CVSS: 9.3EPSS: 45%CPEs: 149EXPL: 0CVE-2010-3778
https://notcve.org/view.php?id=CVE-2010-3778
Unspecified vulnerability in Mozilla Firefox 3.5.x before 3.5.16, Thunderbird before 3.0.11, and SeaMonkey before 2.0.11 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Vulnerabilidad no especificada en Mozilla Firefox 3.5.x en versiones anteriores a la 3.5.16, Thunderbird en versiones anteriores a la 3.0.11 y SeaMonkey en versiones anteriores a la 2.0.11, permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria y caída de la aplicación) o posiblemente ejecutar código de su elección mediante vectores no desconocidos. • http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052502.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052504.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00002.html http://secunia.com/advisories/42716 http://secunia.com/advisories/42818 http://www.debian.org/security/2010/dsa-2132 http://www.mandriva.com/security/advisories?name=MDVSA-2010:258 http://www.mozilla.org/security/announce/2010/mfsa2010-74.html http://www& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.1EPSS: 0%CPEs: 173EXPL: 0CVE-2010-3774 – Mozilla location bar SSL spoofing using network error page (MFSA 2010-83)
https://notcve.org/view.php?id=CVE-2010-3774
The NS_SecurityCompareURIs function in netwerk/base/public/nsNetUtil.h in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, does not properly handle (1) about:neterror and (2) about:certerror pages, which allows remote attackers to spoof the location bar via a crafted web site. La función NS_SecurityCompareURIs en netwerk/base/public/nsNetUtil.h en Mozilla Firefox en versiones anteriores a la 3.5.16 y 3.6.x en versiones anteriores a la 3.6.13 y SeaMonkey en versiones anteriores a la 2.0.11, no maneja de manera apropiada páginas (1) about:neterror y (2) about:certerror, lo que permite a atacantes remotos falsificar la barra de direcciones mediante un sitio web preparado para tal fin. • http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052022.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052032.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052502.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052504.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00002.html http://secunia.com/advisories/42716 http://secunia.com/advisories/42818 http://support.avaya.com/css/P8& • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 1%CPEs: 173EXPL: 0CVE-2010-3773 – Mozilla incomplete fix for CVE-2010-0179 (MFSA 2010-82)
https://notcve.org/view.php?id=CVE-2010-3773
Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, when the XMLHttpRequestSpy module in the Firebug add-on is used, does not properly handle interaction between the XMLHttpRequestSpy object and chrome privileged objects, which allows remote attackers to execute arbitrary JavaScript via a crafted HTTP response. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-0179. Mozilla Firefox en versiones anteriores a la 3.5.16 y 3.6.x en versiones anteriores a la 3.6.13 y SeaMonkey en versiones anteriores a la 2.0.11, cuanto se usa el módulo XMLHttpRequestSpy en el complemento Firebug, no maneja adecuadamente la interacción entre el objeto XMLHttpRequestSpy y objetos chrome privilegiados, lo que permite a atacantes remotos ejecutar código JavaScript de su elección mediante una respuesta HTTP debidamente modificada. NOTA: esta vulnerabilidad existe debido a un parche incompleto de la CVE-2010-0179. • http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052022.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052032.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052502.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052504.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00002.html http://secunia.com/advisories/42716 http://secunia.com/advisories/42818 http://support.avaya.com/css/P8& •
CVSS: 9.3EPSS: 17%CPEs: 233EXPL: 0CVE-2010-3768 – Mozilla add support for OTS font sanitizer (MFSA 2010-78)
https://notcve.org/view.php?id=CVE-2010-3768
Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11 do not properly validate downloadable fonts before use within an operating system's font implementation, which allows remote attackers to execute arbitrary code via vectors related to @font-face Cascading Style Sheets (CSS) rules. Mozilla Firefox en versiones anteriores a la 3.5.16 y 3.6.x en versiones anteriores a la 3.6.13, Thunderbird en versiones anteriores a la 3.0.11 y 3.1.x en versiones anteriores a la 3.1.7 y SeaMonkey en versiones anteriores a la 2.0.11 no validan de manera apropiada las fuentes que se pueden descargar antes de usarlas en una implementación de fuentes del sistema operativo, lo que permite a atacantes remotos ejecutar código de su elección mediante vectores relacionados con reglas @font-face Cascading Style Sheets (CSS). • http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052022.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052032.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052110.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052220.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052502.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052504.html http://lists.opensuse.org& • CWE-20: Improper Input Validation •
CVSS: 5.1EPSS: 14%CPEs: 173EXPL: 1CVE-2010-3770 – Mozilla Firefox/Thunderbird/SeaMonkey - Multiple HTML Injection Vulnerabilities
https://notcve.org/view.php?id=CVE-2010-3770
Multiple cross-site scripting (XSS) vulnerabilities in the rendering engine in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, allow remote attackers to inject arbitrary web script or HTML via (1) x-mac-arabic, (2) x-mac-farsi, or (3) x-mac-hebrew characters that may be converted to angle brackets during rendering. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en el motor de renderizado en Mozilla Firefox en versiones anteriores a la 3.5.16 y 3.6.x en versiones anteriores a la 3.6.13 y SeaMonkey en versiones anteriores a la 2.0.11, permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante caracteres (1) x-mac-arabic, (2) x-mac-farsi o (3) x-mac-hebrew. • https://www.exploit-db.com/exploits/35095 http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052022.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052032.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052502.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052504.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00002.html http://secunia.com/advisories/42716 http://secunia.com/advisori • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •