ALT-BU-2016-2980-1
Branch c7 update bulletin.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2016-1951
Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before 4.12 allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long string to a PR_*printf function.
- 92385
- 92385
- 1036590
- 1036590
- USN-3023-1
- USN-3023-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1174015
- https://bugzilla.mozilla.org/show_bug.cgi?id=1174015
- [dev-tech-nspr] 20160217 [ANNOUNCE] NSPR 4.12 Release
- [dev-tech-nspr] 20160217 [ANNOUNCE] NSPR 4.12 Release
- https://hg.mozilla.org/projects/nspr/rev/96381e3aaae2
- https://hg.mozilla.org/projects/nspr/rev/96381e3aaae2
Closed bugs
Add tstclnt and vfyserv
Closed vulnerabilities
BDU:2015-00241
Уязвимость браузера Google Chrome, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-00450
Уязвимость браузера Firefox, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-00466
Уязвимость программного обеспечения Firefox ESR, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-00677
Уязвимость программного обеспечения SeaMonkey, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-00709
Уязвимость программного обеспечения Thunderbird, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-09815
Уязвимость браузера Firefox, позволяющая удаленному злоумышленнику выполнить произвольный код или вызвать отказ в обслуживании
BDU:2015-09816
Уязвимость браузера Firefox ESR, позволяющая удаленному злоумышленнику выполнить произвольный код или вызвать отказ в обслуживании
BDU:2015-09817
Уязвимость программного обеспечения SeaMonkey, позволяющая удаленному злоумышленнику выполнить произвольный код или вызвать отказ в обслуживании
BDU:2015-09884
Уязвимости браузера Firefox, позволяющие удалённому злоумышленнику вызвать отказ в обслуживании
BDU:2015-09885
Уязвимости браузера Firefox ESR, позволяющие удалённому злоумышленнику вызвать отказ в обслуживании
BDU:2015-09886
Уязвимости почтового клиента Thunderbird, позволяющие удалённому злоумышленнику вызвать отказ в обслуживании
BDU:2015-09888
Уязвимость браузера Firefox, позволяющая удалённому злоумышленнику выполнить произвольный JavaScript-код
BDU:2015-09889
Уязвимость браузера Firefox ESR, позволяющая удалённому злоумышленнику выполнить произвольный JavaScript-код
BDU:2015-09890
Уязвимость почтового клиента Thunderbird, позволяющая удалённому злоумышленнику выполнить произвольный JavaScript-код
BDU:2015-09891
Уязвимость браузера Firefox, позволяющая удалённому злоумышленнику получить доступ к динамической памяти процесса или вызвать отказ в обслуживании
BDU:2015-09892
Уязвимость браузера Firefox, позволяющая удалённому злоумышленнику вызвать отказ в обслуживании
BDU:2015-09893
Уязвимость браузера Firefox, позволяющая удалённому злоумышленнику подделать межсайтовые запросы
BDU:2015-09894
Уязвимость браузера Firefox ESR, позволяющая удалённому злоумышленнику подделать межсайтовые запросы
BDU:2015-09895
Уязвимость почтового клиента Thunderbird, позволяющая удалённому злоумышленнику подделать межсайтовые запросы
BDU:2015-09896
Уязвимость браузера Firefox, позволяющая удалённому злоумышленнику выполнить произвольный код или вызвать отказ в обслуживании
BDU:2015-09897
Уязвимость браузера Firefox, позволяющая удалённому злоумышленнику выполнить произвольный код или вызвать отказ в обслуживании
BDU:2015-09898
Уязвимость браузера Firefox, позволяющая удалённому злоумышленнику выполнить произвольный код или вызвать отказ в обслуживании
BDU:2015-09899
Уязвимость браузера Firefox, позволяющая удалённому злоумышленнику выполнить произвольный код или вызвать отказ в обслуживании
BDU:2015-09900
Уязвимость браузера Firefox, позволяющая удалённому злоумышленнику выполнить произвольный JavaScript-код
BDU:2015-09901
Уязвимость браузера Firefox ESR, позволяющая удалённому злоумышленнику выполнить произвольный JavaScript-код
BDU:2015-09902
Уязвимость почтового клиента Thunderbird, позволяющая удалённому злоумышленнику выполнить произвольный JavaScript-код
BDU:2015-09903
Уязвимость браузера Firefox, позволяющая удалённому злоумышленнику выполнить произвольный JavaScript-код
BDU:2015-09904
Уязвимость браузера Firefox, позволяющая удалённому злоумышленнику обойти проверку сертификата
BDU:2015-10003
Уязвимость программной платформы Oracle Fusion Middleware, позволяющая удаленному нарушителю подменить RSA-подпись
BDU:2015-10028
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2015-10550
Уязвимость браузера Firefox, позволяющая нарушителю выполнить произвольный код
BDU:2015-10551
Уязвимость браузера Firefox ESR, позволяющая нарушителю выполнить произвольный код
BDU:2015-10552
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-10553
Уязвимость браузера Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-10554
Уязвимость почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-10555
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-10556
Уязвимость браузера Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-10557
Уязвимость почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-10558
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-10559
Уязвимость браузера Firefox, позволяющая нарушителю выполнить произвольный код на стороне клиента
BDU:2015-10560
Уязвимость браузера Firefox ESR, позволяющая нарушителю выполнить произвольный код на стороне клиента
BDU:2015-10561
Уязвимость почтового клиента Thunderbird, позволяющая нарушителю выполнить произвольный код на стороне клиента
BDU:2015-10562
Уязвимость браузера Firefox, позволяющая нарушителю выполнить произвольный код
BDU:2015-10563
Уязвимость браузера Firefox ESR, позволяющая нарушителю выполнить произвольный код
BDU:2015-10564
Уязвимость браузера Firefox, позволяющая нарушителю читать данные из неинициализированных областей памяти
BDU:2015-10565
Уязвимость браузера Firefox ESR, позволяющая нарушителю читать данные из неинициализированных областей памяти
BDU:2015-10566
Уязвимость почтового клиента Thunderbird, позволяющая нарушителю читать данные из неинициализированных областей памяти
BDU:2015-10567
Уязвимость браузера Firefox, позволяющая нарушителю читать данные из неинициализированных областей памяти
BDU:2015-10568
Уязвимость браузера Firefox ESR, позволяющая нарушителю читать данные из неинициализированных областей памяти
BDU:2015-10569
Уязвимость почтового клиента Thunderbird, позволяющая нарушителю читать данные из неинициализированных областей памяти
BDU:2015-10570
Уязвимость браузера Firefox, позволяющая нарушителю читать данные из неинициализированных областей памяти
BDU:2015-10571
Уязвимость браузера Firefox ESR, позволяющая нарушителю читать данные из неинициализированных областей памяти
BDU:2015-10572
Уязвимость почтового клиента Thunderbird, позволяющая нарушителю читать данные из неинициализированных областей памяти
BDU:2015-10573
Уязвимость браузера Firefox, позволяющая нарушителю получить доступ к содержимому ячеек памяти
BDU:2015-10574
Уязвимость браузера Firefox ESR, позволяющая нарушителю получить доступ к содержимому ячеек памяти
BDU:2015-10575
Уязвимость почтового клиента Thunderbird, позволяющая нарушителю получить доступ к содержимому ячеек памяти
BDU:2015-10576
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2015-10577
Уязвимость браузера Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2015-10578
Уязвимость почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2015-10810
Уязвимость браузера Firefox, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
BDU:2015-10811
Уязвимость браузера Firefox ESR, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
BDU:2015-10812
Уязвимость браузера Firefox, позволяющая нарушителю повлиять на работу программы
BDU:2015-10813
Уязвимость браузера Firefox ESR, позволяющая нарушителю повлиять на работу программы
BDU:2015-10814
Уязвимость почтового клиента Thunderbird, позволяющая нарушителю повлиять на работу программы
BDU:2015-10815
Уязвимость браузера Firefox, позволяющая нарушителю повлиять на работу программы
BDU:2015-10816
Уязвимость браузера Firefox ESR, позволяющая нарушителю повлиять на работу программы
BDU:2015-10817
Уязвимость почтового клиента Thunderbird, позволяющая нарушителю повлиять на работу программы
BDU:2015-10818
Уязвимость браузера Firefox, позволяющая нарушителю выполнить произвольный код
BDU:2015-10819
Уязвимость браузера Firefox ESR, позволяющая нарушителю выполнить произвольный код
BDU:2015-11104
Уязвимости браузеров Firefox и Firefox ESR, позволяющие нарушителю выполнить произвольный код или вызвать отказ в обслуживании
BDU:2015-11105
Уязвимости браузера Firefox, позволяющие нарушителю выполнить произвольный код или вызвать отказ в обслуживании
BDU:2015-11106
Уязвимость браузера Firefox, позволяющая нарушителю выполнить произвольный код
BDU:2015-11107
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код
BDU:2015-11108
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код
BDU:2015-11109
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
BDU:2015-11134
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
BDU:2015-11135
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код
BDU:2015-11136
Уязвимость браузеров Firefox, Firefox ESR и операционной системы Firefox OS позволяющая нарушителю вызвать отказ в обслуживании
BDU:2015-11137
Уязвимость браузеров Firefox, Firefox ESR и операционной системы Firefox OS, позволяющая нарушителю нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-11138
Уязвимость браузеров Firefox, Firefox ESR и операционной системы Firefox OS, позволяющая нарушителю вызвать отказ в обслуживании или оказать иное воздействие на систему
BDU:2015-11139
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код при помощи объекта
BDU:2015-11140
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код
BDU:2015-11141
Уязвимости браузера Firefox, позволяющие нарушителю выполнить произвольный код
BDU:2015-11241
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю обойти политику разграничения доступа
BDU:2015-11243
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или повысить свои привилегии
BDU:2015-11244
Уязвимость браузера Firefox, позволяющая нарушителю проводить атаки типа "человек посередине"
BDU:2015-11245
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2015-11246
Уязвимость браузера Firefox, позволяющая нарушителю проводить межсайтовый скриптинг
BDU:2015-11248
Уязвимость операционной системы Firefox OS, браузеров Firefox и Firefox ESR, позволяющая нарушителю обойти политику разграничения доступа, читать произвольные файлы и повысить свои привилегии
BDU:2015-11312
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю обойти процедуру подтверждения действий пользователем при установке обновления
BDU:2015-11485
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2015-11486
Уязвимость браузера Firefox, позволяющая нарушителю получить доступ к защищаемой информации
BDU:2015-11508
Уязвимости браузеров Firefox и Firefox ESR, позволяющие нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-11509
Уязвимости браузера Firefox, позволяющие нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-11510
Уязвимость браузера Firefox, позволяющая нарушителю обойти ограничения доступа к элементам окна
BDU:2015-11511
Уязвимость браузера Firefox, позволяющая нарушителю получить доступ к защищаемой информации из памяти процесса
BDU:2015-11512
Уязвимость браузера Firefox, позволяющая нарушителю получить доступ к защищаемой информации или вызвать отказ в обслуживании
BDU:2015-11514
Уязвимость браузера Firefox ESR, позволяющая нарушителю выполнить произвольный код
BDU:2015-11515
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-11516
Уязвимость браузера Firefox, позволяющая нарушителю подменить содержимое окна
BDU:2015-11517
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код
BDU:2015-11518
Уязвимость браузера Firefox, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
BDU:2015-11519
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код
BDU:2015-11521
Уязвимость браузера Firefox, позволяющая нарушителю обойти механизм защиты ECMAScript 5 (ES5) API и выполнить произвольный код
BDU:2015-11522
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2015-11523
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю обойти существующие ограничения доступа и выполнить переход по заданному URL
BDU:2015-11524
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю обойти механизм защиты CORS
BDU:2015-11525
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2015-11526
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2015-11532
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2015-11533
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2015-11534
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2015-11535
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2015-11981
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или оказать иное воздействие на систему
BDU:2015-11982
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или оказать иное воздействие
BDU:2015-11983
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-11984
Уязвимость браузера Firefox, позволяющая нарушителю получить конфиденциальную информацию
BDU:2015-11985
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-11989
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
BDU:2015-11990
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю обойти правила ограничения домена и провести межсайтовое выполнение сценариев
BDU:2015-11991
Уязвимость браузера Firefox, позволяющая нарушителю провести межсайтовое выполнение сценариев
BDU:2015-11994
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
BDU:2015-11995
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-12003
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю обойти существующие ограничения доступа
BDU:2015-12004
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю обойти существующие ограничения доступа
BDU:2015-12005
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-12007
Уязвимость браузера Firefox, позволяющая нарушителю обойти существующие ограничения доступа и провести межсайтовое выполнение сценариев
BDU:2015-12008
Уязвимость браузера Firefox, позволяющая нарушителю получить доступ к защищаемой информации
BDU:2015-12009
Уязвимости браузеров Firefox и Firefox ESR, позволяющие нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-12010
Уязвимости браузеров Firefox и Firefox ESR, позволяющие нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-12238
Уязвимость браузера Firefox, позволяющая нарушителю получить конфиденциальную информацию, повысить свои привилегии или провести XSS-атаку
BDU:2015-12239
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-12240
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2015-12241
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2015-12242
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2015-12243
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2015-12246
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю обойти существующую политику ограничения доступа
BDU:2015-12247
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код
BDU:2015-12248
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код
BDU:2015-12249
Уязвимость браузера Firefox, позволяющая нарушителю получить конфиденциальную информацию или обойти существующую политику ограничения доступа
BDU:2015-12250
Уязвимость браузера Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании, получить конфиденциальную информацию или оказать другое воздействие
BDU:2015-12251
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2015-12252
Уязвимости браузера Firefox, позволяющие нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-12253
Уязвимости браузеров Firefox и Firefox ESR, позволяющие нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-00007
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код
BDU:2016-00136
Уязвимость программных платформ Jrockit и Java Platform, позволяющая нарушителю получить доступ на чтение данных или модифицировать данные
BDU:2016-00509
Уязвимости браузеров Firefox и Firefox ESR, позволяющие нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-00510
Уязвимости браузера Firefox, позволяющие нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-00512
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2016-00528
Уязвимость браузера Firefox, позволяющая нарушителю обойти существующую политику ограничения доступа
BDU:2016-00573
Уязвимость браузеров Firefox ESR и Firefox, программного средства рендеринга Graphite 2, почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании, получить конфиденциальную информацию или выполнить произвольный код
BDU:2016-00718
Уязвимость браузеров Firefox ESR и Firefox, программного средства рендеринга Graphite 2, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2016-00719
Уязвимость браузеров Firefox ESR и Firefox, программного средства рендеринга Graphite 2, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2016-00720
Уязвимость браузеров Firefox ESR и Firefox, программного средства рендеринга Graphite 2, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2016-00721
Уязвимость браузеров Firefox ESR и Firefox, программного средства рендеринга Graphite 2, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2016-00722
Уязвимость браузеров Firefox ESR и Firefox, программного средства рендеринга Graphite 2, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2016-00723
Уязвимость браузеров Firefox ESR и Firefox, программного средства рендеринга Graphite 2, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2016-00724
Уязвимость браузеров Firefox ESR и Firefox, программного средства рендеринга Graphite 2, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2016-00725
Уязвимость браузеров Firefox ESR и Firefox, программного средства рендеринга Graphite 2, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2016-00726
Уязвимость браузеров Firefox ESR и Firefox, программного средства рендеринга Graphite 2, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2016-00727
Уязвимость браузеров Firefox ESR и Firefox, программного средства рендеринга Graphite 2, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2016-00728
Уязвимость браузеров Firefox ESR и Firefox, программного средства рендеринга Graphite 2, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2016-00729
Уязвимость браузеров Firefox ESR и Firefox, программного средства рендеринга Graphite 2, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2016-00730
Уязвимость программного средства рендеринга Graphite 2, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2016-00741
Уязвимость программного средства рендеринга Graphite 2, браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-00743
Уязвимости браузера Firefox, позволяющие нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2016-00744
Уязвимость почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-00745
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-00749
Уязвимость программного средства рендеринга Graphite 2, браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2016-00750
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-00751
Уязвимость браузера Firefox, позволяющая нарушителю получить конфиденциальную информацию или обойти существующую политику ограничения доступа
BDU:2016-00752
Уязвимость почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-00753
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю подделать адресную строку
BDU:2016-00754
Уязвимость почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-00755
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или повысить свои привилегии
BDU:2016-00756
Уязвимость браузеров Firefox ESR и Firefox, позволяющая нарушителю выполнить произвольный код
BDU:2016-00757
Уязвимость почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код
BDU:2016-00758
Уязвимость почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-00759
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-00760
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю подделать адресную строку
BDU:2016-00761
Уязвимость почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2016-00763
Уязвимость браузера Firefox, позволяющая нарушителю получить конфиденциальную информацию или обойти существующую политику ограничения доступа
BDU:2016-00764
Уязвимость почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или повысить свои привилегии
BDU:2016-00765
Уязвимости почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющие нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-00766
Уязвимости почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющие нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-00969
Уязвимость браузера Firefox, позволяющая нарушителю выполнить произвольный код
BDU:2016-00970
Уязвимость браузера Firefox, позволяющая нарушителю получить конфиденциальную информацию
BDU:2016-00971
Уязвимость браузера Firefox, позволяющая нарушителю подменить веб-сайты
BDU:2016-00972
Уязвимость браузера Firefox, позволяющая нарушителю обойти существующую политику ограничения доступа и привести к раскрытию информации
BDU:2016-01138
Уязвимости браузеров Firefox и Firefox ESR, позволяющие нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-01147
Уязвимость браузера Firefox, позволяющая нарушителю внести изменения в настройки общего доступа
BDU:2016-01148
Уязвимость браузера Firefox, позволяющая нарушителю проводить UXSS-атаки
BDU:2016-01149
Уязвимость браузера Firefox, позволяющая нарушителю обойти защитный механизм CSP
BDU:2016-01150
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код
BDU:2016-01152
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-01153
Уязвимость браузера Firefox, позволяющая нарушителю выполнить произвольный код
BDU:2016-01156
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-01157
Уязвимости браузеров Firefox и Firefox ESR, позволяющие нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-01158
Уязвимости браузеров Firefox и Firefox ESR, позволяющие нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2018-00029
Уязвимость функции BufferSubData() почтового клиента Thunderbird и браузеров Firefox позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
BDU:2021-03335
Уязвимость браузера Mozilla Firefox, вызванная переполнением буфера, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2011-3079
The Inter-process Communication (IPC) implementation in Google Chrome before 18.0.1025.168, as used in Mozilla Firefox before 38.0 and other products, does not properly validate messages, which has unspecified impact and attack vectors.
- http://code.google.com/p/chromium/issues/detail?id=117627
- http://googlechromereleases.blogspot.com/2012/04/stable-channel-update_30.html
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0934
- 81645
- RHSA-2015:1012
- 48992
- DSA-3260
- http://www.mozilla.org/security/announce/2015/mfsa2015-57.html
- 53309
- 1027001
- https://bugzilla.mozilla.org/show_bug.cgi?id=1087565
- chrome-ipc-validation-code-execution(75271)
- oval:org.mitre.oval:def:14964
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
- http://code.google.com/p/chromium/issues/detail?id=117627
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
- oval:org.mitre.oval:def:14964
- chrome-ipc-validation-code-execution(75271)
- https://bugzilla.mozilla.org/show_bug.cgi?id=1087565
- 1027001
- 53309
- http://www.mozilla.org/security/announce/2015/mfsa2015-57.html
- DSA-3260
- 48992
- RHSA-2015:1012
- 81645
- openSUSE-SU-2015:0934
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0892
- http://googlechromereleases.blogspot.com/2012/04/stable-channel-update_30.html
Modified: 2024-11-21
CVE-2014-1568
Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a "signature malleability" issue.
- http://googlechromereleases.blogspot.com/2014/09/stable-channel-update_24.html
- http://googlechromereleases.blogspot.com/2014/09/stable-channel-update_24.html
- http://googlechromereleases.blogspot.com/2014/09/stable-channel-update-for-chrome-os_24.html
- http://googlechromereleases.blogspot.com/2014/09/stable-channel-update-for-chrome-os_24.html
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
- SUSE-SU-2014:1220
- SUSE-SU-2014:1220
- openSUSE-SU-2014:1224
- openSUSE-SU-2014:1224
- openSUSE-SU-2014:1232
- openSUSE-SU-2014:1232
- RHSA-2014:1307
- RHSA-2014:1307
- RHSA-2014:1354
- RHSA-2014:1354
- RHSA-2014:1371
- RHSA-2014:1371
- 61540
- 61540
- 61574
- 61574
- 61575
- 61575
- 61576
- 61576
- 61583
- 61583
- DSA-3033
- DSA-3033
- DSA-3034
- DSA-3034
- DSA-3037
- DSA-3037
- VU#772676
- VU#772676
- http://www.mozilla.org/security/announce/2014/mfsa2014-73.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-73.html
- http://www.novell.com/support/kb/doc.php?id=7015701
- http://www.novell.com/support/kb/doc.php?id=7015701
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
- http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- 70116
- 70116
- USN-2360-1
- USN-2360-1
- USN-2360-2
- USN-2360-2
- USN-2361-1
- USN-2361-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1064636
- https://bugzilla.mozilla.org/show_bug.cgi?id=1064636
- https://bugzilla.mozilla.org/show_bug.cgi?id=1069405
- https://bugzilla.mozilla.org/show_bug.cgi?id=1069405
- mozilla-nss-cve20141568-sec-bypass(96194)
- mozilla-nss-cve20141568-sec-bypass(96194)
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1574
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- FEDORA-2014-14084
- FEDORA-2014-14084
- FEDORA-2014-13042
- FEDORA-2014-13042
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2014:1343
- openSUSE-SU-2014:1343
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1345
- openSUSE-SU-2014:1345
- openSUSE-SU-2014:1346
- openSUSE-SU-2014:1346
- RHSA-2014:1635
- RHSA-2014:1635
- RHSA-2014:1647
- RHSA-2014:1647
- 61387
- 61387
- 61854
- 61854
- 62021
- 62021
- 62022
- 62022
- 62023
- 62023
- DSA-3050
- DSA-3050
- DSA-3061
- DSA-3061
- http://www.mozilla.org/security/announce/2014/mfsa2014-74.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-74.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 70436
- 70436
- 1031028
- 1031028
- 1031030
- 1031030
- USN-2372-1
- USN-2372-1
- USN-2373-1
- USN-2373-1
- https://advisories.mageia.org/MGASA-2014-0421.html
- https://advisories.mageia.org/MGASA-2014-0421.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1011354
- https://bugzilla.mozilla.org/show_bug.cgi?id=1011354
- https://bugzilla.mozilla.org/show_bug.cgi?id=1061214
- https://bugzilla.mozilla.org/show_bug.cgi?id=1061214
- https://bugzilla.mozilla.org/show_bug.cgi?id=1061600
- https://bugzilla.mozilla.org/show_bug.cgi?id=1061600
- https://bugzilla.mozilla.org/show_bug.cgi?id=1064346
- https://bugzilla.mozilla.org/show_bug.cgi?id=1064346
- https://bugzilla.mozilla.org/show_bug.cgi?id=1072044
- https://bugzilla.mozilla.org/show_bug.cgi?id=1072044
- https://bugzilla.mozilla.org/show_bug.cgi?id=1072174
- https://bugzilla.mozilla.org/show_bug.cgi?id=1072174
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1575
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to improper interaction between threading and garbage collection in the GCRuntime::triggerGC function in js/src/jsgc.cpp, and unknown other vectors.
- FEDORA-2014-14084
- FEDORA-2014-14084
- FEDORA-2014-13042
- FEDORA-2014-13042
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1345
- openSUSE-SU-2014:1345
- 62022
- 62022
- 62023
- 62023
- http://www.mozilla.org/security/announce/2014/mfsa2014-74.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-74.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 70439
- 70439
- 1031028
- 1031028
- 1031030
- 1031030
- USN-2372-1
- USN-2372-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1001994
- https://bugzilla.mozilla.org/show_bug.cgi?id=1001994
- https://bugzilla.mozilla.org/show_bug.cgi?id=1018916
- https://bugzilla.mozilla.org/show_bug.cgi?id=1018916
- https://bugzilla.mozilla.org/show_bug.cgi?id=1020034
- https://bugzilla.mozilla.org/show_bug.cgi?id=1020034
- https://bugzilla.mozilla.org/show_bug.cgi?id=1023035
- https://bugzilla.mozilla.org/show_bug.cgi?id=1023035
- https://bugzilla.mozilla.org/show_bug.cgi?id=1032208
- https://bugzilla.mozilla.org/show_bug.cgi?id=1032208
- https://bugzilla.mozilla.org/show_bug.cgi?id=1033020
- https://bugzilla.mozilla.org/show_bug.cgi?id=1033020
- https://bugzilla.mozilla.org/show_bug.cgi?id=1034230
- https://bugzilla.mozilla.org/show_bug.cgi?id=1034230
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1576
Heap-based buffer overflow in the nsTransformedTextRun function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via Cascading Style Sheets (CSS) token sequences that trigger changes to capitalization style.
- FEDORA-2014-14084
- FEDORA-2014-14084
- FEDORA-2014-13042
- FEDORA-2014-13042
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2014:1343
- openSUSE-SU-2014:1343
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1345
- openSUSE-SU-2014:1345
- openSUSE-SU-2014:1346
- openSUSE-SU-2014:1346
- RHSA-2014:1635
- RHSA-2014:1635
- 61387
- 61387
- 61854
- 61854
- 62021
- 62021
- 62022
- 62022
- 62023
- 62023
- DSA-3050
- DSA-3050
- DSA-3061
- DSA-3061
- http://www.mozilla.org/security/announce/2014/mfsa2014-75.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-75.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 70430
- 70430
- 1031028
- 1031028
- 1031030
- 1031030
- USN-2372-1
- USN-2372-1
- USN-2373-1
- USN-2373-1
- https://advisories.mageia.org/MGASA-2014-0421.html
- https://advisories.mageia.org/MGASA-2014-0421.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1041512
- https://bugzilla.mozilla.org/show_bug.cgi?id=1041512
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1577
The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via an invalid custom waveform that triggers a calculation of a negative frequency value.
- FEDORA-2014-14084
- FEDORA-2014-14084
- FEDORA-2014-13042
- FEDORA-2014-13042
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2014:1343
- openSUSE-SU-2014:1343
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1345
- openSUSE-SU-2014:1345
- openSUSE-SU-2014:1346
- openSUSE-SU-2014:1346
- RHSA-2014:1635
- RHSA-2014:1635
- RHSA-2014:1647
- RHSA-2014:1647
- 61387
- 61387
- 61854
- 61854
- 62021
- 62021
- 62022
- 62022
- 62023
- 62023
- DSA-3050
- DSA-3050
- DSA-3061
- DSA-3061
- http://www.mozilla.org/security/announce/2014/mfsa2014-76.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-76.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 70440
- 70440
- 1031028
- 1031028
- 1031030
- 1031030
- USN-2372-1
- USN-2372-1
- USN-2373-1
- USN-2373-1
- https://advisories.mageia.org/MGASA-2014-0421.html
- https://advisories.mageia.org/MGASA-2014-0421.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1012609
- https://bugzilla.mozilla.org/show_bug.cgi?id=1012609
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1578
The get_tile function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly execute arbitrary code via WebM frames with invalid tile sizes that are improperly handled in buffering operations during video playback.
- FEDORA-2014-14084
- FEDORA-2014-14084
- FEDORA-2014-13042
- FEDORA-2014-13042
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2014:1343
- openSUSE-SU-2014:1343
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1345
- openSUSE-SU-2014:1345
- openSUSE-SU-2014:1346
- openSUSE-SU-2014:1346
- RHSA-2014:1635
- RHSA-2014:1635
- RHSA-2014:1647
- RHSA-2014:1647
- 61387
- 61387
- 61854
- 61854
- 62021
- 62021
- 62022
- 62022
- 62023
- 62023
- DSA-3050
- DSA-3050
- DSA-3061
- DSA-3061
- http://www.mozilla.org/security/announce/2014/mfsa2014-77.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-77.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 70428
- 70428
- 1031028
- 1031028
- 1031030
- 1031030
- USN-2372-1
- USN-2372-1
- USN-2373-1
- USN-2373-1
- https://advisories.mageia.org/MGASA-2014-0421.html
- https://advisories.mageia.org/MGASA-2014-0421.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1063327
- https://bugzilla.mozilla.org/show_bug.cgi?id=1063327
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1580
Mozilla Firefox before 33.0 does not properly initialize memory for GIF images, which allows remote attackers to obtain sensitive information from process memory via a crafted web page that triggers a sequence of rendering operations for truncated GIF data within a CANVAS element.
- FEDORA-2014-14084
- FEDORA-2014-14084
- FEDORA-2014-13042
- FEDORA-2014-13042
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1345
- openSUSE-SU-2014:1345
- 62022
- 62022
- 62023
- 62023
- http://www.mozilla.org/security/announce/2014/mfsa2014-78.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-78.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 70431
- 70431
- 1031028
- 1031028
- USN-2372-1
- USN-2372-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1063733
- https://bugzilla.mozilla.org/show_bug.cgi?id=1063733
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1581
Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout.
- FEDORA-2014-14084
- FEDORA-2014-14084
- FEDORA-2014-13042
- FEDORA-2014-13042
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2014:1343
- openSUSE-SU-2014:1343
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1345
- openSUSE-SU-2014:1345
- openSUSE-SU-2014:1346
- openSUSE-SU-2014:1346
- RHSA-2014:1635
- RHSA-2014:1635
- RHSA-2014:1647
- RHSA-2014:1647
- 61387
- 61387
- 61854
- 61854
- 62021
- 62021
- 62022
- 62022
- 62023
- 62023
- DSA-3050
- DSA-3050
- DSA-3061
- DSA-3061
- http://www.mozilla.org/security/announce/2014/mfsa2014-79.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-79.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 70426
- 70426
- 1031028
- 1031028
- 1031030
- 1031030
- USN-2372-1
- USN-2372-1
- USN-2373-1
- USN-2373-1
- https://advisories.mageia.org/MGASA-2014-0421.html
- https://advisories.mageia.org/MGASA-2014-0421.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1068218
- https://bugzilla.mozilla.org/show_bug.cgi?id=1068218
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1582
The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 does not properly consider the connection-coalescing behavior of SPDY and HTTP/2 in the case of a shared IP address, which allows man-in-the-middle attackers to bypass an intended pinning configuration and spoof a web site by providing a valid certificate from an arbitrary recognized Certification Authority.
- FEDORA-2014-14084
- FEDORA-2014-14084
- FEDORA-2014-13042
- FEDORA-2014-13042
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1345
- openSUSE-SU-2014:1345
- 62022
- 62022
- 62023
- 62023
- http://www.mozilla.org/security/announce/2014/mfsa2014-80.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-80.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 70432
- 70432
- 1031028
- 1031028
- USN-2372-1
- USN-2372-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1049095
- https://bugzilla.mozilla.org/show_bug.cgi?id=1049095
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1583
The Alarm API in Mozilla Firefox before 33.0 and Firefox ESR 31.x before 31.2 does not properly restrict toJSON calls, which allows remote attackers to bypass the Same Origin Policy via crafted API calls that access sensitive information within the JSON data of an alarm.
- FEDORA-2014-14084
- FEDORA-2014-14084
- FEDORA-2014-13042
- FEDORA-2014-13042
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1345
- openSUSE-SU-2014:1345
- RHSA-2014:1635
- RHSA-2014:1635
- 61854
- 61854
- 62022
- 62022
- 62023
- 62023
- DSA-3050
- DSA-3050
- http://www.mozilla.org/security/announce/2014/mfsa2014-82.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-82.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 70424
- 70424
- 1031028
- 1031028
- 1031030
- 1031030
- USN-2372-1
- USN-2372-1
- https://advisories.mageia.org/MGASA-2014-0421.html
- https://advisories.mageia.org/MGASA-2014-0421.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1015540
- https://bugzilla.mozilla.org/show_bug.cgi?id=1015540
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1584
The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user.
- FEDORA-2014-14084
- FEDORA-2014-14084
- FEDORA-2014-13042
- FEDORA-2014-13042
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1345
- openSUSE-SU-2014:1345
- 62022
- 62022
- 62023
- 62023
- http://www.mozilla.org/security/announce/2014/mfsa2014-80.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-80.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 70434
- 70434
- 1031028
- 1031028
- USN-2372-1
- USN-2372-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1066190
- https://bugzilla.mozilla.org/show_bug.cgi?id=1066190
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1585
The WebRTC video-sharing feature in dom/media/MediaManager.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does not properly recognize Stop Sharing actions for videos in IFRAME elements, which allows remote attackers to obtain sensitive information from the local camera by maintaining a session after the user tries to discontinue streaming.
- FEDORA-2014-14084
- FEDORA-2014-14084
- FEDORA-2014-13042
- FEDORA-2014-13042
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2014:1343
- openSUSE-SU-2014:1343
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1345
- openSUSE-SU-2014:1345
- openSUSE-SU-2014:1346
- openSUSE-SU-2014:1346
- 61387
- 61387
- 62021
- 62021
- 62022
- 62022
- 62023
- 62023
- DSA-3050
- DSA-3050
- DSA-3061
- DSA-3061
- http://www.mozilla.org/security/announce/2014/mfsa2014-81.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-81.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 70425
- 70425
- 1031028
- 1031028
- 1031030
- 1031030
- USN-2372-1
- USN-2372-1
- USN-2373-1
- USN-2373-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1062876
- https://bugzilla.mozilla.org/show_bug.cgi?id=1062876
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1586
content/base/src/nsDocument.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does not consider whether WebRTC video sharing is occurring, which allows remote attackers to obtain sensitive information from the local camera in certain IFRAME situations by maintaining a session after the user temporarily navigates away.
- FEDORA-2014-14084
- FEDORA-2014-14084
- FEDORA-2014-13042
- FEDORA-2014-13042
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2014:1343
- openSUSE-SU-2014:1343
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1344
- openSUSE-SU-2014:1345
- openSUSE-SU-2014:1345
- openSUSE-SU-2014:1346
- openSUSE-SU-2014:1346
- 61387
- 61387
- 62021
- 62021
- 62022
- 62022
- 62023
- 62023
- DSA-3050
- DSA-3050
- DSA-3061
- DSA-3061
- http://www.mozilla.org/security/announce/2014/mfsa2014-81.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-81.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 70427
- 70427
- 1031028
- 1031028
- 1031030
- 1031030
- USN-2372-1
- USN-2372-1
- USN-2373-1
- USN-2373-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1062981
- https://bugzilla.mozilla.org/show_bug.cgi?id=1062981
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1587
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- DSA-3090
- DSA-3090
- DSA-3092
- DSA-3092
- http://www.mozilla.org/security/announce/2014/mfsa2014-83.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-83.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 71391
- 71391
- https://bugzilla.mozilla.org/show_bug.cgi?id=1042567
- https://bugzilla.mozilla.org/show_bug.cgi?id=1042567
- https://bugzilla.mozilla.org/show_bug.cgi?id=1072847
- https://bugzilla.mozilla.org/show_bug.cgi?id=1072847
- https://bugzilla.mozilla.org/show_bug.cgi?id=1079729
- https://bugzilla.mozilla.org/show_bug.cgi?id=1079729
- https://bugzilla.mozilla.org/show_bug.cgi?id=1080312
- https://bugzilla.mozilla.org/show_bug.cgi?id=1080312
- https://bugzilla.mozilla.org/show_bug.cgi?id=1089207
- https://bugzilla.mozilla.org/show_bug.cgi?id=1089207
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1588
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 34.0 and SeaMonkey before 2.31 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- http://www.mozilla.org/security/announce/2014/mfsa2014-83.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-83.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1013001
- https://bugzilla.mozilla.org/show_bug.cgi?id=1013001
- https://bugzilla.mozilla.org/show_bug.cgi?id=1023158
- https://bugzilla.mozilla.org/show_bug.cgi?id=1023158
- https://bugzilla.mozilla.org/show_bug.cgi?id=1026037
- https://bugzilla.mozilla.org/show_bug.cgi?id=1026037
- https://bugzilla.mozilla.org/show_bug.cgi?id=1037830
- https://bugzilla.mozilla.org/show_bug.cgi?id=1037830
- https://bugzilla.mozilla.org/show_bug.cgi?id=1048517
- https://bugzilla.mozilla.org/show_bug.cgi?id=1048517
- https://bugzilla.mozilla.org/show_bug.cgi?id=1064835
- https://bugzilla.mozilla.org/show_bug.cgi?id=1064835
- https://bugzilla.mozilla.org/show_bug.cgi?id=1073577
- https://bugzilla.mozilla.org/show_bug.cgi?id=1073577
- https://bugzilla.mozilla.org/show_bug.cgi?id=1075546
- https://bugzilla.mozilla.org/show_bug.cgi?id=1075546
- https://bugzilla.mozilla.org/show_bug.cgi?id=1077687
- https://bugzilla.mozilla.org/show_bug.cgi?id=1077687
- https://bugzilla.mozilla.org/show_bug.cgi?id=1086842
- https://bugzilla.mozilla.org/show_bug.cgi?id=1086842
- https://bugzilla.mozilla.org/show_bug.cgi?id=1096026
- https://bugzilla.mozilla.org/show_bug.cgi?id=1096026
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1589
Mozilla Firefox before 34.0 and SeaMonkey before 2.31 provide stylesheets with an incorrect primary namespace, which allows remote attackers to bypass intended access restrictions via an XBL binding.
- http://www.mozilla.org/security/announce/2014/mfsa2014-84.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-84.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1043787
- https://bugzilla.mozilla.org/show_bug.cgi?id=1043787
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1590
The XMLHttpRequest.prototype.send method in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to cause a denial of service (application crash) via a crafted JavaScript object.
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- DSA-3090
- DSA-3090
- DSA-3092
- DSA-3092
- http://www.mozilla.org/security/announce/2014/mfsa2014-85.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-85.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 71397
- 71397
- https://bugzilla.mozilla.org/show_bug.cgi?id=1087633
- https://bugzilla.mozilla.org/show_bug.cgi?id=1087633
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1592
Use-after-free vulnerability in the nsHtml5TreeOperation function in xul.dll in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code by adding a second root element to an HTML5 document during parsing.
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- DSA-3090
- DSA-3090
- DSA-3092
- DSA-3092
- http://www.mozilla.org/security/announce/2014/mfsa2014-87.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-87.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 71398
- 71398
- https://bugzilla.mozilla.org/show_bug.cgi?id=1088635
- https://bugzilla.mozilla.org/show_bug.cgi?id=1088635
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1593
Stack-based buffer overflow in the mozilla::FileBlockCache::Read function in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code via crafted media content.
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- DSA-3090
- DSA-3090
- DSA-3092
- DSA-3092
- http://www.mozilla.org/security/announce/2014/mfsa2014-88.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-88.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 71395
- 71395
- https://bugzilla.mozilla.org/show_bug.cgi?id=1085175
- https://bugzilla.mozilla.org/show_bug.cgi?id=1085175
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1594
Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 might allow remote attackers to execute arbitrary code by leveraging an incorrect cast from the BasicThebesLayer data type to the BasicContainerLayer data type.
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- DSA-3090
- DSA-3090
- DSA-3092
- DSA-3092
- http://www.mozilla.org/security/announce/2014/mfsa2014-89.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-89.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 71396
- 71396
- https://bugzilla.mozilla.org/show_bug.cgi?id=1074280
- https://bugzilla.mozilla.org/show_bug.cgi?id=1074280
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-8631
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 34.0 and SeaMonkey before 2.31 supports native-interface passing, which allows remote attackers to bypass intended DOM object restrictions via a call to an unspecified method.
- http://www.mozilla.org/security/announce/2014/mfsa2014-91.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-91.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=821573
- https://bugzilla.mozilla.org/show_bug.cgi?id=821573
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-8632
The structured-clone implementation in Mozilla Firefox before 34.0 and SeaMonkey before 2.31 does not properly interact with XrayWrapper property filtering, which allows remote attackers to bypass intended DOM object restrictions by leveraging property availability after XrayWrapper removal.
- http://www.mozilla.org/security/announce/2014/mfsa2014-91.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-91.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1050340
- https://bugzilla.mozilla.org/show_bug.cgi?id=1050340
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-8634
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- http://linux.oracle.com/errata/ELSA-2015-0046.html
- http://linux.oracle.com/errata/ELSA-2015-0046.html
- http://linux.oracle.com/errata/ELSA-2015-0047.html
- http://linux.oracle.com/errata/ELSA-2015-0047.html
- openSUSE-SU-2015:0077
- openSUSE-SU-2015:0077
- SUSE-SU-2015:0171
- SUSE-SU-2015:0171
- SUSE-SU-2015:0173
- SUSE-SU-2015:0173
- SUSE-SU-2015:0180
- SUSE-SU-2015:0180
- openSUSE-SU-2015:0192
- openSUSE-SU-2015:0192
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0133
- openSUSE-SU-2015:0133
- RHSA-2015:0046
- RHSA-2015:0046
- RHSA-2015:0047
- RHSA-2015:0047
- 62237
- 62237
- 62242
- 62242
- 62250
- 62250
- 62253
- 62253
- 62259
- 62259
- 62273
- 62273
- 62274
- 62274
- 62283
- 62283
- 62293
- 62293
- 62304
- 62304
- 62313
- 62313
- 62315
- 62315
- 62316
- 62316
- 62418
- 62418
- 62446
- 62446
- 62657
- 62657
- 62790
- 62790
- DSA-3127
- DSA-3127
- DSA-3132
- DSA-3132
- http://www.mozilla.org/security/announce/2014/mfsa2015-01.html
- http://www.mozilla.org/security/announce/2014/mfsa2015-01.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 72049
- 72049
- 1031533
- 1031533
- 1031534
- 1031534
- USN-2460-1
- USN-2460-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1109889
- https://bugzilla.mozilla.org/show_bug.cgi?id=1109889
- https://bugzilla.mozilla.org/show_bug.cgi?id=1111737
- https://bugzilla.mozilla.org/show_bug.cgi?id=1111737
- firefox-cve20148634-code-exec(99955)
- firefox-cve20148634-code-exec(99955)
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-8635
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2015:0077
- openSUSE-SU-2015:0077
- openSUSE-SU-2015:0192
- openSUSE-SU-2015:0192
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0133
- openSUSE-SU-2015:0133
- 62242
- 62242
- 62250
- 62250
- 62253
- 62253
- 62316
- 62316
- 62418
- 62418
- 62446
- 62446
- 62657
- 62657
- 62790
- 62790
- http://www.mozilla.org/security/announce/2014/mfsa2015-01.html
- http://www.mozilla.org/security/announce/2014/mfsa2015-01.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 72050
- 72050
- 1031533
- 1031533
- 1031534
- 1031534
- https://bugzilla.mozilla.org/show_bug.cgi?id=1026774
- https://bugzilla.mozilla.org/show_bug.cgi?id=1026774
- https://bugzilla.mozilla.org/show_bug.cgi?id=1027300
- https://bugzilla.mozilla.org/show_bug.cgi?id=1027300
- https://bugzilla.mozilla.org/show_bug.cgi?id=1054538
- https://bugzilla.mozilla.org/show_bug.cgi?id=1054538
- https://bugzilla.mozilla.org/show_bug.cgi?id=1067473
- https://bugzilla.mozilla.org/show_bug.cgi?id=1067473
- https://bugzilla.mozilla.org/show_bug.cgi?id=1070962
- https://bugzilla.mozilla.org/show_bug.cgi?id=1070962
- https://bugzilla.mozilla.org/show_bug.cgi?id=1072130
- https://bugzilla.mozilla.org/show_bug.cgi?id=1072130
- https://bugzilla.mozilla.org/show_bug.cgi?id=1072871
- https://bugzilla.mozilla.org/show_bug.cgi?id=1072871
- https://bugzilla.mozilla.org/show_bug.cgi?id=1098583
- https://bugzilla.mozilla.org/show_bug.cgi?id=1098583
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-8636
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with a DOM object that has a named getter, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via unspecified vectors.
- openSUSE-SU-2015:0077
- openSUSE-SU-2015:0077
- SUSE-SU-2015:0171
- SUSE-SU-2015:0171
- SUSE-SU-2015:0173
- SUSE-SU-2015:0173
- SUSE-SU-2015:0180
- SUSE-SU-2015:0180
- openSUSE-SU-2015:0192
- openSUSE-SU-2015:0192
- http://packetstormsecurity.com/files/130972/Firefox-Proxy-Prototype-Privileged-Javascript-Injection.html
- http://packetstormsecurity.com/files/130972/Firefox-Proxy-Prototype-Privileged-Javascript-Injection.html
- 62242
- 62242
- 62250
- 62250
- 62418
- 62418
- 62446
- 62446
- 62790
- 62790
- http://www.mozilla.org/security/announce/2014/mfsa2015-09.html
- http://www.mozilla.org/security/announce/2014/mfsa2015-09.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 72041
- 72041
- 1031533
- 1031533
- https://bugzilla.mozilla.org/show_bug.cgi?id=987794
- https://bugzilla.mozilla.org/show_bug.cgi?id=987794
- https://community.rapid7.com/community/metasploit/blog/2015/03/23/r7-2015-04-disclosure-mozilla-firefox-proxy-prototype-rce-cve-2014-8636
- https://community.rapid7.com/community/metasploit/blog/2015/03/23/r7-2015-04-disclosure-mozilla-firefox-proxy-prototype-rce-cve-2014-8636
- firefox-cve20148636-sec-bypass(99964)
- firefox-cve20148636-sec-bypass(99964)
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-8637
Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not properly initialize memory for BMP images, which allows remote attackers to obtain sensitive information from process memory via a crafted web page that triggers the rendering of malformed BMP data within a CANVAS element.
- openSUSE-SU-2015:0077
- openSUSE-SU-2015:0077
- SUSE-SU-2015:0171
- SUSE-SU-2015:0171
- SUSE-SU-2015:0173
- SUSE-SU-2015:0173
- SUSE-SU-2015:0180
- SUSE-SU-2015:0180
- openSUSE-SU-2015:0192
- openSUSE-SU-2015:0192
- 62242
- 62242
- 62250
- 62250
- 62253
- 62253
- 62316
- 62316
- 62418
- 62418
- 62446
- 62446
- 62790
- 62790
- http://www.mozilla.org/security/announce/2014/mfsa2015-02.html
- http://www.mozilla.org/security/announce/2014/mfsa2015-02.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 72048
- 72048
- 1031533
- 1031533
- https://bugzilla.mozilla.org/show_bug.cgi?id=1094536
- https://bugzilla.mozilla.org/show_bug.cgi?id=1094536
- firefox-cve20148637-info-disc(99957)
- firefox-cve20148637-info-disc(99957)
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-8638
The navigator.sendBeacon implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 omits the CORS Origin header, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site.
- http://linux.oracle.com/errata/ELSA-2015-0046.html
- http://linux.oracle.com/errata/ELSA-2015-0046.html
- http://linux.oracle.com/errata/ELSA-2015-0047.html
- http://linux.oracle.com/errata/ELSA-2015-0047.html
- openSUSE-SU-2015:0077
- openSUSE-SU-2015:0077
- SUSE-SU-2015:0171
- SUSE-SU-2015:0171
- SUSE-SU-2015:0173
- SUSE-SU-2015:0173
- SUSE-SU-2015:0180
- SUSE-SU-2015:0180
- openSUSE-SU-2015:0192
- openSUSE-SU-2015:0192
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0133
- openSUSE-SU-2015:0133
- RHSA-2015:0046
- RHSA-2015:0046
- RHSA-2015:0047
- RHSA-2015:0047
- 62237
- 62237
- 62242
- 62242
- 62250
- 62250
- 62253
- 62253
- 62259
- 62259
- 62273
- 62273
- 62274
- 62274
- 62283
- 62283
- 62293
- 62293
- 62304
- 62304
- 62313
- 62313
- 62315
- 62315
- 62316
- 62316
- 62418
- 62418
- 62446
- 62446
- 62657
- 62657
- 62790
- 62790
- DSA-3127
- DSA-3127
- DSA-3132
- DSA-3132
- http://www.mozilla.org/security/announce/2014/mfsa2015-03.html
- http://www.mozilla.org/security/announce/2014/mfsa2015-03.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 72047
- 72047
- 1031533
- 1031533
- 1031534
- 1031534
- USN-2460-1
- USN-2460-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1080987
- https://bugzilla.mozilla.org/show_bug.cgi?id=1080987
- firefox-cve20148638-csrf(99958)
- firefox-cve20148638-csrf(99958)
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-8639
Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 (aka Proxy Authentication Required) status code, which allows remote HTTP proxy servers to conduct session fixation attacks by providing a cookie name that corresponds to the session cookie of the origin server.
- http://linux.oracle.com/errata/ELSA-2015-0046.html
- http://linux.oracle.com/errata/ELSA-2015-0046.html
- http://linux.oracle.com/errata/ELSA-2015-0047.html
- http://linux.oracle.com/errata/ELSA-2015-0047.html
- openSUSE-SU-2015:0077
- openSUSE-SU-2015:0077
- SUSE-SU-2015:0171
- SUSE-SU-2015:0171
- SUSE-SU-2015:0173
- SUSE-SU-2015:0173
- SUSE-SU-2015:0180
- SUSE-SU-2015:0180
- openSUSE-SU-2015:0192
- openSUSE-SU-2015:0192
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0133
- openSUSE-SU-2015:0133
- RHSA-2015:0046
- RHSA-2015:0046
- RHSA-2015:0047
- RHSA-2015:0047
- 62237
- 62237
- 62242
- 62242
- 62250
- 62250
- 62253
- 62253
- 62259
- 62259
- 62273
- 62273
- 62274
- 62274
- 62283
- 62283
- 62293
- 62293
- 62304
- 62304
- 62313
- 62313
- 62315
- 62315
- 62316
- 62316
- 62418
- 62418
- 62446
- 62446
- 62657
- 62657
- 62790
- 62790
- DSA-3127
- DSA-3127
- DSA-3132
- DSA-3132
- http://www.mozilla.org/security/announce/2014/mfsa2015-04.html
- http://www.mozilla.org/security/announce/2014/mfsa2015-04.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 72046
- 72046
- 1031533
- 1031533
- 1031534
- 1031534
- USN-2460-1
- USN-2460-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1095859
- https://bugzilla.mozilla.org/show_bug.cgi?id=1095859
- firefox-cve20148639-session-hijacking(99959)
- firefox-cve20148639-session-hijacking(99959)
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-8640
The mozilla::dom::AudioParamTimeline::AudioNodeInputValue function in the Web Audio API implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly restrict timeline operations, which allows remote attackers to cause a denial of service (uninitialized-memory read and application crash) via crafted API calls.
- openSUSE-SU-2015:0077
- openSUSE-SU-2015:0077
- SUSE-SU-2015:0171
- SUSE-SU-2015:0171
- SUSE-SU-2015:0173
- SUSE-SU-2015:0173
- SUSE-SU-2015:0180
- SUSE-SU-2015:0180
- openSUSE-SU-2015:0192
- openSUSE-SU-2015:0192
- 62242
- 62242
- 62250
- 62250
- 62418
- 62418
- 62790
- 62790
- http://www.mozilla.org/security/announce/2014/mfsa2015-05.html
- http://www.mozilla.org/security/announce/2014/mfsa2015-05.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 72045
- 72045
- 1031533
- 1031533
- https://bugzilla.mozilla.org/show_bug.cgi?id=1100409
- https://bugzilla.mozilla.org/show_bug.cgi?id=1100409
- firefox-cve20148640-info-disc(99960)
- firefox-cve20148640-info-disc(99960)
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-8641
Use-after-free vulnerability in the WebRTC implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, and SeaMonkey before 2.32 allows remote attackers to execute arbitrary code via crafted track data.
- http://linux.oracle.com/errata/ELSA-2015-0046.html
- http://linux.oracle.com/errata/ELSA-2015-0046.html
- openSUSE-SU-2015:0077
- openSUSE-SU-2015:0077
- SUSE-SU-2015:0171
- SUSE-SU-2015:0171
- SUSE-SU-2015:0173
- SUSE-SU-2015:0173
- SUSE-SU-2015:0180
- SUSE-SU-2015:0180
- openSUSE-SU-2015:0192
- openSUSE-SU-2015:0192
- RHSA-2015:0046
- RHSA-2015:0046
- 62237
- 62237
- 62242
- 62242
- 62250
- 62250
- 62253
- 62253
- 62273
- 62273
- 62293
- 62293
- 62313
- 62313
- 62316
- 62316
- 62418
- 62418
- 62446
- 62446
- 62790
- 62790
- DSA-3127
- DSA-3127
- http://www.mozilla.org/security/announce/2014/mfsa2015-06.html
- http://www.mozilla.org/security/announce/2014/mfsa2015-06.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 72044
- 72044
- 1031533
- 1031533
- https://bugzilla.mozilla.org/show_bug.cgi?id=1108455
- https://bugzilla.mozilla.org/show_bug.cgi?id=1108455
- firefox-cve20148641-dos(99961)
- firefox-cve20148641-dos(99961)
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-8642
Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not consider the id-pkix-ocsp-nocheck extension in deciding whether to trust an OCSP responder, which makes it easier for remote attackers to obtain sensitive information by sniffing the network during a session in which there was an incorrect decision to accept a compromised and revoked certificate.
- openSUSE-SU-2015:0077
- openSUSE-SU-2015:0077
- openSUSE-SU-2015:0192
- openSUSE-SU-2015:0192
- 62242
- 62242
- 62250
- 62250
- 62253
- 62253
- 62316
- 62316
- 62418
- 62418
- 62446
- 62446
- 62790
- 62790
- http://www.mozilla.org/security/announce/2014/mfsa2015-08.html
- http://www.mozilla.org/security/announce/2014/mfsa2015-08.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 72042
- 72042
- 1031533
- 1031533
- https://bugzilla.mozilla.org/show_bug.cgi?id=1079658
- https://bugzilla.mozilla.org/show_bug.cgi?id=1079658
- firefox-cve20148642-sec-bypass(99963)
- firefox-cve20148642-sec-bypass(99963)
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0799
The HTTP Alternative Services feature in Mozilla Firefox before 37.0.1 allows man-in-the-middle attackers to bypass an intended X.509 certificate-verification step for an SSL server by specifying that server in the uri-host field of an Alt-Svc HTTP/2 response header.
- openSUSE-SU-2015:0677
- openSUSE-SU-2015:0677
- http://www.mozilla.org/security/announce/2015/mfsa2015-44.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-44.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1032030
- 1032030
- USN-2557-1
- USN-2557-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1148328
- https://bugzilla.mozilla.org/show_bug.cgi?id=1148328
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-0801
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818.
- openSUSE-SU-2015:0677
- openSUSE-SU-2015:0677
- SUSE-SU-2015:0704
- SUSE-SU-2015:0704
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- RHSA-2015:0766
- RHSA-2015:0766
- RHSA-2015:0771
- RHSA-2015:0771
- DSA-3211
- DSA-3211
- DSA-3212
- DSA-3212
- http://www.mozilla.org/security/announce/2015/mfsa2015-40.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-40.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 73455
- 73455
- 1031996
- 1031996
- 1032000
- 1032000
- USN-2550-1
- USN-2550-1
- USN-2552-1
- USN-2552-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1146339
- https://bugzilla.mozilla.org/show_bug.cgi?id=1146339
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-0802
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods.
- openSUSE-SU-2015:0677
- openSUSE-SU-2015:0677
- http://www.mozilla.org/security/announce/2015/mfsa2015-42.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-42.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1031996
- 1031996
- USN-2550-1
- USN-2550-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1124898
- https://bugzilla.mozilla.org/show_bug.cgi?id=1124898
- GLSA-201512-10
- GLSA-201512-10
- 37958
- 37958
Modified: 2024-11-21
CVE-2015-0803
The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does not properly constrain the original data type of a casted value during the setting of a SOURCE element's attributes, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document.
- openSUSE-SU-2015:0677
- openSUSE-SU-2015:0677
- http://www.mozilla.org/security/announce/2015/mfsa2015-39.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-39.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1031996
- 1031996
- USN-2550-1
- USN-2550-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1134561
- https://bugzilla.mozilla.org/show_bug.cgi?id=1134561
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-0804
The HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does not properly constrain a data type after omitting namespace validation during certain tree-binding operations, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document containing a SOURCE element.
- openSUSE-SU-2015:0677
- openSUSE-SU-2015:0677
- http://www.mozilla.org/security/announce/2015/mfsa2015-39.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-39.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1031996
- 1031996
- USN-2550-1
- USN-2550-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1134560
- https://bugzilla.mozilla.org/show_bug.cgi?id=1134560
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-0805
The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 makes an incorrect memset call during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors that trigger rendering of 2D graphics content.
- openSUSE-SU-2015:0677
- openSUSE-SU-2015:0677
- http://www.mozilla.org/security/announce/2015/mfsa2015-38.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-38.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1031996
- 1031996
- USN-2550-1
- USN-2550-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1135511
- https://bugzilla.mozilla.org/show_bug.cgi?id=1135511
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-0806
The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 attempts to use memset for a memory region of negative length during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors that trigger rendering of 2D graphics content.
- openSUSE-SU-2015:0677
- openSUSE-SU-2015:0677
- http://www.mozilla.org/security/announce/2015/mfsa2015-38.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-38.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1031996
- 1031996
- USN-2550-1
- USN-2550-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1099437
- https://bugzilla.mozilla.org/show_bug.cgi?id=1099437
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-0807
The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site, a similar issue to CVE-2014-8638.
- openSUSE-SU-2015:0677
- openSUSE-SU-2015:0677
- SUSE-SU-2015:0704
- SUSE-SU-2015:0704
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- RHSA-2015:0766
- RHSA-2015:0766
- RHSA-2015:0771
- RHSA-2015:0771
- DSA-3211
- DSA-3211
- DSA-3212
- DSA-3212
- http://www.mozilla.org/security/announce/2015/mfsa2015-37.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-37.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 73457
- 73457
- 1031996
- 1031996
- 1032000
- 1032000
- USN-2550-1
- USN-2550-1
- USN-2552-1
- USN-2552-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1111834
- https://bugzilla.mozilla.org/show_bug.cgi?id=1111834
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-0808
The webrtc::VPMContentAnalysis::Release function in the WebRTC implementation in Mozilla Firefox before 37.0 uses incompatible approaches to the deallocation of memory for simple-type arrays, which might allow remote attackers to cause a denial of service (memory corruption) via unspecified vectors.
- openSUSE-SU-2015:0677
- openSUSE-SU-2015:0677
- http://www.mozilla.org/security/announce/2015/mfsa2015-36.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-36.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1031996
- 1031996
- USN-2550-1
- USN-2550-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1109552
- https://bugzilla.mozilla.org/show_bug.cgi?id=1109552
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-0811
The QCMS implementation in Mozilla Firefox before 37.0 allows remote attackers to obtain sensitive information from process heap memory or cause a denial of service (out-of-bounds read) via an image that is improperly handled during transformation.
- openSUSE-SU-2015:0677
- openSUSE-SU-2015:0677
- http://www.mozilla.org/security/announce/2015/mfsa2015-34.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-34.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1031996
- 1031996
- USN-2550-1
- USN-2550-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1132468
- https://bugzilla.mozilla.org/show_bug.cgi?id=1132468
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-0815
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2015:0677
- openSUSE-SU-2015:0677
- SUSE-SU-2015:0704
- SUSE-SU-2015:0704
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- RHSA-2015:0766
- RHSA-2015:0766
- RHSA-2015:0771
- RHSA-2015:0771
- DSA-3211
- DSA-3211
- DSA-3212
- DSA-3212
- http://www.mozilla.org/security/announce/2015/mfsa2015-30.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-30.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 73466
- 73466
- 1031996
- 1031996
- 1032000
- 1032000
- USN-2550-1
- USN-2550-1
- USN-2552-1
- USN-2552-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1036515
- https://bugzilla.mozilla.org/show_bug.cgi?id=1036515
- https://bugzilla.mozilla.org/show_bug.cgi?id=1137326
- https://bugzilla.mozilla.org/show_bug.cgi?id=1137326
- https://bugzilla.mozilla.org/show_bug.cgi?id=1138199
- https://bugzilla.mozilla.org/show_bug.cgi?id=1138199
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-0816
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js.
- openSUSE-SU-2015:0677
- openSUSE-SU-2015:0677
- SUSE-SU-2015:0704
- SUSE-SU-2015:0704
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- RHSA-2015:0766
- RHSA-2015:0766
- RHSA-2015:0771
- RHSA-2015:0771
- DSA-3211
- DSA-3211
- DSA-3212
- DSA-3212
- http://www.mozilla.org/security/announce/2015/mfsa2015-33.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-33.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 73461
- 73461
- 1031996
- 1031996
- 1032000
- 1032000
- USN-2550-1
- USN-2550-1
- USN-2552-1
- USN-2552-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1144991
- https://bugzilla.mozilla.org/show_bug.cgi?id=1144991
- GLSA-201512-10
- GLSA-201512-10
- 37958
- 37958
Modified: 2024-11-21
CVE-2015-0817
The asm.js implementation in Mozilla Firefox before 36.0.3, Firefox ESR 31.x before 31.5.2, and SeaMonkey before 2.33.1 does not properly determine the cases in which bounds checking may be safely skipped during JIT compilation and heap access, which allows remote attackers to read or write to unintended memory locations, and consequently execute arbitrary code, via crafted JavaScript.
- openSUSE-SU-2015:0567
- openSUSE-SU-2015:0567
- SUSE-SU-2015:0593
- SUSE-SU-2015:0593
- SUSE-SU-2015:0630
- SUSE-SU-2015:0630
- openSUSE-SU-2015:0636
- openSUSE-SU-2015:0636
- RHSA-2015:0718
- RHSA-2015:0718
- DSA-3201
- DSA-3201
- http://www.mozilla.org/security/announce/2015/mfsa2015-29.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-29.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 73263
- 73263
- 1031958
- 1031958
- USN-2538-1
- USN-2538-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1145255
- https://bugzilla.mozilla.org/show_bug.cgi?id=1145255
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0818
Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving SVG hash navigation.
- openSUSE-SU-2015:0567
- openSUSE-SU-2015:0567
- SUSE-SU-2015:0593
- SUSE-SU-2015:0593
- SUSE-SU-2015:0630
- SUSE-SU-2015:0630
- openSUSE-SU-2015:0636
- openSUSE-SU-2015:0636
- RHSA-2015:0718
- RHSA-2015:0718
- DSA-3201
- DSA-3201
- http://www.mozilla.org/security/announce/2015/mfsa2015-28.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-28.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 73265
- 73265
- 1031959
- 1031959
- USN-2538-1
- USN-2538-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1144988
- https://bugzilla.mozilla.org/show_bug.cgi?id=1144988
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0819
The UITour::onPageEvent function in Mozilla Firefox before 36.0 does not ensure that an API call originates from a foreground tab, which allows remote attackers to conduct spoofing and clickjacking attacks by leveraging access to a UI Tour web site.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- http://www.mozilla.org/security/announce/2015/mfsa2015-26.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-26.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 72759
- 72759
- 1031791
- 1031791
- USN-2505-1
- USN-2505-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1079554
- https://bugzilla.mozilla.org/show_bug.cgi?id=1079554
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0820
Mozilla Firefox before 36.0 does not properly restrict transitions of JavaScript objects from a non-extensible state to an extensible state, which allows remote attackers to bypass a Caja Compiler sandbox protection mechanism or a Secure EcmaScript sandbox protection mechanism via a crafted web site.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- http://www.mozilla.org/security/announce/2015/mfsa2015-27.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-27.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 72757
- 72757
- USN-2505-1
- USN-2505-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1125389
- https://bugzilla.mozilla.org/show_bug.cgi?id=1125389
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0821
Mozilla Firefox before 36.0 allows user-assisted remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges via a crafted web site that is accessed with unspecified mouse and keyboard actions.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- http://www.mozilla.org/security/announce/2015/mfsa2015-25.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-25.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 72758
- 72758
- 1031791
- 1031791
- USN-2505-1
- USN-2505-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1111960
- https://bugzilla.mozilla.org/show_bug.cgi?id=1111960
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0822
The Form Autocompletion feature in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to read arbitrary files via crafted JavaScript code.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- SUSE-SU-2015:0412
- SUSE-SU-2015:0412
- SUSE-SU-2015:0446
- SUSE-SU-2015:0446
- SUSE-SU-2015:0447
- SUSE-SU-2015:0447
- openSUSE-SU-2015:0448
- openSUSE-SU-2015:0448
- openSUSE-SU-2015:0567
- openSUSE-SU-2015:0567
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- RHSA-2015:0265
- RHSA-2015:0265
- RHSA-2015:0266
- RHSA-2015:0266
- RHSA-2015:0642
- RHSA-2015:0642
- DSA-3174
- DSA-3174
- DSA-3179
- DSA-3179
- http://www.mozilla.org/security/announce/2015/mfsa2015-24.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-24.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 72756
- 72756
- 1031791
- 1031791
- 1031792
- 1031792
- USN-2505-1
- USN-2505-1
- USN-2506-1
- USN-2506-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1110557
- https://bugzilla.mozilla.org/show_bug.cgi?id=1110557
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0823
Multiple use-after-free vulnerabilities in OpenType Sanitiser, as used in Mozilla Firefox before 36.0, might allow remote attackers to trigger problematic Developer Console information or possibly have unspecified other impact by leveraging incorrect macro expansion, related to the ots::ots_gasp_parse function.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- http://www.mozilla.org/security/announce/2015/mfsa2015-23.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-23.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 72754
- 72754
- 1031791
- 1031791
- USN-2505-1
- USN-2505-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1098497
- https://bugzilla.mozilla.org/show_bug.cgi?id=1098497
- https://github.com/khaledhosny/ots/commit/003c62d28ae438aa8943cb31535563397f838a2c
- https://github.com/khaledhosny/ots/commit/003c62d28ae438aa8943cb31535563397f838a2c
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0824
The mozilla::layers::BufferTextureClient::AllocateForSurface function in Mozilla Firefox before 36.0 allows remote attackers to cause a denial of service (out-of-bounds write of zero values, and application crash) via vectors that trigger use of DrawTarget and the Cairo library for image drawing.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- http://www.mozilla.org/security/announce/2015/mfsa2015-22.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-22.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 72753
- 72753
- 1031791
- 1031791
- USN-2505-1
- USN-2505-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1095925
- https://bugzilla.mozilla.org/show_bug.cgi?id=1095925
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0825
Stack-based buffer underflow in the mozilla::MP3FrameParser::ParseBuffer function in Mozilla Firefox before 36.0 allows remote attackers to obtain sensitive information from process memory via a malformed MP3 file that improperly interacts with memory allocation during playback.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- http://www.mozilla.org/security/announce/2015/mfsa2015-21.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-21.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 72751
- 72751
- 1031791
- 1031791
- USN-2505-1
- USN-2505-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1092370
- https://bugzilla.mozilla.org/show_bug.cgi?id=1092370
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0826
The nsTransformedTextRun::SetCapitalization function in Mozilla Firefox before 36.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read of heap memory) via a crafted Cascading Style Sheets (CSS) token sequence that triggers a restyle or reflow operation.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- http://www.mozilla.org/security/announce/2015/mfsa2015-20.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-20.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 72750
- 72750
- 1031791
- 1031791
- USN-2505-1
- USN-2505-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1092363
- https://bugzilla.mozilla.org/show_bug.cgi?id=1092363
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0827
Heap-based buffer overflow in the mozilla::gfx::CopyRect function in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to obtain sensitive information from uninitialized process memory via a malformed SVG graphic.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- SUSE-SU-2015:0412
- SUSE-SU-2015:0412
- SUSE-SU-2015:0446
- SUSE-SU-2015:0446
- SUSE-SU-2015:0447
- SUSE-SU-2015:0447
- openSUSE-SU-2015:0448
- openSUSE-SU-2015:0448
- openSUSE-SU-2015:0567
- openSUSE-SU-2015:0567
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- RHSA-2015:0265
- RHSA-2015:0265
- RHSA-2015:0266
- RHSA-2015:0266
- RHSA-2015:0642
- RHSA-2015:0642
- DSA-3174
- DSA-3174
- DSA-3179
- DSA-3179
- http://www.mozilla.org/security/announce/2015/mfsa2015-19.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-19.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 72755
- 72755
- 1031791
- 1031791
- 1031792
- 1031792
- USN-2505-1
- USN-2505-1
- USN-2506-1
- USN-2506-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1117304
- https://bugzilla.mozilla.org/show_bug.cgi?id=1117304
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0828
Double free vulnerability in the nsXMLHttpRequest::GetResponse function in Mozilla Firefox before 36.0, when a nonstandard memory allocator is used, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted JavaScript code that makes an XMLHttpRequest call with zero bytes of data.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- http://www.mozilla.org/security/announce/2015/mfsa2015-18.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-18.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 72744
- 72744
- 1031791
- 1031791
- https://bugzilla.mozilla.org/show_bug.cgi?id=1030667
- https://bugzilla.mozilla.org/show_bug.cgi?id=1030667
- https://bugzilla.mozilla.org/show_bug.cgi?id=988675
- https://bugzilla.mozilla.org/show_bug.cgi?id=988675
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0829
Buffer overflow in libstagefright in Mozilla Firefox before 36.0 allows remote attackers to execute arbitrary code via a crafted MP4 video that is improperly handled during playback.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- http://www.mozilla.org/security/announce/2015/mfsa2015-17.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-17.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 72741
- 72741
- 1031791
- 1031791
- USN-2505-1
- USN-2505-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1128939
- https://bugzilla.mozilla.org/show_bug.cgi?id=1128939
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0830
The WebGL implementation in Mozilla Firefox before 36.0 does not properly allocate memory for copying an unspecified string to a shader's compilation log, which allows remote attackers to cause a denial of service (application crash) via crafted WebGL content.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- http://www.mozilla.org/security/announce/2015/mfsa2015-14.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-14.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 72745
- 72745
- 1031791
- 1031791
- USN-2505-1
- USN-2505-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1110488
- https://bugzilla.mozilla.org/show_bug.cgi?id=1110488
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0831
Use-after-free vulnerability in the mozilla::dom::IndexedDB::IDBObjectStore::CreateIndex function in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted content that is improperly handled during IndexedDB index creation.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- SUSE-SU-2015:0412
- SUSE-SU-2015:0412
- SUSE-SU-2015:0446
- SUSE-SU-2015:0446
- SUSE-SU-2015:0447
- SUSE-SU-2015:0447
- openSUSE-SU-2015:0448
- openSUSE-SU-2015:0448
- openSUSE-SU-2015:0567
- openSUSE-SU-2015:0567
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- RHSA-2015:0265
- RHSA-2015:0265
- RHSA-2015:0266
- RHSA-2015:0266
- RHSA-2015:0642
- RHSA-2015:0642
- DSA-3174
- DSA-3174
- DSA-3179
- DSA-3179
- http://www.mozilla.org/security/announce/2015/mfsa2015-16.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-16.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 72746
- 72746
- 1031791
- 1031791
- 1031792
- 1031792
- USN-2505-1
- USN-2505-1
- USN-2506-1
- USN-2506-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1130541
- https://bugzilla.mozilla.org/show_bug.cgi?id=1130541
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0832
Mozilla Firefox before 36.0 does not properly recognize the equivalence of domain names with and without a trailing . (dot) character, which allows man-in-the-middle attackers to bypass the HPKP and HSTS protection mechanisms by constructing a URL with this character and leveraging access to an X.509 certificate for a domain with this character.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- http://www.mozilla.org/security/announce/2015/mfsa2015-13.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-13.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 72752
- 72752
- USN-2505-1
- USN-2505-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1065909
- https://bugzilla.mozilla.org/show_bug.cgi?id=1065909
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0834
The WebRTC subsystem in Mozilla Firefox before 36.0 recognizes turns: and stuns: URIs but accesses the TURN or STUN server without using TLS, which makes it easier for man-in-the-middle attackers to discover credentials by spoofing a server and completing a brute-force attack within a short time window.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- http://www.mozilla.org/security/announce/2015/mfsa2015-15.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-15.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 72743
- 72743
- 1031791
- 1031791
- USN-2505-1
- USN-2505-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1098314
- https://bugzilla.mozilla.org/show_bug.cgi?id=1098314
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0835
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- SUSE-SU-2015:0412
- SUSE-SU-2015:0412
- SUSE-SU-2015:0446
- SUSE-SU-2015:0446
- SUSE-SU-2015:0447
- SUSE-SU-2015:0447
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- http://www.mozilla.org/security/announce/2015/mfsa2015-11.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-11.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 72748
- 72748
- 1031791
- 1031791
- 1031792
- 1031792
- USN-2505-1
- USN-2505-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1072760
- https://bugzilla.mozilla.org/show_bug.cgi?id=1072760
- https://bugzilla.mozilla.org/show_bug.cgi?id=1092947
- https://bugzilla.mozilla.org/show_bug.cgi?id=1092947
- https://bugzilla.mozilla.org/show_bug.cgi?id=1114058
- https://bugzilla.mozilla.org/show_bug.cgi?id=1114058
- https://bugzilla.mozilla.org/show_bug.cgi?id=1114569
- https://bugzilla.mozilla.org/show_bug.cgi?id=1114569
- https://bugzilla.mozilla.org/show_bug.cgi?id=1118894
- https://bugzilla.mozilla.org/show_bug.cgi?id=1118894
- https://bugzilla.mozilla.org/show_bug.cgi?id=1119019
- https://bugzilla.mozilla.org/show_bug.cgi?id=1119019
- https://bugzilla.mozilla.org/show_bug.cgi?id=1122387
- https://bugzilla.mozilla.org/show_bug.cgi?id=1122387
- https://bugzilla.mozilla.org/show_bug.cgi?id=1125734
- https://bugzilla.mozilla.org/show_bug.cgi?id=1125734
- https://bugzilla.mozilla.org/show_bug.cgi?id=1127206
- https://bugzilla.mozilla.org/show_bug.cgi?id=1127206
- https://bugzilla.mozilla.org/show_bug.cgi?id=1127246
- https://bugzilla.mozilla.org/show_bug.cgi?id=1127246
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0836
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- SUSE-SU-2015:0412
- SUSE-SU-2015:0412
- SUSE-SU-2015:0446
- SUSE-SU-2015:0446
- SUSE-SU-2015:0447
- SUSE-SU-2015:0447
- openSUSE-SU-2015:0448
- openSUSE-SU-2015:0448
- openSUSE-SU-2015:0567
- openSUSE-SU-2015:0567
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- RHSA-2015:0265
- RHSA-2015:0265
- RHSA-2015:0266
- RHSA-2015:0266
- RHSA-2015:0642
- RHSA-2015:0642
- DSA-3174
- DSA-3174
- DSA-3179
- DSA-3179
- http://www.mozilla.org/security/announce/2015/mfsa2015-11.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-11.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 72742
- 72742
- 1031791
- 1031791
- 1031792
- 1031792
- USN-2505-1
- USN-2505-1
- USN-2506-1
- USN-2506-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1096138
- https://bugzilla.mozilla.org/show_bug.cgi?id=1096138
- https://bugzilla.mozilla.org/show_bug.cgi?id=1107009
- https://bugzilla.mozilla.org/show_bug.cgi?id=1107009
- https://bugzilla.mozilla.org/show_bug.cgi?id=1111243
- https://bugzilla.mozilla.org/show_bug.cgi?id=1111243
- https://bugzilla.mozilla.org/show_bug.cgi?id=1111248
- https://bugzilla.mozilla.org/show_bug.cgi?id=1111248
- https://bugzilla.mozilla.org/show_bug.cgi?id=1115776
- https://bugzilla.mozilla.org/show_bug.cgi?id=1115776
- https://bugzilla.mozilla.org/show_bug.cgi?id=1117406
- https://bugzilla.mozilla.org/show_bug.cgi?id=1117406
- https://bugzilla.mozilla.org/show_bug.cgi?id=1119579
- https://bugzilla.mozilla.org/show_bug.cgi?id=1119579
- https://bugzilla.mozilla.org/show_bug.cgi?id=1123882
- https://bugzilla.mozilla.org/show_bug.cgi?id=1123882
- https://bugzilla.mozilla.org/show_bug.cgi?id=1124018
- https://bugzilla.mozilla.org/show_bug.cgi?id=1124018
- https://bugzilla.mozilla.org/show_bug.cgi?id=1128196
- https://bugzilla.mozilla.org/show_bug.cgi?id=1128196
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-2706
Race condition in the AsyncPaintWaitEvent::AsyncPaintWaitEvent function in Mozilla Firefox before 37.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted plugin that does not properly complete initialization.
- openSUSE-SU-2015:0761
- openSUSE-SU-2015:0761
- openSUSE-SU-2015:0763
- openSUSE-SU-2015:0763
- http://www.mozilla.org/security/announce/2015/mfsa2015-45.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-45.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 74247
- 74247
- 1032171
- 1032171
- USN-2571-1
- USN-2571-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1141081
- https://bugzilla.mozilla.org/show_bug.cgi?id=1141081
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2708
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:0892
- SUSE-SU-2015:0960
- SUSE-SU-2015:0960
- SUSE-SU-2015:0978
- SUSE-SU-2015:0978
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0934
- openSUSE-SU-2015:0934
- RHSA-2015:0988
- RHSA-2015:0988
- RHSA-2015:1012
- RHSA-2015:1012
- DSA-3260
- DSA-3260
- DSA-3264
- DSA-3264
- http://www.mozilla.org/security/announce/2015/mfsa2015-46.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-46.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 74615
- 74615
- USN-2602-1
- USN-2602-1
- USN-2603-1
- USN-2603-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1120655
- https://bugzilla.mozilla.org/show_bug.cgi?id=1120655
- https://bugzilla.mozilla.org/show_bug.cgi?id=1143299
- https://bugzilla.mozilla.org/show_bug.cgi?id=1143299
- https://bugzilla.mozilla.org/show_bug.cgi?id=1151139
- https://bugzilla.mozilla.org/show_bug.cgi?id=1151139
- https://bugzilla.mozilla.org/show_bug.cgi?id=1152177
- https://bugzilla.mozilla.org/show_bug.cgi?id=1152177
- GLSA-201605-06
- GLSA-201605-06
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
Modified: 2024-11-21
CVE-2015-2709
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- SUSE-SU-2015:0960
- SUSE-SU-2015:0960
- SUSE-SU-2015:0978
- SUSE-SU-2015:0978
- openSUSE-SU-2015:0934
- openSUSE-SU-2015:0934
- RHSA-2015:1012
- RHSA-2015:1012
- http://www.mozilla.org/security/announce/2015/mfsa2015-46.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-46.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 74615
- 74615
- USN-2602-1
- USN-2602-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1111251
- https://bugzilla.mozilla.org/show_bug.cgi?id=1111251
- https://bugzilla.mozilla.org/show_bug.cgi?id=1117977
- https://bugzilla.mozilla.org/show_bug.cgi?id=1117977
- https://bugzilla.mozilla.org/show_bug.cgi?id=1128064
- https://bugzilla.mozilla.org/show_bug.cgi?id=1128064
- https://bugzilla.mozilla.org/show_bug.cgi?id=1135066
- https://bugzilla.mozilla.org/show_bug.cgi?id=1135066
- https://bugzilla.mozilla.org/show_bug.cgi?id=1143194
- https://bugzilla.mozilla.org/show_bug.cgi?id=1143194
- https://bugzilla.mozilla.org/show_bug.cgi?id=1146101
- https://bugzilla.mozilla.org/show_bug.cgi?id=1146101
- https://bugzilla.mozilla.org/show_bug.cgi?id=1149526
- https://bugzilla.mozilla.org/show_bug.cgi?id=1149526
- https://bugzilla.mozilla.org/show_bug.cgi?id=1153688
- https://bugzilla.mozilla.org/show_bug.cgi?id=1153688
- https://bugzilla.mozilla.org/show_bug.cgi?id=1155474
- https://bugzilla.mozilla.org/show_bug.cgi?id=1155474
- GLSA-201605-06
- GLSA-201605-06
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
Modified: 2024-11-21
CVE-2015-2710
Heap-based buffer overflow in the SVGTextFrame class in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code via crafted SVG graphics data in conjunction with a crafted Cascading Style Sheets (CSS) token sequence.
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:0892
- SUSE-SU-2015:0960
- SUSE-SU-2015:0960
- SUSE-SU-2015:0978
- SUSE-SU-2015:0978
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0934
- openSUSE-SU-2015:0934
- RHSA-2015:0988
- RHSA-2015:0988
- RHSA-2015:1012
- RHSA-2015:1012
- DSA-3260
- DSA-3260
- DSA-3264
- DSA-3264
- http://www.mozilla.org/security/announce/2015/mfsa2015-48.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-48.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 74611
- 74611
- USN-2602-1
- USN-2602-1
- USN-2603-1
- USN-2603-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1149542
- https://bugzilla.mozilla.org/show_bug.cgi?id=1149542
- GLSA-201605-06
- GLSA-201605-06
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
Modified: 2024-11-21
CVE-2015-2711
Mozilla Firefox before 38.0 does not recognize a referrer policy delivered by a referrer META element in cases of context-menu navigation and middle-click navigation, which allows remote attackers to obtain sensitive information by reading web-server Referer logs that contain private data in a URL, as demonstrated by a private path component.
- openSUSE-SU-2015:0934
- openSUSE-SU-2015:0934
- http://www.mozilla.org/security/announce/2015/mfsa2015-49.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-49.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 74611
- 74611
- USN-2602-1
- USN-2602-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1113431
- https://bugzilla.mozilla.org/show_bug.cgi?id=1113431
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-2712
The asm.js implementation in Mozilla Firefox before 38.0 does not properly determine heap lengths during identification of cases in which bounds checking may be safely skipped, which allows remote attackers to trigger out-of-bounds write operations and possibly execute arbitrary code, or trigger out-of-bounds read operations and possibly obtain sensitive information from process memory, via crafted JavaScript.
- openSUSE-SU-2015:0934
- openSUSE-SU-2015:0934
- http://www.mozilla.org/security/announce/2015/mfsa2015-50.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-50.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 74611
- 74611
- USN-2602-1
- USN-2602-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1152280
- https://bugzilla.mozilla.org/show_bug.cgi?id=1152280
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-2713
Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a document containing crafted text in conjunction with a Cascading Style Sheets (CSS) token sequence containing properties related to vertical text.
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:0892
- SUSE-SU-2015:0960
- SUSE-SU-2015:0960
- SUSE-SU-2015:0978
- SUSE-SU-2015:0978
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0934
- openSUSE-SU-2015:0934
- RHSA-2015:0988
- RHSA-2015:0988
- RHSA-2015:1012
- RHSA-2015:1012
- DSA-3260
- DSA-3260
- DSA-3264
- DSA-3264
- http://www.mozilla.org/security/announce/2015/mfsa2015-51.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-51.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 74611
- 74611
- USN-2602-1
- USN-2602-1
- USN-2603-1
- USN-2603-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1153478
- https://bugzilla.mozilla.org/show_bug.cgi?id=1153478
- GLSA-201605-06
- GLSA-201605-06
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
Modified: 2024-11-21
CVE-2015-2715
Race condition in the nsThreadManager::RegisterCurrentThread function in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) by leveraging improper Media Decoder Thread creation at the time of a shutdown.
- openSUSE-SU-2015:0934
- openSUSE-SU-2015:0934
- http://www.mozilla.org/security/announce/2015/mfsa2015-53.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-53.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 74611
- 74611
- USN-2602-1
- USN-2602-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=988698
- https://bugzilla.mozilla.org/show_bug.cgi?id=988698
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-2716
Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:0892
- SUSE-SU-2015:0960
- SUSE-SU-2015:0960
- SUSE-SU-2015:0978
- SUSE-SU-2015:0978
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0934
- openSUSE-SU-2015:0934
- RHSA-2015:0988
- RHSA-2015:0988
- RHSA-2015:1012
- RHSA-2015:1012
- DSA-3260
- DSA-3260
- DSA-3264
- DSA-3264
- http://www.mozilla.org/security/announce/2015/mfsa2015-54.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-54.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 74611
- 74611
- USN-2602-1
- USN-2602-1
- USN-2603-1
- USN-2603-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1140537
- https://bugzilla.mozilla.org/show_bug.cgi?id=1140537
- https://hg.mozilla.org/releases/mozilla-esr31/rev/2f3e78643f5c
- https://hg.mozilla.org/releases/mozilla-esr31/rev/2f3e78643f5c
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365
- GLSA-201605-06
- GLSA-201605-06
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
- https://www.tenable.com/security/tns-2016-20
- https://www.tenable.com/security/tns-2016-20
Modified: 2024-11-21
CVE-2015-2717
Integer overflow in libstagefright in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and out-of-bounds read) via an MP4 video file containing invalid metadata.
- openSUSE-SU-2015:0934
- openSUSE-SU-2015:0934
- http://www.mozilla.org/security/announce/2015/mfsa2015-55.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-55.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 74611
- 74611
- USN-2602-1
- USN-2602-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1154683
- https://bugzilla.mozilla.org/show_bug.cgi?id=1154683
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-2718
The WebChannel.jsm module in Mozilla Firefox before 38.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive webchannel-response data via a crafted web site containing an IFRAME element referencing a different web site that is intended to read this data.
- openSUSE-SU-2015:0934
- openSUSE-SU-2015:0934
- http://www.mozilla.org/security/announce/2015/mfsa2015-56.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-56.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 74611
- 74611
- USN-2602-1
- USN-2602-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1146724
- https://bugzilla.mozilla.org/show_bug.cgi?id=1146724
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-2720
The update implementation in Mozilla Firefox before 38.0 on Windows does not ensure that the pathname for updater.exe corresponds to the application directory, which might allow local users to gain privileges via a Trojan horse file.
- http://www.mozilla.org/security/announce/2015/mfsa2015-58.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-58.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 74611
- 74611
- https://bugzilla.mozilla.org/show_bug.cgi?id=1127481
- https://bugzilla.mozilla.org/show_bug.cgi?id=1127481
Modified: 2024-11-21
CVE-2015-2722
Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a shared worker.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- http://www.mozilla.org/security/announce/2015/mfsa2015-65.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-65.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1166924
- https://bugzilla.mozilla.org/show_bug.cgi?id=1166924
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2724
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- DSA-3300
- DSA-3300
- DSA-3324
- DSA-3324
- http://www.mozilla.org/security/announce/2015/mfsa2015-59.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-59.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- USN-2673-1
- USN-2673-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1143679
- https://bugzilla.mozilla.org/show_bug.cgi?id=1143679
- https://bugzilla.mozilla.org/show_bug.cgi?id=1154876
- https://bugzilla.mozilla.org/show_bug.cgi?id=1154876
- https://bugzilla.mozilla.org/show_bug.cgi?id=1160884
- https://bugzilla.mozilla.org/show_bug.cgi?id=1160884
- https://bugzilla.mozilla.org/show_bug.cgi?id=1164567
- https://bugzilla.mozilla.org/show_bug.cgi?id=1164567
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2725
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- http://www.mozilla.org/security/announce/2015/mfsa2015-59.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-59.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1056410
- https://bugzilla.mozilla.org/show_bug.cgi?id=1056410
- https://bugzilla.mozilla.org/show_bug.cgi?id=1151650
- https://bugzilla.mozilla.org/show_bug.cgi?id=1151650
- https://bugzilla.mozilla.org/show_bug.cgi?id=1156861
- https://bugzilla.mozilla.org/show_bug.cgi?id=1156861
- https://bugzilla.mozilla.org/show_bug.cgi?id=1159321
- https://bugzilla.mozilla.org/show_bug.cgi?id=1159321
- https://bugzilla.mozilla.org/show_bug.cgi?id=1159973
- https://bugzilla.mozilla.org/show_bug.cgi?id=1159973
- https://bugzilla.mozilla.org/show_bug.cgi?id=1163359
- https://bugzilla.mozilla.org/show_bug.cgi?id=1163359
- https://bugzilla.mozilla.org/show_bug.cgi?id=1163852
- https://bugzilla.mozilla.org/show_bug.cgi?id=1163852
- https://bugzilla.mozilla.org/show_bug.cgi?id=1172076
- https://bugzilla.mozilla.org/show_bug.cgi?id=1172076
- https://bugzilla.mozilla.org/show_bug.cgi?id=1172397
- https://bugzilla.mozilla.org/show_bug.cgi?id=1172397
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2726
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- http://www.mozilla.org/security/announce/2015/mfsa2015-59.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-59.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1059081
- https://bugzilla.mozilla.org/show_bug.cgi?id=1059081
- https://bugzilla.mozilla.org/show_bug.cgi?id=1132265
- https://bugzilla.mozilla.org/show_bug.cgi?id=1132265
- https://bugzilla.mozilla.org/show_bug.cgi?id=1145781
- https://bugzilla.mozilla.org/show_bug.cgi?id=1145781
- https://bugzilla.mozilla.org/show_bug.cgi?id=1146416
- https://bugzilla.mozilla.org/show_bug.cgi?id=1146416
- https://bugzilla.mozilla.org/show_bug.cgi?id=1155985
- https://bugzilla.mozilla.org/show_bug.cgi?id=1155985
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2728
The IndexedDatabaseManager class in the IndexedDB implementation in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 misinterprets an unspecified IDBDatabase field as a pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors, related to a "type confusion" issue.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- DSA-3300
- DSA-3300
- http://www.mozilla.org/security/announce/2015/mfsa2015-61.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-61.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1142210
- https://bugzilla.mozilla.org/show_bug.cgi?id=1142210
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2729
The AudioParamTimeline::AudioNodeInputValue function in the Web Audio implementation in Mozilla Firefox before 39.0 and Firefox ESR 38.x before 38.1 does not properly calculate an oscillator rendering range, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspecified vectors.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- RHSA-2015:1207
- RHSA-2015:1207
- http://www.mozilla.org/security/announce/2015/mfsa2015-62.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-62.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1122218
- https://bugzilla.mozilla.org/show_bug.cgi?id=1122218
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2731
Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allows remote attackers to execute arbitrary code by leveraging client-side JavaScript that triggers removal of a DOM object on the basis of a Content Policy.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- DSA-3300
- DSA-3300
- http://www.mozilla.org/security/announce/2015/mfsa2015-63.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-63.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1149891
- https://bugzilla.mozilla.org/show_bug.cgi?id=1149891
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2733
Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a dedicated worker.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- http://www.mozilla.org/security/announce/2015/mfsa2015-65.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-65.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1169867
- https://bugzilla.mozilla.org/show_bug.cgi?id=1169867
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2734
The CairoTextureClientD3D9::BorrowDrawTarget function in the Direct3D 9 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- DSA-3300
- DSA-3300
- DSA-3324
- DSA-3324
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- USN-2673-1
- USN-2673-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1166082
- https://bugzilla.mozilla.org/show_bug.cgi?id=1166082
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2735
nsZipArchive.cpp in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- DSA-3300
- DSA-3300
- DSA-3324
- DSA-3324
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- USN-2673-1
- USN-2673-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1166900
- https://bugzilla.mozilla.org/show_bug.cgi?id=1166900
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2736
The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- DSA-3300
- DSA-3300
- DSA-3324
- DSA-3324
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- USN-2673-1
- USN-2673-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1167888
- https://bugzilla.mozilla.org/show_bug.cgi?id=1167888
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2737
The rx::d3d11::SetBufferData function in the Direct3D 11 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- DSA-3300
- DSA-3300
- DSA-3324
- DSA-3324
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- USN-2673-1
- USN-2673-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1167332
- https://bugzilla.mozilla.org/show_bug.cgi?id=1167332
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2738
The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- DSA-3300
- DSA-3300
- DSA-3324
- DSA-3324
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- USN-2673-1
- USN-2673-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1167356
- https://bugzilla.mozilla.org/show_bug.cgi?id=1167356
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2739
The ArrayBufferBuilder::append function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which has unspecified impact and attack vectors.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- DSA-3300
- DSA-3300
- DSA-3324
- DSA-3324
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- USN-2673-1
- USN-2673-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1168207
- https://bugzilla.mozilla.org/show_bug.cgi?id=1168207
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2740
Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 might allow remote attackers to cause a denial of service or have unspecified other impact via unknown vectors.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- DSA-3300
- DSA-3300
- DSA-3324
- DSA-3324
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- USN-2673-1
- USN-2673-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1170809
- https://bugzilla.mozilla.org/show_bug.cgi?id=1170809
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2741
Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 do not enforce key pinning upon encountering an X.509 certificate problem that generates a user dialog, which allows user-assisted man-in-the-middle attackers to bypass intended access restrictions by triggering a (1) expired certificate or (2) mismatched hostname for a domain with pinning enabled.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- http://www.mozilla.org/security/announce/2015/mfsa2015-67.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-67.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1147497
- https://bugzilla.mozilla.org/show_bug.cgi?id=1147497
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2743
PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables excessive privileges for internal Workers, which might allow remote attackers to execute arbitrary code by leveraging a Same Origin Policy bypass.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- DSA-3300
- DSA-3300
- http://www.mozilla.org/security/announce/2015/mfsa2015-69.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-69.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1163109
- https://bugzilla.mozilla.org/show_bug.cgi?id=1163109
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-4473
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1390
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- SUSE-SU-2015:1528
- SUSE-SU-2015:1528
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1454
- openSUSE-SU-2015:1454
- RHSA-2015:1586
- RHSA-2015:1586
- RHSA-2015:1682
- RHSA-2015:1682
- DSA-3333
- DSA-3333
- DSA-3410
- DSA-3410
- http://www.mozilla.org/security/announce/2015/mfsa2015-79.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-79.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1033247
- 1033247
- 1033372
- 1033372
- USN-2702-1
- USN-2702-1
- USN-2702-2
- USN-2702-2
- USN-2702-3
- USN-2702-3
- USN-2712-1
- USN-2712-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1146213
- https://bugzilla.mozilla.org/show_bug.cgi?id=1146213
- https://bugzilla.mozilla.org/show_bug.cgi?id=1178890
- https://bugzilla.mozilla.org/show_bug.cgi?id=1178890
- https://bugzilla.mozilla.org/show_bug.cgi?id=1182711
- https://bugzilla.mozilla.org/show_bug.cgi?id=1182711
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-4474
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 40.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1390
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- SUSE-SU-2015:1528
- SUSE-SU-2015:1528
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- http://www.mozilla.org/security/announce/2015/mfsa2015-79.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-79.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1033247
- 1033247
- 1033372
- 1033372
- USN-2702-1
- USN-2702-1
- USN-2702-2
- USN-2702-2
- USN-2702-3
- USN-2702-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1143130
- https://bugzilla.mozilla.org/show_bug.cgi?id=1143130
- https://bugzilla.mozilla.org/show_bug.cgi?id=1161719
- https://bugzilla.mozilla.org/show_bug.cgi?id=1161719
- https://bugzilla.mozilla.org/show_bug.cgi?id=1177501
- https://bugzilla.mozilla.org/show_bug.cgi?id=1177501
- https://bugzilla.mozilla.org/show_bug.cgi?id=1181204
- https://bugzilla.mozilla.org/show_bug.cgi?id=1181204
- https://bugzilla.mozilla.org/show_bug.cgi?id=1184068
- https://bugzilla.mozilla.org/show_bug.cgi?id=1184068
- https://bugzilla.mozilla.org/show_bug.cgi?id=1188590
- https://bugzilla.mozilla.org/show_bug.cgi?id=1188590
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-4475
The mozilla::AudioSink function in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 mishandles inconsistent sample formats within MP3 audio data, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a malformed file.
