?id=CVE-2012-4209
21 Nov 2012 — Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 do not prevent use of a "top" frame name-attribute value to access the location property, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a binary plugin. Mozilla Firefox anterior a v17.0, Firefox ESR v10.x anterior a v10.0.11, Thunderbird anterior a v17.0, Thunderbird ESR v10.x anterior a v10.0.11... • http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 2%CPEs: 182EXPL: 0CVE-2012-4210 – Mozilla: CSS and HTML injection through Style Inspector (MFSA 2012-104)
https://notcve.org/view.php?id=CVE-2012-4210
21 Nov 2012 — The Style Inspector in Mozilla Firefox before 17.0 and Firefox ESR 10.x before 10.0.11 does not properly restrict the context of HTML markup and Cascading Style Sheets (CSS) token sequences, which allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted stylesheet. El Style Inspector en Mozilla Firefox anterior a v17.0 y Firefox ESR v10.x anterior a v10.0.11 no restringe correctamente el token de secuencias de marcado y CSS (Cascading Style Sheets), per... • http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 2%CPEs: 19EXPL: 1CVE-2012-4213
https://notcve.org/view.php?id=CVE-2012-4213
21 Nov 2012 — Use-after-free vulnerability in the nsEditor::FindNextLeafNode function in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. Uso después de liberación en la función nsEditor::FindNextLeafNode en Mozilla Firefox antes de 17.0, Thunderbird antes de 17.0, y SeaMonkey antes de 2.14 permite a atacantes remotos ejecutar código arbitrario o causar una denega... • http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html • CWE-416: Use After Free •
CVSS: 9.8EPSS: 3%CPEs: 26EXPL: 1CVE-2012-4214 – Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2012-105)
https://notcve.org/view.php?id=CVE-2012-4214
21 Nov 2012 — Use-after-free vulnerability in the nsTextEditorState::PrepareEditor function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-5840. Uso después de liberación en la función sTextEditorState::PrepareEditor en Mozilla Firefox antes de 17.0, ... • http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-416: Use After Free •
CVSS: 9.8EPSS: 3%CPEs: 26EXPL: 1CVE-2012-4215 – Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2012-105)
https://notcve.org/view.php?id=CVE-2012-4215
21 Nov 2012 — Use-after-free vulnerability in the nsPlaintextEditor::FireClipboardEvent function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. Uso después de liberación en la función sPlaintextEditor::FireClipboardEvent en Mozilla Firefox antes de 17.0, Firefox ESR 10.x antes de 10.0.11, T... • http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-416: Use After Free •
CVSS: 9.8EPSS: 6%CPEs: 28EXPL: 1CVE-2012-4216 – Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2012-105)
https://notcve.org/view.php?id=CVE-2012-4216
21 Nov 2012 — Use-after-free vulnerability in the gfxFont::GetFontEntry function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. Uso después de liberación en la función gfxFont::GetFontEntry en Mozilla Firefox antes de 17.0, Firefox ESR 10.x antes de 10.0.11, Thunderbird antes de 17.0, Thund... • http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-416: Use After Free •
CVSS: 6.8EPSS: 1%CPEs: 27EXPL: 1CVE-2012-4194 – Mozilla: Fixes for Location object issues (MFSA 2012-90)
https://notcve.org/view.php?id=CVE-2012-4194
29 Oct 2012 — Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 do not prevent use of the valueOf method to shadow the location object (aka window.location), which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a plugin. Mozilla Firefox anteriores a v16.0.2, Firefox ESR v10.x anteriores a v10.0.10, Thunderbird anteriores a v16.0.2, Thunderbird ESR v10.x anteri... • http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00019.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 27EXPL: 0CVE-2012-4195 – Mozilla: Fixes for Location object issues (MFSA 2012-90)
https://notcve.org/view.php?id=CVE-2012-4195
29 Oct 2012 — The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 does not properly determine the calling document and principal in its return value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site, and makes it easier for remote attackers to execute arbitrary JavaScript code by leveraging certain add-on behavior. La fu... • http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00019.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 27EXPL: 1CVE-2012-4196 – Mozilla: Fixes for Location object issues (MFSA 2012-90)
https://notcve.org/view.php?id=CVE-2012-4196
29 Oct 2012 — Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 allow remote attackers to bypass the Same Origin Policy and read the Location object via a prototype property-injection attack that defeats certain protection mechanisms for this object. Mozilla Firefox anteriores a v16.0.2, Firefox ESR v10.x anteriores a v10.0.10, Thunderbird anteriores a v16.0.2, Thunderbird ESR v10.x anteriores a v10.0.10, y SeaMonkey... • http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00019.html • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •