CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2011-3866
https://notcve.org/view.php?id=CVE-2011-3866
Mozilla Firefox before 7.0 and SeaMonkey before 2.4 do not properly restrict availability of motion data events, which makes it easier for remote attackers to read keystrokes by leveraging JavaScript code running in a background tab. Mozilla Firefox antes de v7.0 y SeaMonkey antes de v2.4 no restringe correctamente la disponibilidad de los datos de movimiento de eventos, lo que hace que sea más fácil para los atacantes remotos leer las pulsaciones de teclado mediante el aprovechamiento de código JavaScript que se ejecuta en una pestaña en segundo plano. • http://www.mozilla.org/security/announce/2011/mfsa2011-45.html http://www.usenix.org/events/hotsec11/tech/tech.html#Cai https://bugzilla.mozilla.org/show_bug.cgi?id=682562 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13954 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 86EXPL: 0CVE-2011-3004
https://notcve.org/view.php?id=CVE-2011-3004
The JSSubScriptLoader in Mozilla Firefox 4.x through 6 and SeaMonkey before 2.4 does not properly handle XPCNativeWrappers during calls to the loadSubScript method in an add-on, which makes it easier for remote attackers to gain privileges via a crafted web site that leverages certain unwrapping behavior. JSSubScriptLoader en Mozilla Firefox 4.x hasta la versión 6 y SeaMonkey anteriores a la 2.4 no maneja apropiadamente XPCNativeWrappers durante llamadas al método loadSubScript en un complemento, lo que facilita a atacantes remotos escalar privilegios a través de una web modificada que utiliza "unwrapping behavior". • http://www.mandriva.com/security/advisories?name=MDVSA-2011:141 http://www.mozilla.org/security/announce/2011/mfsa2011-43.html https://bugzilla.mozilla.org/show_bug.cgi?id=653926 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14121 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 0%CPEs: 207EXPL: 0CVE-2011-2372 – Mozilla: Code installation through holding down Enter (MFSA 2011-40)
https://notcve.org/view.php?id=CVE-2011-2372
Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent the starting of a download in response to the holding of the Enter key, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site. Mozilla Firefox anteriores a v3.6.23 y 4.x anteriores a v6, Thunderbird anteriores a v7.0 y SeaMonkey anteriores a v2.4, no impiden la puesta en marcha de una descarga en respuesta a la pulsación de la tecla Enter, lo que permite a atacantes remotos asistidos por el usuario evitar las restricciones de acceso previstas a través de un sitio web manipulado. • http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html http://secunia.com/advisories/46315 http://www.debian.org/security/2011/dsa-2312 http://www.debian.org/security/2011/dsa-2313 http://www.debian.org/security/2011/dsa-2317 http://www.mandriva.com/security/advisories?name=MDVSA-2011:139 http://www.mandriva.com/security/advisories?name=MDVSA-2011:140 http://www.mandriva.com/security/advisories? • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 59%CPEs: 207EXPL: 0CVE-2011-2995 – Mozilla: Miscellaneous memory safety hazards (MFSA 2011-36)
https://notcve.org/view.php?id=CVE-2011-2995
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador de Mozilla Firefox anteriores a v3.6.23 y 4.x hasta v6, Thunderbird anteriores a v7.0 y SeaMonkey anteriores a v2.4, permiten a atacantes remotos causar una denegación de servicio (corrupción de memoria y caída de la aplicación) o posiblemente ejecutar código arbitrario a través de vectores desconocidos. • http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html http://secunia.com/advisories/46315 http://www.debian.org/security/2011/dsa-2312 http://www.debian.org/security/2011/dsa-2313 http://www.debian.org/security/2011/dsa-2317 http://www.mandriva.com/security/advisories?name=MDVSA-2011:139 http://www.mandriva.com/security/advisories?name=MDVSA-2011:140 http://www.mandriva.com/security/advisories?name=MDVSA-2011:141 http://www.mandriva.com/security/advisories?name=MDVSA&# •
CVSS: 4.3EPSS: 1%CPEs: 186EXPL: 0CVE-2011-3001
https://notcve.org/view.php?id=CVE-2011-3001
Mozilla Firefox 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent manual add-on installation in response to the holding of the Enter key, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that triggers an unspecified internal error. Mozilla Firefox v4.x hasta v6, Thunderbird anterior a v7.0 y SeaMonkey anterior a v2.4 no impiden instalación manual de complementos (add-on) en respuesta a la presión de la tecla Enter, lo que permite a atacantes remotos asistidos por el usuario pasar por alto las restricciones de acceso a través de una web manipulada que provoca un error interno no especificado. • http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html http://secunia.com/advisories/46315 http://www.mandriva.com/security/advisories?name=MDVSA-2011:139 http://www.mandriva.com/security/advisories?name=MDVSA-2011:140 http://www.mandriva.com/security/advisories?name=MDVSA-2011:141 http://www.mandriva.com/security/advisories?name=MDVSA-2011:142 http://www.mozilla.org/security/announce/2011/mfsa2011-40.html h • CWE-264: Permissions, Privileges, and Access Controls •