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1390
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- SUSE-SU-2015:1528
- SUSE-SU-2015:1528
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1454
- openSUSE-SU-2015:1454
- RHSA-2015:1586
- RHSA-2015:1586
- http://www.mozilla.org/security/announce/2015/mfsa2015-80.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-80.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 76294
- 76294
- 1033247
- 1033247
- USN-2702-1
- USN-2702-1
- USN-2702-2
- USN-2702-2
- USN-2702-3
- USN-2702-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1175396
- https://bugzilla.mozilla.org/show_bug.cgi?id=1175396
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-4477
Use-after-free vulnerability in the MediaStream playback feature in Mozilla Firefox before 40.0 allows remote attackers to execute arbitrary code via unspecified use of the Web Audio API.
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1390
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- http://www.mozilla.org/security/announce/2015/mfsa2015-81.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-81.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1033247
- 1033247
- USN-2702-1
- USN-2702-1
- USN-2702-2
- USN-2702-2
- USN-2702-3
- USN-2702-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1179484
- https://bugzilla.mozilla.org/show_bug.cgi?id=1179484
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-4478
Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 do not impose certain ECMAScript 6 requirements on JavaScript object properties, which allows remote attackers to bypass the Same Origin Policy via the reviver parameter to the JSON.parse method.
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1390
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- SUSE-SU-2015:1528
- SUSE-SU-2015:1528
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1454
- openSUSE-SU-2015:1454
- RHSA-2015:1586
- RHSA-2015:1586
- DSA-3333
- DSA-3333
- http://www.mozilla.org/security/announce/2015/mfsa2015-82.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-82.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1033247
- 1033247
- USN-2702-1
- USN-2702-1
- USN-2702-2
- USN-2702-2
- USN-2702-3
- USN-2702-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1105914
- https://bugzilla.mozilla.org/show_bug.cgi?id=1105914
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-4479
Multiple integer overflows in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allow remote attackers to execute arbitrary code via a crafted saio chunk in MPEG-4 video data.
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1390
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- SUSE-SU-2015:1528
- SUSE-SU-2015:1528
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1454
- openSUSE-SU-2015:1454
- RHSA-2015:1586
- RHSA-2015:1586
- DSA-3333
- DSA-3333
- http://www.mozilla.org/security/announce/2015/mfsa2015-83.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-83.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1033247
- 1033247
- USN-2702-1
- USN-2702-1
- USN-2702-2
- USN-2702-2
- USN-2702-3
- USN-2702-3
- http://www.zerodayinitiative.com/advisories/ZDI-15-456
- http://www.zerodayinitiative.com/advisories/ZDI-15-456
- https://bugzilla.mozilla.org/show_bug.cgi?id=1170344
- https://bugzilla.mozilla.org/show_bug.cgi?id=1170344
- https://bugzilla.mozilla.org/show_bug.cgi?id=1185115
- https://bugzilla.mozilla.org/show_bug.cgi?id=1185115
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-4480
Integer overflow in the stagefright::SampleTable::isValid function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via crafted MPEG-4 video data with H.264 encoding.
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1454
- openSUSE-SU-2015:1454
- RHSA-2015:1586
- RHSA-2015:1586
- DSA-3333
- DSA-3333
- http://www.mozilla.org/security/announce/2015/mfsa2015-83.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-83.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1033247
- 1033247
- USN-2702-1
- USN-2702-1
- USN-2702-2
- USN-2702-2
- USN-2702-3
- USN-2702-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1144107
- https://bugzilla.mozilla.org/show_bug.cgi?id=1144107
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-4482
mar_read.c in the Updater in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows local users to gain privileges or cause a denial of service (out-of-bounds write) via a crafted name of a Mozilla Archive (aka MAR) file.
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1454
- openSUSE-SU-2015:1454
- http://www.mozilla.org/security/announce/2015/mfsa2015-85.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-85.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 76294
- 76294
- 1033247
- 1033247
- 1033372
- 1033372
- https://bugzilla.mozilla.org/show_bug.cgi?id=1184500
- https://bugzilla.mozilla.org/show_bug.cgi?id=1184500
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-4483
Mozilla Firefox before 40.0 allows man-in-the-middle attackers to bypass a mixed-content protection mechanism via a feed: URL in a POST request.
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1390
- http://www.mozilla.org/security/announce/2015/mfsa2015-86.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-86.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 76510
- 76510
- 1033247
- 1033247
- https://bugzilla.mozilla.org/show_bug.cgi?id=1148732
- https://bugzilla.mozilla.org/show_bug.cgi?id=1148732
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-4484
The js::jit::AssemblerX86Shared::lock_addl function in the JavaScript implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to cause a denial of service (application crash) by leveraging the use of shared memory and accessing (1) an Atomics object or (2) a SharedArrayBuffer object.
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1390
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- SUSE-SU-2015:1528
- SUSE-SU-2015:1528
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1454
- openSUSE-SU-2015:1454
- RHSA-2015:1586
- RHSA-2015:1586
- DSA-3333
- DSA-3333
- http://www.mozilla.org/security/announce/2015/mfsa2015-87.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-87.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1033247
- 1033247
- USN-2702-1
- USN-2702-1
- USN-2702-2
- USN-2702-2
- USN-2702-3
- USN-2702-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1171540
- https://bugzilla.mozilla.org/show_bug.cgi?id=1171540
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-4485
Heap-based buffer overflow in the resize_context_buffers function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via malformed WebM video data.
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1390
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- SUSE-SU-2015:1528
- SUSE-SU-2015:1528
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1454
- openSUSE-SU-2015:1454
- RHSA-2015:1586
- RHSA-2015:1586
- http://www.mozilla.org/security/announce/2015/mfsa2015-89.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-89.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1033247
- 1033247
- USN-2702-1
- USN-2702-1
- USN-2702-2
- USN-2702-2
- USN-2702-3
- USN-2702-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1177948
- https://bugzilla.mozilla.org/show_bug.cgi?id=1177948
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-4486
The decrease_ref_count function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via malformed WebM video data.
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1390
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- SUSE-SU-2015:1528
- SUSE-SU-2015:1528
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1454
- openSUSE-SU-2015:1454
- RHSA-2015:1586
- RHSA-2015:1586
- http://www.mozilla.org/security/announce/2015/mfsa2015-89.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-89.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1033247
- 1033247
- USN-2702-1
- USN-2702-1
- USN-2702-2
- USN-2702-2
- USN-2702-3
- USN-2702-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1178148
- https://bugzilla.mozilla.org/show_bug.cgi?id=1178148
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-4487
The nsTSubstring::ReplacePrep function in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, related to an "overflow."
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1390
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- SUSE-SU-2015:1528
- SUSE-SU-2015:1528
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1454
- openSUSE-SU-2015:1454
- RHSA-2015:1586
- RHSA-2015:1586
- RHSA-2015:1682
- RHSA-2015:1682
- DSA-3333
- DSA-3333
- DSA-3410
- DSA-3410
- http://www.mozilla.org/security/announce/2015/mfsa2015-90.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-90.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1033247
- 1033247
- 1033372
- 1033372
- USN-2702-1
- USN-2702-1
- USN-2702-2
- USN-2702-2
- USN-2702-3
- USN-2702-3
- USN-2712-1
- USN-2712-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1171603
- https://bugzilla.mozilla.org/show_bug.cgi?id=1171603
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-4488
Use-after-free vulnerability in the StyleAnimationValue class in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 allows remote attackers to have an unspecified impact by leveraging a StyleAnimationValue::operator self assignment.
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1390
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- SUSE-SU-2015:1528
- SUSE-SU-2015:1528
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1454
- openSUSE-SU-2015:1454
- RHSA-2015:1586
- RHSA-2015:1586
- RHSA-2015:1682
- RHSA-2015:1682
- DSA-3333
- DSA-3333
- DSA-3410
- DSA-3410
- http://www.mozilla.org/security/announce/2015/mfsa2015-90.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-90.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1033247
- 1033247
- 1033372
- 1033372
- USN-2702-1
- USN-2702-1
- USN-2702-2
- USN-2702-2
- USN-2702-3
- USN-2702-3
- USN-2712-1
- USN-2712-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1176270
- https://bugzilla.mozilla.org/show_bug.cgi?id=1176270
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-4489
The nsTArray_Impl class in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging a self assignment.
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1390
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- SUSE-SU-2015:1528
- SUSE-SU-2015:1528
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1454
- openSUSE-SU-2015:1454
- RHSA-2015:1586
- RHSA-2015:1586
- RHSA-2015:1682
- RHSA-2015:1682
- DSA-3333
- DSA-3333
- DSA-3410
- DSA-3410
- http://www.mozilla.org/security/announce/2015/mfsa2015-90.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-90.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1033247
- 1033247
- 1033372
- 1033372
- USN-2702-1
- USN-2702-1
- USN-2702-2
- USN-2702-2
- USN-2702-3
- USN-2702-3
- USN-2712-1
- USN-2712-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1182723
- https://bugzilla.mozilla.org/show_bug.cgi?id=1182723
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-4490
The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not implement the Content Security Policy Level 2 exceptions for the blob, data, and filesystem URL schemes during wildcard source-expression matching, which might make it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging unexpected policy-enforcement behavior.
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1390
- http://www.mozilla.org/security/announce/2015/mfsa2015-91.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-91.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1033247
- 1033247
- USN-2702-1
- USN-2702-1
- USN-2702-2
- USN-2702-2
- USN-2702-3
- USN-2702-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1086999
- https://bugzilla.mozilla.org/show_bug.cgi?id=1086999
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-4492
Use-after-free vulnerability in the XMLHttpRequest::Open implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 might allow remote attackers to execute arbitrary code via a SharedWorker object that makes recursive calls to the open method of an XMLHttpRequest object.
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1390
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- SUSE-SU-2015:1528
- SUSE-SU-2015:1528
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1454
- openSUSE-SU-2015:1454
- RHSA-2015:1586
- RHSA-2015:1586
- DSA-3333
- DSA-3333
- http://www.mozilla.org/security/announce/2015/mfsa2015-92.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-92.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 76297
- 76297
- 1033247
- 1033247
- USN-2702-1
- USN-2702-1
- USN-2702-2
- USN-2702-2
- USN-2702-3
- USN-2702-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1185820
- https://bugzilla.mozilla.org/show_bug.cgi?id=1185820
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-4493
Heap-based buffer overflow in the stagefright::ESDS::parseESDescriptor function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via an invalid size field in an esds chunk in MPEG-4 video data, a related issue to CVE-2015-1539.
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1453
- openSUSE-SU-2015:1454
- openSUSE-SU-2015:1454
- RHSA-2015:1586
- RHSA-2015:1586
- DSA-3333
- DSA-3333
- http://www.mozilla.org/security/announce/2015/mfsa2015-83.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-83.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1033247
- 1033247
- USN-2702-1
- USN-2702-1
- USN-2702-2
- USN-2702-2
- USN-2702-3
- USN-2702-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1186718
- https://bugzilla.mozilla.org/show_bug.cgi?id=1186718
- https://hg.mozilla.org/mozilla-central/rev/a674c7019cb5
- https://hg.mozilla.org/mozilla-central/rev/a674c7019cb5
- GLSA-201605-06
- GLSA-201605-06
Modified: 2025-03-21
CVE-2015-4495
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.
- SUSE-SU-2015:1379
- SUSE-SU-2015:1379
- SUSE-SU-2015:1380
- SUSE-SU-2015:1380
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1389
- openSUSE-SU-2015:1390
- openSUSE-SU-2015:1390
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- SUSE-SU-2015:1528
- SUSE-SU-2015:1528
- RHSA-2015:1581
- RHSA-2015:1581
- http://www.mozilla.org/security/announce/2015/mfsa2015-78.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-78.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 76249
- 76249
- 1033216
- 1033216
- USN-2707-1
- USN-2707-1
- https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/
- https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1178058
- https://bugzilla.mozilla.org/show_bug.cgi?id=1178058
- https://bugzilla.mozilla.org/show_bug.cgi?id=1179262
- https://bugzilla.mozilla.org/show_bug.cgi?id=1179262
- GLSA-201512-10
- GLSA-201512-10
- 37772
- 37772
Modified: 2024-11-21
CVE-2015-4496
Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file, a related issue to CVE-2015-1538.
- http://www.mozilla.org/security/announce/2015/mfsa2015-93.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-93.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1149605
- https://bugzilla.mozilla.org/show_bug.cgi?id=1149605
- https://hg.mozilla.org/mozilla-central/rev/87277085561a
- https://hg.mozilla.org/mozilla-central/rev/87277085561a
Modified: 2024-11-21
CVE-2015-4498
The add-on installation feature in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to bypass an intended user-confirmation requirement by constructing a crafted data: URL and triggering navigation to an arbitrary http: or https: URL at a certain early point in the installation process.
- SUSE-SU-2015:1504
- SUSE-SU-2015:1504
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:1492
- openSUSE-SU-2015:1492
- RHSA-2015:1693
- RHSA-2015:1693
- DSA-3345
- DSA-3345
- http://www.mozilla.org/security/announce/2015/mfsa2015-95.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-95.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 76505
- 76505
- 1033396
- 1033396
- USN-2723-1
- USN-2723-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1042699
- https://bugzilla.mozilla.org/show_bug.cgi?id=1042699
Modified: 2024-11-21
CVE-2015-4500
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1679
- openSUSE-SU-2015:1679
- SUSE-SU-2015:1680
- SUSE-SU-2015:1680
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- SUSE-SU-2015:1703
- SUSE-SU-2015:1703
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- RHSA-2015:1834
- RHSA-2015:1834
- RHSA-2015:1852
- RHSA-2015:1852
- DSA-3365
- DSA-3365
- http://www.mozilla.org/security/announce/2015/mfsa2015-96.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-96.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 76816
- 76816
- 1033640
- 1033640
- USN-2743-1
- USN-2743-1
- USN-2743-2
- USN-2743-2
- USN-2743-3
- USN-2743-3
- USN-2743-4
- USN-2743-4
- USN-2754-1
- USN-2754-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1044077
- https://bugzilla.mozilla.org/show_bug.cgi?id=1044077
- https://bugzilla.mozilla.org/show_bug.cgi?id=1152026
- https://bugzilla.mozilla.org/show_bug.cgi?id=1152026
- https://bugzilla.mozilla.org/show_bug.cgi?id=1161063
- https://bugzilla.mozilla.org/show_bug.cgi?id=1161063
- https://bugzilla.mozilla.org/show_bug.cgi?id=1181651
- https://bugzilla.mozilla.org/show_bug.cgi?id=1181651
- https://bugzilla.mozilla.org/show_bug.cgi?id=1183153
- https://bugzilla.mozilla.org/show_bug.cgi?id=1183153
- https://bugzilla.mozilla.org/show_bug.cgi?id=1186962
- https://bugzilla.mozilla.org/show_bug.cgi?id=1186962
- https://bugzilla.mozilla.org/show_bug.cgi?id=1201793
- https://bugzilla.mozilla.org/show_bug.cgi?id=1201793
- https://bugzilla.mozilla.org/show_bug.cgi?id=1202844
- https://bugzilla.mozilla.org/show_bug.cgi?id=1202844
Modified: 2024-11-21
CVE-2015-4501
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 41.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- SUSE-SU-2015:1680
- SUSE-SU-2015:1680
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- SUSE-SU-2015:1703
- SUSE-SU-2015:1703
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- http://www.mozilla.org/security/announce/2015/mfsa2015-96.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-96.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 76816
- 76816
- 1033640
- 1033640
- USN-2743-1
- USN-2743-1
- USN-2743-2
- USN-2743-2
- USN-2743-3
- USN-2743-3
- USN-2743-4
- USN-2743-4
- https://bugzilla.mozilla.org/show_bug.cgi?id=1165706
- https://bugzilla.mozilla.org/show_bug.cgi?id=1165706
- https://bugzilla.mozilla.org/show_bug.cgi?id=1186657
- https://bugzilla.mozilla.org/show_bug.cgi?id=1186657
Modified: 2024-11-21
CVE-2015-4502
js/src/proxy/Proxy.cpp in Mozilla Firefox before 41.0 mishandles certain receiver arguments, which allows remote attackers to bypass intended window access restrictions via a crafted web site.
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- http://www.mozilla.org/security/announce/2015/mfsa2015-108.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-108.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 76815
- 76815
- 1033640
- 1033640
- USN-2743-1
- USN-2743-1
- USN-2743-2
- USN-2743-2
- USN-2743-3
- USN-2743-3
- USN-2743-4
- USN-2743-4
- https://bugzilla.mozilla.org/show_bug.cgi?id=1105045
- https://bugzilla.mozilla.org/show_bug.cgi?id=1105045
- https://hg.mozilla.org/mozilla-central/rev/dc21224de25b
- https://hg.mozilla.org/mozilla-central/rev/dc21224de25b
Modified: 2024-11-21
CVE-2015-4503
The TCP Socket API implementation in Mozilla Firefox before 41.0 mishandles array boundaries that were established with a navigator.mozTCPSocket.open method call and send method calls, which allows remote TCP servers to obtain sensitive information from process memory by reading packet data, as demonstrated by availability of this API in a Firefox OS application.
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- http://www.mozilla.org/security/announce/2015/mfsa2015-97.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-97.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 76815
- 76815
- 1033640
- 1033640
- https://bugzilla.mozilla.org/show_bug.cgi?id=994337
- https://bugzilla.mozilla.org/show_bug.cgi?id=994337
Modified: 2024-11-21
CVE-2015-4504
The lut_inverse_interp16 function in the QCMS library in Mozilla Firefox before 41.0 allows remote attackers to obtain sensitive information or cause a denial of service (buffer over-read and application crash) via crafted attributes in the ICC 4 profile of an image.
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- http://www.mozilla.org/security/announce/2015/mfsa2015-98.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-98.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 76815
- 76815
- 1033640
- 1033640
- USN-2743-1
- USN-2743-1
- USN-2743-2
- USN-2743-2
- USN-2743-3
- USN-2743-3
- USN-2743-4
- USN-2743-4
- https://bugzilla.mozilla.org/show_bug.cgi?id=1132467
- https://bugzilla.mozilla.org/show_bug.cgi?id=1132467
Modified: 2024-11-21
CVE-2015-4506
Buffer overflow in the vp9_init_context_buffers function in libvpx, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3, allows remote attackers to execute arbitrary code via a crafted VP9 file.
