CVSS: 5.0EPSS: 1%CPEs: 237EXPL: 0CVE-2015-0830
https://notcve.org/view.php?id=CVE-2015-0830
The WebGL implementation in Mozilla Firefox before 36.0 does not properly allocate memory for copying an unspecified string to a shader's compilation log, which allows remote attackers to cause a denial of service (application crash) via crafted WebGL content. La implementación WebGL en Mozilla Firefox anterior a 36.0 no reserva correctamente memoria para copiar una cadena no especificada en el registro de la compilación de un sombreado, lo que permite a atacantes remotos causar una denegación de servicio (caída de la aplicación) a través de contenidos WebGL manipulados. • http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00000.html http://lists.opensuse.org/opensuse-updates/2015-03/msg00067.html http://www.mozilla.org/security/announce/2015/mfsa2015-14.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securityfocus.com/bid/72745 http://www.securitytracker.com/id/1031791 http://www.ubuntu.com/usn/USN-2505-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1110488 https://security.gentoo.org/glsa/2 • CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 1%CPEs: 237EXPL: 0CVE-2015-0824
https://notcve.org/view.php?id=CVE-2015-0824
The mozilla::layers::BufferTextureClient::AllocateForSurface function in Mozilla Firefox before 36.0 allows remote attackers to cause a denial of service (out-of-bounds write of zero values, and application crash) via vectors that trigger use of DrawTarget and the Cairo library for image drawing. La función mozilla::layers::BufferTextureClient::AllocateForSurface en Mozilla Firefox anterior a 36.0 permite a atacantes remotos causar una denegación de servicio (escritura fuera de rango de valores cero y caída de la aplicación) a través de vectores que provocan el uso de DrawTarget y la libraría Cairo para dibujar imágenes. • http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00000.html http://lists.opensuse.org/opensuse-updates/2015-03/msg00067.html http://www.mozilla.org/security/announce/2015/mfsa2015-22.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securityfocus.com/bid/72753 http://www.securitytracker.com/id/1031791 http://www.ubuntu.com/usn/USN-2505-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1095925 https://security.gentoo.org/glsa/2 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 237EXPL: 0CVE-2015-0834
https://notcve.org/view.php?id=CVE-2015-0834
The WebRTC subsystem in Mozilla Firefox before 36.0 recognizes turns: and stuns: URIs but accesses the TURN or STUN server without using TLS, which makes it easier for man-in-the-middle attackers to discover credentials by spoofing a server and completing a brute-force attack within a short time window. El subsistema WebRTC en Mozilla Firefox anterior a 36.0 reconoce las URIs turns: y stuns: pero accede al servidor TURN o STUN sin utilizar TLS, lo que facilita a atacantes man-in-the-middle descubrir credenciales mediante la suplantación de un servidor y la finalización de un ataque de fuerza bruta dentro de una ventana de tiempo corta. • http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00000.html http://lists.opensuse.org/opensuse-updates/2015-03/msg00067.html http://www.mozilla.org/security/announce/2015/mfsa2015-15.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securityfocus.com/bid/72743 http://www.securitytracker.com/id/1031791 http://www.ubuntu.com/usn/USN-2505-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1098314 https://security.gentoo.org/glsa/2 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 1%CPEs: 238EXPL: 0CVE-2015-0823
https://notcve.org/view.php?id=CVE-2015-0823
Multiple use-after-free vulnerabilities in OpenType Sanitiser, as used in Mozilla Firefox before 36.0, might allow remote attackers to trigger problematic Developer Console information or possibly have unspecified other impact by leveraging incorrect macro expansion, related to the ots::ots_gasp_parse function. Múltiples vulnerabilidades de uso después de liberación en OpenType Sanitiser, utilizado en Mozilla Firefox anterior a 36.0, podrían permitir a atacantes remotos provocar información problemática de la consola de desarrollo (Developer Console) o posiblemente tener otro impacto no especificado mediante el aprovechamiento de la expansión incorrecta de macros, relacionado con la función ots::ots_gasp_parse. • http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00000.html http://lists.opensuse.org/opensuse-updates/2015-03/msg00067.html http://www.mozilla.org/security/announce/2015/mfsa2015-23.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securityfocus.com/bid/72754 http://www.securitytracker.com/id/1031791 http://www.ubuntu.com/usn/USN-2505-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1098497 https://github.com/khaledhosny/ots •
CVSS: 5.0EPSS: 0%CPEs: 8EXPL: 0CVE-2013-7423 – glibc: getaddrinfo() writes DNS queries to random file descriptors under high load
https://notcve.org/view.php?id=CVE-2013-7423
The send_dg function in resolv/res_send.c in GNU C Library (aka glibc or libc6) before 2.20 does not properly reuse file descriptors, which allows remote attackers to send DNS queries to unintended locations via a large number of requests that trigger a call to the getaddrinfo function. La función send_dg en resolv/res_send.c en GNU C Library (también conocido como glibc o libc6) en versiones anteriores a 2.20 no reutiliza adecuadamente descriptores de fichero, lo que permite a atacantes remotos mandar consultas DNS a ubicaciones no intencionadas a través de un gran número de peticiones que desencadenan una llamada a la función getaddrinfo. It was discovered that, under certain circumstances, glibc's getaddrinfo() function would send DNS queries to random file descriptors. An attacker could potentially use this flaw to send DNS queries to unintended recipients, resulting in information disclosure or data loss due to the application encountering corrupted data. Many Moxa devices suffer from command injection, cross site scripting, and outdated software vulnerabilities. • http://lists.opensuse.org/opensuse-updates/2015-02/msg00089.html http://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.html http://rhn.redhat.com/errata/RHSA-2015-0863.html http://seclists.org/fulldisclosure/2021/Sep/0 http://www.openwall.com/lists/oss-security/2015/01/28/20 http://www.securityfocus.com/bid/72844 http://www.ubuntu.com/usn/USN-2519-1 https://access.redhat.com/errata/RHSA-2016:1207 https://github.com/golang&# • CWE-17: DEPRECATED: Code CWE-201: Insertion of Sensitive Information Into Sent Data •