CVSS: 10.0EPSS: 1%CPEs: 26EXPL: 7CVE-2014-1493 – Mozilla: Miscellaneous memory safety hazards (rv:24.4) (MFSA 2014-15)
https://notcve.org/view.php?id=CVE-2014-1493
18 Mar 2014 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor de navegación en Mozilla Firefox anterior a 28.0, Firefox ESR 24.x anterior a 24.4, Thunderbird anterior a 24.4 y SeaMonkey anterior a... • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 1%CPEs: 26EXPL: 1CVE-2014-1497 – Mozilla: Out of bounds read during WAV file decoding (MFSA 2014-17)
https://notcve.org/view.php?id=CVE-2014-1497
18 Mar 2014 — The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process heap memory, cause a denial of service (out-of-bounds read and application crash), or possibly have unspecified other impact via a crafted WAV file. La función mozilla::WaveReader::DecodeAudioData en Mozilla Firefox anterior a 28.0, Firefox ESR 24.x anterior a 24.4, Thunderbird a... • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 26EXPL: 1CVE-2014-1505 – Mozilla: SVG filters information disclosure through feDisplacementMap (MFSA 2014-28)
https://notcve.org/view.php?id=CVE-2014-1505
18 Mar 2014 — The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information, and possibly bypass the Same Origin Policy and read text from a different domain, via a timing attack involving feDisplacementMap elements, a related issue to CVE-2013-1693. La implementación del filtro SVG en Mozilla Firefox anterior a 28.0, Firefox ESR 24.x anterior a 24.4, Thunderbir... • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 43%CPEs: 26EXPL: 3CVE-2014-1511 – Mozilla Firefox Pop-Up Blocker Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2014-1511
18 Mar 2014 — Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified vectors. Mozilla Firefox anterior a 28.0, Firefox ESR 24.x anterior a 24.4, Thunderbird anterior a 24.4 y SeaMonkey anterior a 2.25 permiten a atacantes remotos evadir el bloqueo de ventanas emergentes a través de vectores no especificados. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installatio... • https://packetstorm.news/files/id/128022 • CWE-269: Improper Privilege Management •
CVSS: 8.8EPSS: 1%CPEs: 24EXPL: 1CVE-2014-1509 – Mozilla: Memory corruption in Cairo during PDF font rendering (MFSA 2014-27)
https://notcve.org/view.php?id=CVE-2014-1509
18 Mar 2014 — Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, as used in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25, allows remote attackers to execute arbitrary code via a crafted extension that renders fonts in a PDF document. Desbordamiento de buffer en la función _cairo_truetype_index_to_ucs4 en cairo, utilizado en Mozilla Firefox anterior a 28.0, Firefox ESR 24.x anterior a 24.4, Thunderbird anterior a 24.4 y SeaMonkey anterio... • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 10.0EPSS: 48%CPEs: 26EXPL: 1CVE-2014-1512 – Mozilla Firefox TypeObject Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-1512
18 Mar 2014 — Use-after-free vulnerability in the TypeObject class in the JavaScript engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary code by triggering extensive memory consumption while garbage collection is occurring, as demonstrated by improper handling of BumpChunk objects. Vulnerabilidad de uso después de liberación en la clase TypeObject en el motor JavaScript en Mozilla Firefox anterior a 28.0, Fire... • http://archives.neohapsis.com/archives/bugtraq/2014-03/0145.html • CWE-416: Use After Free •
CVSS: 6.5EPSS: 1%CPEs: 225EXPL: 0CVE-2014-1489 – Ubuntu Security Notice USN-2102-2
https://notcve.org/view.php?id=CVE-2014-1489
06 Feb 2014 — Mozilla Firefox before 27.0 does not properly restrict access to about:home buttons by script on other pages, which allows user-assisted remote attackers to cause a denial of service (session restore) via a crafted web site. Mozilla Firefox anterior a 27.0 no restringe debidamente el acceso a botones about:home por script en otras páginas, lo que permite a atacantes remotos asistidos por usuario causar una denegación de servicio (restablecimiento de sesión) a través de un sitio web manipulado. Christian Hol... • http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2014-1483 – Ubuntu Security Notice USN-2102-2
https://notcve.org/view.php?id=CVE-2014-1483
06 Feb 2014 — Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information by using an IFRAME element in conjunction with certain timing measurements involving the document.caretPositionFromPoint and document.elementFromPoint functions. Mozilla Firefox anterior a 27.0 y SeaMonkey anterior a 2.24 permiten a atacantes remotos evadir Same Origin Policy y obtener información sensible usando un elemento IFRAME en conjunción con ciertas medidas d... • http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 6.5EPSS: 0%CPEs: 223EXPL: 0CVE-2014-1484 – Firefox for Android Information Leak
https://notcve.org/view.php?id=CVE-2014-1484
06 Feb 2014 — Mozilla Firefox before 27.0 on Android 4.2 and earlier creates system-log entries containing profile paths, which allows attackers to obtain sensitive information via a crafted application. Mozilla Firefox anterior a 27.0 en Android 4.2 y anteriores crea entradas en el registro del sistema que contienen rutas de perfil, lo que permite a atacantes remotos obtener información sensible a través de una aplicación manipulada. A series of vulnerabilities have been discovered in Firefox for Android that allows a m... • http://archives.neohapsis.com/archives/bugtraq/2014-03/0153.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 1%CPEs: 27EXPL: 1CVE-2014-1482 – Mozilla: Incorrect use of discarded images by RasterImage (MFSA 2014-04)
https://notcve.org/view.php?id=CVE-2014-1482
04 Feb 2014 — RasterImage.cpp in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent access to discarded data, which allows remote attackers to execute arbitrary code or cause a denial of service (incorrect write operations) via crafted image data, as demonstrated by Goo Create. RasterImage.cpp en Mozilla Firefox anterior a 27.0, Firefox ESR 24.x anterior a 24.3, Thunderbird anterior a 24.3 y SeaMonkey anterior a 2.24 no previene el acceso a datos... • http://download.novell.com/Download?buildid=VYQsgaFpQ2k • CWE-787: Out-of-bounds Write •