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1679
- openSUSE-SU-2015:1679
- SUSE-SU-2015:1680
- SUSE-SU-2015:1680
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- SUSE-SU-2015:1703
- SUSE-SU-2015:1703
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- RHSA-2015:1834
- RHSA-2015:1834
- DSA-3365
- DSA-3365
- http://www.mozilla.org/security/announce/2015/mfsa2015-101.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-101.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 76816
- 76816
- 1033640
- 1033640
- USN-2743-1
- USN-2743-1
- USN-2743-2
- USN-2743-2
- USN-2743-3
- USN-2743-3
- USN-2743-4
- USN-2743-4
- USN-2754-1
- USN-2754-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1192226
- https://bugzilla.mozilla.org/show_bug.cgi?id=1192226
Modified: 2024-11-21
CVE-2015-4507
The SavedStacks class in the JavaScript implementation in Mozilla Firefox before 41.0, when the Debugger API is enabled, allows remote attackers to cause a denial of service (getSlotRef assertion failure and application exit) or possibly execute arbitrary code via a crafted web site.
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- http://www.mozilla.org/security/announce/2015/mfsa2015-102.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-102.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 76815
- 76815
- 1033640
- 1033640
- USN-2743-1
- USN-2743-1
- USN-2743-2
- USN-2743-2
- USN-2743-3
- USN-2743-3
- USN-2743-4
- USN-2743-4
- https://bugzilla.mozilla.org/show_bug.cgi?id=1192401
- https://bugzilla.mozilla.org/show_bug.cgi?id=1192401
Modified: 2024-11-21
CVE-2015-4508
Mozilla Firefox before 41.0, when reader mode is enabled, allows remote attackers to spoof the relationship between address-bar URLs and web content via a crafted web site.
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- http://www.mozilla.org/security/announce/2015/mfsa2015-103.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-103.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 76815
- 76815
- 1033640
- 1033640
- USN-2743-1
- USN-2743-1
- USN-2743-2
- USN-2743-2
- USN-2743-3
- USN-2743-3
- USN-2743-4
- USN-2743-4
- https://bugzilla.mozilla.org/show_bug.cgi?id=1195976
- https://bugzilla.mozilla.org/show_bug.cgi?id=1195976
Modified: 2024-11-21
CVE-2015-4509
Use-after-free vulnerability in the HTMLVideoElement interface in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via crafted JavaScript code that modifies the URI table of a media element, aka ZDI-CAN-3176.
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1679
- openSUSE-SU-2015:1679
- SUSE-SU-2015:1680
- SUSE-SU-2015:1680
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- SUSE-SU-2015:1703
- SUSE-SU-2015:1703
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- RHSA-2015:1834
- RHSA-2015:1834
- RHSA-2015:1852
- RHSA-2015:1852
- DSA-3365
- DSA-3365
- http://www.mozilla.org/security/announce/2015/mfsa2015-106.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-106.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 76816
- 76816
- 1033640
- 1033640
- USN-2743-1
- USN-2743-1
- USN-2743-2
- USN-2743-2
- USN-2743-3
- USN-2743-3
- USN-2743-4
- USN-2743-4
- USN-2754-1
- USN-2754-1
- http://www.zerodayinitiative.com/advisories/ZDI-15-646
- http://www.zerodayinitiative.com/advisories/ZDI-15-646
- https://bugzilla.mozilla.org/show_bug.cgi?id=1198435
- https://bugzilla.mozilla.org/show_bug.cgi?id=1198435
Modified: 2024-11-21
CVE-2015-4510
Race condition in the WorkerPrivate::NotifyFeatures function in Mozilla Firefox before 41.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) by leveraging improper interaction between shared workers and the IndexedDB implementation.
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- http://www.mozilla.org/security/announce/2015/mfsa2015-104.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-104.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 76815
- 76815
- 1033640
- 1033640
- USN-2743-1
- USN-2743-1
- USN-2743-2
- USN-2743-2
- USN-2743-3
- USN-2743-3
- USN-2743-4
- USN-2743-4
- https://bugzilla.mozilla.org/show_bug.cgi?id=1200004
- https://bugzilla.mozilla.org/show_bug.cgi?id=1200004
Modified: 2024-11-21
CVE-2015-4511
Heap-based buffer overflow in the nestegg_track_codec_data function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via a crafted header in a WebM video.
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1679
- openSUSE-SU-2015:1679
- SUSE-SU-2015:1680
- SUSE-SU-2015:1680
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- SUSE-SU-2015:1703
- SUSE-SU-2015:1703
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- RHSA-2015:1834
- RHSA-2015:1834
- DSA-3365
- DSA-3365
- http://www.mozilla.org/security/announce/2015/mfsa2015-105.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-105.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 76816
- 76816
- 1033640
- 1033640
- USN-2754-1
- USN-2754-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1200148
- https://bugzilla.mozilla.org/show_bug.cgi?id=1200148
Modified: 2024-11-21
CVE-2015-4513
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- SUSE-SU-2015:1926
- SUSE-SU-2015:1926
- openSUSE-SU-2015:1942
- openSUSE-SU-2015:1942
- SUSE-SU-2015:1978
- SUSE-SU-2015:1978
- SUSE-SU-2015:1981
- SUSE-SU-2015:1981
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2245
- openSUSE-SU-2015:2245
- RHSA-2015:1982
- RHSA-2015:1982
- RHSA-2015:2519
- RHSA-2015:2519
- DSA-3393
- DSA-3393
- DSA-3410
- DSA-3410
- http://www.mozilla.org/security/announce/2015/mfsa2015-116.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-116.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 77411
- 77411
- 1034069
- 1034069
- USN-2785-1
- USN-2785-1
- USN-2819-1
- USN-2819-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1107011
- https://bugzilla.mozilla.org/show_bug.cgi?id=1107011
- https://bugzilla.mozilla.org/show_bug.cgi?id=1191942
- https://bugzilla.mozilla.org/show_bug.cgi?id=1191942
- https://bugzilla.mozilla.org/show_bug.cgi?id=1193038
- https://bugzilla.mozilla.org/show_bug.cgi?id=1193038
- https://bugzilla.mozilla.org/show_bug.cgi?id=1204580
- https://bugzilla.mozilla.org/show_bug.cgi?id=1204580
- https://bugzilla.mozilla.org/show_bug.cgi?id=1204669
- https://bugzilla.mozilla.org/show_bug.cgi?id=1204669
- https://bugzilla.mozilla.org/show_bug.cgi?id=1204700
- https://bugzilla.mozilla.org/show_bug.cgi?id=1204700
- https://bugzilla.mozilla.org/show_bug.cgi?id=1205707
- https://bugzilla.mozilla.org/show_bug.cgi?id=1205707
- https://bugzilla.mozilla.org/show_bug.cgi?id=1206564
- https://bugzilla.mozilla.org/show_bug.cgi?id=1206564
- https://bugzilla.mozilla.org/show_bug.cgi?id=1208665
- https://bugzilla.mozilla.org/show_bug.cgi?id=1208665
- https://bugzilla.mozilla.org/show_bug.cgi?id=1209471
- https://bugzilla.mozilla.org/show_bug.cgi?id=1209471
- https://bugzilla.mozilla.org/show_bug.cgi?id=1213979
- https://bugzilla.mozilla.org/show_bug.cgi?id=1213979
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-4514
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 42.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2015:1942
- openSUSE-SU-2015:1942
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2245
- openSUSE-SU-2015:2245
- http://www.mozilla.org/security/announce/2015/mfsa2015-116.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-116.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 77411
- 77411
- 1034069
- 1034069
- USN-2785-1
- USN-2785-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1185157
- https://bugzilla.mozilla.org/show_bug.cgi?id=1185157
- https://bugzilla.mozilla.org/show_bug.cgi?id=1186160
- https://bugzilla.mozilla.org/show_bug.cgi?id=1186160
- https://bugzilla.mozilla.org/show_bug.cgi?id=1196237
- https://bugzilla.mozilla.org/show_bug.cgi?id=1196237
- https://bugzilla.mozilla.org/show_bug.cgi?id=1200326
- https://bugzilla.mozilla.org/show_bug.cgi?id=1200326
- https://bugzilla.mozilla.org/show_bug.cgi?id=1202677
- https://bugzilla.mozilla.org/show_bug.cgi?id=1202677
- https://bugzilla.mozilla.org/show_bug.cgi?id=1205937
- https://bugzilla.mozilla.org/show_bug.cgi?id=1205937
- https://bugzilla.mozilla.org/show_bug.cgi?id=969309
- https://bugzilla.mozilla.org/show_bug.cgi?id=969309
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-4515
Mozilla Firefox before 42.0, when NTLM v1 is enabled for HTTP authentication, allows remote attackers to obtain sensitive hostname information by constructing a crafted web site that sends an NTLM request and reads the Workstation field of an NTLM type 3 message.
- openSUSE-SU-2015:1942
- openSUSE-SU-2015:1942
- http://www.mozilla.org/security/announce/2015/mfsa2015-117.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-117.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1034069
- 1034069
- USN-2785-1
- USN-2785-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1046421
- https://bugzilla.mozilla.org/show_bug.cgi?id=1046421
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-4516
Mozilla Firefox before 41.0 allows remote attackers to bypass certain ECMAScript 5 (aka ES5) API protection mechanisms and modify immutable properties, and consequently execute arbitrary JavaScript code with chrome privileges, via a crafted web page that does not use ES5 APIs.
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- http://www.mozilla.org/security/announce/2015/mfsa2015-109.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-109.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 76815
- 76815
- 1033640
- 1033640
- USN-2743-1
- USN-2743-1
- USN-2743-2
- USN-2743-2
- USN-2743-3
- USN-2743-3
- USN-2743-4
- USN-2743-4
- https://bugzilla.mozilla.org/show_bug.cgi?id=904886
- https://bugzilla.mozilla.org/show_bug.cgi?id=904886
Modified: 2024-11-21
CVE-2015-4517
NetworkUtils.cpp in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1679
- openSUSE-SU-2015:1679
- SUSE-SU-2015:1680
- SUSE-SU-2015:1680
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- SUSE-SU-2015:1703
- SUSE-SU-2015:1703
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- RHSA-2015:1834
- RHSA-2015:1834
- RHSA-2015:1852
- RHSA-2015:1852
- DSA-3365
- DSA-3365
- http://www.mozilla.org/security/announce/2015/mfsa2015-112.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-112.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 76816
- 76816
- 1033640
- 1033640
- USN-2743-1
- USN-2743-1
- USN-2743-2
- USN-2743-2
- USN-2743-3
- USN-2743-3
- USN-2743-4
- USN-2743-4
- USN-2754-1
- USN-2754-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1168959
- https://bugzilla.mozilla.org/show_bug.cgi?id=1168959
Modified: 2024-11-21
CVE-2015-4518
The Reader View implementation in Mozilla Firefox before 42.0 has an improper whitelist, which makes it easier for remote attackers to bypass the Content Security Policy (CSP) protection mechanism and conduct cross-site scripting (XSS) attacks via vectors involving SVG animations and the about:reader URL.
- openSUSE-SU-2015:1942
- openSUSE-SU-2015:1942
- http://www.mozilla.org/security/announce/2015/mfsa2015-118.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-118.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1034069
- 1034069
- USN-2785-1
- USN-2785-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1136692
- https://bugzilla.mozilla.org/show_bug.cgi?id=1136692
- https://bugzilla.mozilla.org/show_bug.cgi?id=1182778
- https://bugzilla.mozilla.org/show_bug.cgi?id=1182778
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-4519
Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow user-assisted remote attackers to bypass intended access restrictions and discover a redirect's target URL via crafted JavaScript code that executes after a drag-and-drop action of an image into a TEXTBOX element.
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1679
- openSUSE-SU-2015:1679
- SUSE-SU-2015:1680
- SUSE-SU-2015:1680
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- SUSE-SU-2015:1703
- SUSE-SU-2015:1703
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- RHSA-2015:1834
- RHSA-2015:1834
- RHSA-2015:1852
- RHSA-2015:1852
- DSA-3365
- DSA-3365
- http://www.mozilla.org/security/announce/2015/mfsa2015-110.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-110.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 76816
- 76816
- 1033640
- 1033640
- USN-2743-1
- USN-2743-1
- USN-2743-2
- USN-2743-2
- USN-2743-3
- USN-2743-3
- USN-2743-4
- USN-2743-4
- USN-2754-1
- USN-2754-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1189814
- https://bugzilla.mozilla.org/show_bug.cgi?id=1189814
Modified: 2024-11-21
CVE-2015-4520
Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass CORS preflight protection mechanisms by leveraging (1) duplicate cache-key generation or (2) retrieval of a value from an incorrect HTTP Access-Control-* response header.
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1679
- openSUSE-SU-2015:1679
- SUSE-SU-2015:1680
- SUSE-SU-2015:1680
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- SUSE-SU-2015:1703
- SUSE-SU-2015:1703
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- RHSA-2015:1834
- RHSA-2015:1834
- RHSA-2015:1852
- RHSA-2015:1852
- DSA-3365
- DSA-3365
- http://www.mozilla.org/security/announce/2015/mfsa2015-111.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-111.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 76816
- 76816
- 1033640
- 1033640
- USN-2743-1
- USN-2743-1
- USN-2743-2
- USN-2743-2
- USN-2743-3
- USN-2743-3
- USN-2743-4
- USN-2743-4
- USN-2754-1
- USN-2754-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1200856
- https://bugzilla.mozilla.org/show_bug.cgi?id=1200856
- https://bugzilla.mozilla.org/show_bug.cgi?id=1200869
- https://bugzilla.mozilla.org/show_bug.cgi?id=1200869
Modified: 2024-11-21
CVE-2015-4521
The ConvertDialogOptions function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1679
- openSUSE-SU-2015:1679
- SUSE-SU-2015:1680
- SUSE-SU-2015:1680
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- SUSE-SU-2015:1703
- SUSE-SU-2015:1703
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- RHSA-2015:1834
- RHSA-2015:1834
- RHSA-2015:1852
- RHSA-2015:1852
- DSA-3365
- DSA-3365
- http://www.mozilla.org/security/announce/2015/mfsa2015-112.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-112.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 76816
- 76816
- 1033640
- 1033640
- USN-2743-1
- USN-2743-1
- USN-2743-2
- USN-2743-2
- USN-2743-3
- USN-2743-3
- USN-2743-4
- USN-2743-4
- USN-2754-1
- USN-2754-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1170246
- https://bugzilla.mozilla.org/show_bug.cgi?id=1170246
Modified: 2024-11-21
CVE-2015-4522
The nsUnicodeToUTF8::GetMaxLength function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow."
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1679
- openSUSE-SU-2015:1679
- SUSE-SU-2015:1680
- SUSE-SU-2015:1680
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- SUSE-SU-2015:1703
- SUSE-SU-2015:1703
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- RHSA-2015:1834
- RHSA-2015:1834
- RHSA-2015:1852
- RHSA-2015:1852
- DSA-3365
- DSA-3365
- http://www.mozilla.org/security/announce/2015/mfsa2015-112.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-112.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 76816
- 76816
- 1033640
- 1033640
- USN-2743-1
- USN-2743-1
- USN-2743-2
- USN-2743-2
- USN-2743-3
- USN-2743-3
- USN-2743-4
- USN-2743-4
- USN-2754-1
- USN-2754-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1170794
- https://bugzilla.mozilla.org/show_bug.cgi?id=1170794
Modified: 2024-11-21
CVE-2015-7174
The nsAttrAndChildArray::GrowBy function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow."
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1679
- openSUSE-SU-2015:1679
- SUSE-SU-2015:1680
- SUSE-SU-2015:1680
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- SUSE-SU-2015:1703
- SUSE-SU-2015:1703
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- RHSA-2015:1834
- RHSA-2015:1834
- RHSA-2015:1852
- RHSA-2015:1852
- DSA-3365
- DSA-3365
- http://www.mozilla.org/security/announce/2015/mfsa2015-112.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-112.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 76816
- 76816
- 1033640
- 1033640
- USN-2743-1
- USN-2743-1
- USN-2743-2
- USN-2743-2
- USN-2743-3
- USN-2743-3
- USN-2743-4
- USN-2743-4
- USN-2754-1
- USN-2754-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1172055
- https://bugzilla.mozilla.org/show_bug.cgi?id=1172055
Modified: 2024-11-21
CVE-2015-7175
The XULContentSinkImpl::AddText function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow."
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1679
- openSUSE-SU-2015:1679
- SUSE-SU-2015:1680
- SUSE-SU-2015:1680
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- SUSE-SU-2015:1703
- SUSE-SU-2015:1703
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- RHSA-2015:1834
- RHSA-2015:1834
- RHSA-2015:1852
- RHSA-2015:1852
- DSA-3365
- DSA-3365
- http://www.mozilla.org/security/announce/2015/mfsa2015-112.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-112.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 76816
- 76816
- 1033640
- 1033640
- USN-2743-1
- USN-2743-1
- USN-2743-2
- USN-2743-2
- USN-2743-3
- USN-2743-3
- USN-2743-4
- USN-2743-4
- USN-2754-1
- USN-2754-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1172189
- https://bugzilla.mozilla.org/show_bug.cgi?id=1172189
Modified: 2024-11-21
CVE-2015-7176
The AnimationThread function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 uses an incorrect argument to the sscanf function, which might allow remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via unknown vectors.
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1679
- openSUSE-SU-2015:1679
- SUSE-SU-2015:1680
- SUSE-SU-2015:1680
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- SUSE-SU-2015:1703
- SUSE-SU-2015:1703
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- RHSA-2015:1834
- RHSA-2015:1834
- RHSA-2015:1852
- RHSA-2015:1852
- DSA-3365
- DSA-3365
- http://www.mozilla.org/security/announce/2015/mfsa2015-112.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-112.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 76816
- 76816
- 1033640
- 1033640
- USN-2743-1
- USN-2743-1
- USN-2743-2
- USN-2743-2
- USN-2743-3
- USN-2743-3
- USN-2743-4
- USN-2743-4
- USN-2754-1
- USN-2754-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1174479
- https://bugzilla.mozilla.org/show_bug.cgi?id=1174479
Modified: 2024-11-21
CVE-2015-7177
The InitTextures function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1679
- openSUSE-SU-2015:1679
- SUSE-SU-2015:1680
- SUSE-SU-2015:1680
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- SUSE-SU-2015:1703
- SUSE-SU-2015:1703
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- RHSA-2015:1834
- RHSA-2015:1834
- RHSA-2015:1852
- RHSA-2015:1852
- DSA-3365
- DSA-3365
- http://www.mozilla.org/security/announce/2015/mfsa2015-112.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-112.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 76816
- 76816
- 1033640
- 1033640
- USN-2743-1
- USN-2743-1
- USN-2743-2
- USN-2743-2
- USN-2743-3
- USN-2743-3
- USN-2743-4
- USN-2743-4
- USN-2754-1
- USN-2754-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1186725
- https://bugzilla.mozilla.org/show_bug.cgi?id=1186725
Modified: 2024-11-21
CVE-2015-7180
The ReadbackResultWriterD3D11::Run function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 misinterprets the return value of a function call, which might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1658
- openSUSE-SU-2015:1679
- openSUSE-SU-2015:1679
- SUSE-SU-2015:1680
- SUSE-SU-2015:1680
- openSUSE-SU-2015:1681
- openSUSE-SU-2015:1681
- SUSE-SU-2015:1703
- SUSE-SU-2015:1703
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- RHSA-2015:1834
- RHSA-2015:1834
- RHSA-2015:1852
- RHSA-2015:1852
- DSA-3365
- DSA-3365
- http://www.mozilla.org/security/announce/2015/mfsa2015-112.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-112.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 76816
- 76816
- 1033640
- 1033640
- USN-2743-1
- USN-2743-1
- USN-2743-2
- USN-2743-2
- USN-2743-3
- USN-2743-3
- USN-2743-4
- USN-2743-4
- USN-2754-1
- USN-2754-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1191463
- https://bugzilla.mozilla.org/show_bug.cgi?id=1191463
Modified: 2024-11-21
CVE-2015-7181
The sec_asn1d_parse_leaf function in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, improperly restricts access to an unspecified data structure, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data, related to a "use-after-poison" issue.
- SUSE-SU-2015:1926
- SUSE-SU-2015:1926
- openSUSE-SU-2015:1942
- openSUSE-SU-2015:1942
- SUSE-SU-2015:1978
- SUSE-SU-2015:1978
- SUSE-SU-2015:1981
- SUSE-SU-2015:1981
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2245
- openSUSE-SU-2015:2245
- http://packetstormsecurity.com/files/134268/Slackware-Security-Advisory-mozilla-nss-Updates.html
- http://packetstormsecurity.com/files/134268/Slackware-Security-Advisory-mozilla-nss-Updates.html
- RHSA-2015:1980
- RHSA-2015:1980
- RHSA-2015:1981
- RHSA-2015:1981
- DSA-3393
- DSA-3393
- DSA-3410
- DSA-3410
- DSA-3688
- DSA-3688
- http://www.mozilla.org/security/announce/2015/mfsa2015-133.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-133.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- 77416
- 77416
- 91787
- 91787
- 1034069
- 1034069
- SSA:2015-310-02
- SSA:2015-310-02
- USN-2785-1
- USN-2785-1
- USN-2791-1
- USN-2791-1
- USN-2819-1
- USN-2819-1
- https://bto.bluecoat.com/security-advisory/sa119
- https://bto.bluecoat.com/security-advisory/sa119
- https://bugzilla.mozilla.org/show_bug.cgi?id=1192028
- https://bugzilla.mozilla.org/show_bug.cgi?id=1192028
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.2.1_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.2.1_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.4_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.4_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.20.1_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.20.1_release_notes
- GLSA-201512-10
- GLSA-201512-10
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-7182
Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.
- SUSE-SU-2015:1926
- SUSE-SU-2015:1926
- openSUSE-SU-2015:1942
- openSUSE-SU-2015:1942
- SUSE-SU-2015:1978
- SUSE-SU-2015:1978
- SUSE-SU-2015:1981
- SUSE-SU-2015:1981
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2245
- openSUSE-SU-2015:2245
- http://packetstormsecurity.com/files/134268/Slackware-Security-Advisory-mozilla-nss-Updates.html
- http://packetstormsecurity.com/files/134268/Slackware-Security-Advisory-mozilla-nss-Updates.html
- RHSA-2015:1980
- RHSA-2015:1980
- RHSA-2015:1981
- RHSA-2015:1981
- DSA-3393
- DSA-3393
- DSA-3410
- DSA-3410
- DSA-3688
- DSA-3688
- http://www.mozilla.org/security/announce/2015/mfsa2015-133.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-133.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- 77416
- 77416
- 91787
- 91787
- 1034069
- 1034069
- SSA:2015-310-02
- SSA:2015-310-02
- USN-2785-1
- USN-2785-1
- USN-2791-1
- USN-2791-1
- USN-2819-1
- USN-2819-1
- https://bto.bluecoat.com/security-advisory/sa119
- https://bto.bluecoat.com/security-advisory/sa119
- https://bugzilla.mozilla.org/show_bug.cgi?id=1202868
- https://bugzilla.mozilla.org/show_bug.cgi?id=1202868
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.2.1_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.2.1_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.4_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.4_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.20.1_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.20.1_release_notes
- GLSA-201512-10
- GLSA-201512-10
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-7183
Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.
- SUSE-SU-2015:1926
- SUSE-SU-2015:1926
- openSUSE-SU-2015:1942
- openSUSE-SU-2015:1942
- SUSE-SU-2015:1978
- SUSE-SU-2015:1978
- SUSE-SU-2015:1981
- SUSE-SU-2015:1981
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2245
- openSUSE-SU-2015:2245
- http://packetstormsecurity.com/files/134268/Slackware-Security-Advisory-mozilla-nss-Updates.html
- http://packetstormsecurity.com/files/134268/Slackware-Security-Advisory-mozilla-nss-Updates.html
- RHSA-2015:1980
- RHSA-2015:1980
- RHSA-2015:1981
- RHSA-2015:1981
- DSA-3393
- DSA-3393
- DSA-3406
- DSA-3406
- http://www.mozilla.org/security/announce/2015/mfsa2015-133.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-133.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- 77415
- 77415
- 91787
- 91787
- 1034069
- 1034069
- SSA:2015-310-02
- SSA:2015-310-02
- USN-2785-1
- USN-2785-1
- USN-2790-1
- USN-2790-1
- USN-2819-1
- USN-2819-1
- https://bto.bluecoat.com/security-advisory/sa119
- https://bto.bluecoat.com/security-advisory/sa119
- https://bugzilla.mozilla.org/show_bug.cgi?id=1205157
- https://bugzilla.mozilla.org/show_bug.cgi?id=1205157
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.2.1_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.2.1_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.4_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.4_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.20.1_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.20.1_release_notes
- GLSA-201512-10
- GLSA-201512-10
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2015-7184
The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
- openSUSE-SU-2015:1817
- openSUSE-SU-2015:1817
- http://www.mozilla.org/security/announce/2015/mfsa2015-115.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-115.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 77100
- 77100
- 1033820
- 1033820
- USN-2768-1
- USN-2768-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1208339
- https://bugzilla.mozilla.org/show_bug.cgi?id=1208339
- https://bugzilla.mozilla.org/show_bug.cgi?id=1212669
- https://bugzilla.mozilla.org/show_bug.cgi?id=1212669
Modified: 2024-11-21
CVE-2015-7187
The Add-on SDK in Mozilla Firefox before 42.0 misinterprets a "script: false" panel setting, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via inline JavaScript code that is executed within a third-party extension.
- openSUSE-SU-2015:1942
- openSUSE-SU-2015:1942
- http://www.mozilla.org/security/announce/2015/mfsa2015-121.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-121.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1034069
- 1034069
- USN-2785-1
- USN-2785-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1195735
- https://bugzilla.mozilla.org/show_bug.cgi?id=1195735
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7188
Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to bypass the Same Origin Policy for an IP address origin, and conduct cross-site scripting (XSS) attacks, by appending whitespace characters to an IP address string.
- SUSE-SU-2015:1926
- SUSE-SU-2015:1926
- openSUSE-SU-2015:1942
- openSUSE-SU-2015:1942
- SUSE-SU-2015:1978
- SUSE-SU-2015:1978
- SUSE-SU-2015:1981
- SUSE-SU-2015:1981
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2245
- openSUSE-SU-2015:2245
- RHSA-2015:1982
- RHSA-2015:1982
- DSA-3393
- DSA-3393
- DSA-3410
- DSA-3410
- http://www.mozilla.org/security/announce/2015/mfsa2015-122.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-122.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 77411
- 77411
- 1034069
- 1034069
- USN-2785-1
- USN-2785-1
- USN-2819-1
- USN-2819-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1199430
- https://bugzilla.mozilla.org/show_bug.cgi?id=1199430
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7189
Race condition in the JPEGEncoder function in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via vectors involving a CANVAS element and crafted JavaScript code.
- SUSE-SU-2015:1926
- SUSE-SU-2015:1926
- openSUSE-SU-2015:1942
- openSUSE-SU-2015:1942
- SUSE-SU-2015:1978
- SUSE-SU-2015:1978
- SUSE-SU-2015:1981
- SUSE-SU-2015:1981
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2245
- openSUSE-SU-2015:2245
- RHSA-2015:1982
- RHSA-2015:1982
- RHSA-2015:2519
- RHSA-2015:2519
- DSA-3393
- DSA-3393
- DSA-3410
- DSA-3410
- http://www.mozilla.org/security/announce/2015/mfsa2015-123.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-123.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 77411
- 77411
- 1034069
- 1034069
- USN-2785-1
- USN-2785-1
- USN-2819-1
- USN-2819-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1205900
- https://bugzilla.mozilla.org/show_bug.cgi?id=1205900
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7193
Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly follow the CORS cross-origin request algorithm for the POST method in situations involving an unspecified Content-Type header manipulation, which allows remote attackers to bypass the Same Origin Policy by leveraging the lack of a preflight-request step.
- SUSE-SU-2015:1926
- SUSE-SU-2015:1926
- openSUSE-SU-2015:1942
- openSUSE-SU-2015:1942
- SUSE-SU-2015:1978
- SUSE-SU-2015:1978
- SUSE-SU-2015:1981
- SUSE-SU-2015:1981
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2245
- openSUSE-SU-2015:2245
- RHSA-2015:1982
- RHSA-2015:1982
- RHSA-2015:2519
- RHSA-2015:2519
- DSA-3393
- DSA-3393
- DSA-3410
- DSA-3410
- http://www.mozilla.org/security/announce/2015/mfsa2015-127.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-127.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 77411
- 77411
- 1034069
- 1034069
- USN-2785-1
- USN-2785-1
- USN-2819-1
- USN-2819-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1210302
- https://bugzilla.mozilla.org/show_bug.cgi?id=1210302
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7194
Buffer underflow in libjar in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ZIP archive.
- SUSE-SU-2015:1926
- SUSE-SU-2015:1926
- openSUSE-SU-2015:1942
- openSUSE-SU-2015:1942
- SUSE-SU-2015:1978
- SUSE-SU-2015:1978
- SUSE-SU-2015:1981
- SUSE-SU-2015:1981
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2245
- openSUSE-SU-2015:2245
- RHSA-2015:1982
- RHSA-2015:1982
- DSA-3393
- DSA-3393
- DSA-3410
- DSA-3410
- http://www.mozilla.org/security/announce/2015/mfsa2015-128.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-128.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 77411
- 77411
- 1034069
- 1034069
- USN-2785-1
- USN-2785-1
- USN-2819-1
- USN-2819-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1211262
- https://bugzilla.mozilla.org/show_bug.cgi?id=1211262
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7195
The URL parsing implementation in Mozilla Firefox before 42.0 improperly recognizes escaped characters in hostnames within Location headers, which allows remote attackers to obtain sensitive information via vectors involving a redirect.
- openSUSE-SU-2015:1942
- openSUSE-SU-2015:1942
- http://www.mozilla.org/security/announce/2015/mfsa2015-129.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-129.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1034069
- 1034069
- USN-2785-1
- USN-2785-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1211871
- https://bugzilla.mozilla.org/show_bug.cgi?id=1211871
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7196
Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, when a Java plugin is enabled, allow remote attackers to cause a denial of service (incorrect garbage collection and application crash) or possibly execute arbitrary code via a crafted Java applet that deallocates an in-use JavaScript wrapper.
- SUSE-SU-2015:1926
- SUSE-SU-2015:1926
- openSUSE-SU-2015:1942
- openSUSE-SU-2015:1942
- SUSE-SU-2015:1978
- SUSE-SU-2015:1978
- SUSE-SU-2015:1981
- SUSE-SU-2015:1981
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2245
- openSUSE-SU-2015:2245
- RHSA-2015:1982
- RHSA-2015:1982
- DSA-3393
- DSA-3393
- http://www.mozilla.org/security/announce/2015/mfsa2015-130.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-130.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 77411
- 77411
- 1034069
- 1034069
- USN-2785-1
- USN-2785-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1140616
- https://bugzilla.mozilla.org/show_bug.cgi?id=1140616
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7197
Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly control the ability of a web worker to create a WebSocket object, which allows remote attackers to bypass intended mixed-content restrictions via crafted JavaScript code.
- SUSE-SU-2015:1926
- SUSE-SU-2015:1926
- openSUSE-SU-2015:1942
- openSUSE-SU-2015:1942
- SUSE-SU-2015:1978
- SUSE-SU-2015:1978
- SUSE-SU-2015:1981
- SUSE-SU-2015:1981
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2245
- openSUSE-SU-2015:2245
- RHSA-2015:1982
- RHSA-2015:1982
- RHSA-2015:2519
- RHSA-2015:2519
- DSA-3393
- DSA-3393
- DSA-3410
- DSA-3410
- http://www.mozilla.org/security/announce/2015/mfsa2015-132.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-132.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 77411
- 77411
- 1034069
- 1034069
- USN-2785-1
- USN-2785-1
- USN-2819-1
- USN-2819-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1204269
- https://bugzilla.mozilla.org/show_bug.cgi?id=1204269
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7198
Buffer overflow in the rx::TextureStorage11 class in ANGLE, as used in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted texture data.
- SUSE-SU-2015:1926
- SUSE-SU-2015:1926
- openSUSE-SU-2015:1942
- openSUSE-SU-2015:1942
- SUSE-SU-2015:1978
- SUSE-SU-2015:1978
- SUSE-SU-2015:1981
- SUSE-SU-2015:1981
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2245
- openSUSE-SU-2015:2245
- RHSA-2015:1982
- RHSA-2015:1982
- RHSA-2015:2519
- RHSA-2015:2519
- DSA-3393
- DSA-3393
- DSA-3410
- DSA-3410
- http://www.mozilla.org/security/announce/2015/mfsa2015-131.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-131.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 77411
- 77411
- 1034069
- 1034069
- USN-2785-1
- USN-2785-1
- USN-2819-1
- USN-2819-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1188010
- https://bugzilla.mozilla.org/show_bug.cgi?id=1188010
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7199
The (1) AddWeightedPathSegLists and (2) SVGPathSegListSMILType::Interpolate functions in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lack status checking, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted SVG document.
- SUSE-SU-2015:1926
- SUSE-SU-2015:1926
- openSUSE-SU-2015:1942
- openSUSE-SU-2015:1942
- SUSE-SU-2015:1978
- SUSE-SU-2015:1978
- SUSE-SU-2015:1981
- SUSE-SU-2015:1981
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2245
- openSUSE-SU-2015:2245
- RHSA-2015:1982
- RHSA-2015:1982
- RHSA-2015:2519
- RHSA-2015:2519
- DSA-3393
- DSA-3393
- DSA-3410
- DSA-3410
- http://www.mozilla.org/security/announce/2015/mfsa2015-131.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-131.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 77411
- 77411
- 1034069
- 1034069
- USN-2785-1
- USN-2785-1
- USN-2819-1
- USN-2819-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1204061
- https://bugzilla.mozilla.org/show_bug.cgi?id=1204061
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7200
The CryptoKey interface implementation in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lacks status checking, which allows attackers to have an unspecified impact via vectors related to a cryptographic key.
- SUSE-SU-2015:1926
- SUSE-SU-2015:1926
- openSUSE-SU-2015:1942
- openSUSE-SU-2015:1942
- SUSE-SU-2015:1978
- SUSE-SU-2015:1978
- SUSE-SU-2015:1981
- SUSE-SU-2015:1981
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2229
- openSUSE-SU-2015:2245
- openSUSE-SU-2015:2245
- RHSA-2015:1982
- RHSA-2015:1982
- RHSA-2015:2519
- RHSA-2015:2519
- DSA-3393
- DSA-3393
- DSA-3410
- DSA-3410
- http://www.mozilla.org/security/announce/2015/mfsa2015-131.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-131.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 77411
- 77411
- 1034069
- 1034069
- USN-2785-1
- USN-2785-1
- USN-2819-1
- USN-2819-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1204155
- https://bugzilla.mozilla.org/show_bug.cgi?id=1204155
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7201
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- FEDORA-2015-51b1105902
- FEDORA-2015-51b1105902
- FEDORA-2015-7ab3d3afcf
- FEDORA-2015-7ab3d3afcf
- SUSE-SU-2015:2334
- SUSE-SU-2015:2334
- SUSE-SU-2015:2335
- SUSE-SU-2015:2335
- SUSE-SU-2015:2336
- SUSE-SU-2015:2336
- openSUSE-SU-2015:2380
- openSUSE-SU-2015:2380
- openSUSE-SU-2015:2406
- openSUSE-SU-2015:2406
- openSUSE-SU-2015:2353
- openSUSE-SU-2015:2353
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0308
- RHSA-2015:2657
- RHSA-2015:2657
- DSA-3422
- DSA-3422
- DSA-3432
- DSA-3432
- http://www.mozilla.org/security/announce/2015/mfsa2015-134.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-134.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 79279
- 79279
- 1034426
- 1034426
- USN-2833-1
- USN-2833-1
- USN-2859-1
- USN-2859-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1203135
- https://bugzilla.mozilla.org/show_bug.cgi?id=1203135
- https://bugzilla.mozilla.org/show_bug.cgi?id=1224100
- https://bugzilla.mozilla.org/show_bug.cgi?id=1224100
- https://bugzilla.mozilla.org/show_bug.cgi?id=1225250
- https://bugzilla.mozilla.org/show_bug.cgi?id=1225250
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7202
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- FEDORA-2015-51b1105902
- FEDORA-2015-51b1105902
- FEDORA-2015-7ab3d3afcf
- FEDORA-2015-7ab3d3afcf
- SUSE-SU-2015:2334
- SUSE-SU-2015:2334
- SUSE-SU-2015:2335
- SUSE-SU-2015:2335
- SUSE-SU-2015:2336
- SUSE-SU-2015:2336
- openSUSE-SU-2015:2353
- openSUSE-SU-2015:2353
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0308
- http://www.mozilla.org/security/announce/2015/mfsa2015-134.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-134.html
- 79279
- 79279
- 1034426
- 1034426
- USN-2833-1
- USN-2833-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1188105
- https://bugzilla.mozilla.org/show_bug.cgi?id=1188105
- https://bugzilla.mozilla.org/show_bug.cgi?id=1193757
- https://bugzilla.mozilla.org/show_bug.cgi?id=1193757
- https://bugzilla.mozilla.org/show_bug.cgi?id=1193999
- https://bugzilla.mozilla.org/show_bug.cgi?id=1193999
- https://bugzilla.mozilla.org/show_bug.cgi?id=1194002
- https://bugzilla.mozilla.org/show_bug.cgi?id=1194002
- https://bugzilla.mozilla.org/show_bug.cgi?id=1194006
- https://bugzilla.mozilla.org/show_bug.cgi?id=1194006
- https://bugzilla.mozilla.org/show_bug.cgi?id=1197012
- https://bugzilla.mozilla.org/show_bug.cgi?id=1197012
- https://bugzilla.mozilla.org/show_bug.cgi?id=1200580
- https://bugzilla.mozilla.org/show_bug.cgi?id=1200580
- https://bugzilla.mozilla.org/show_bug.cgi?id=1207571
- https://bugzilla.mozilla.org/show_bug.cgi?id=1207571
- https://bugzilla.mozilla.org/show_bug.cgi?id=1208059
- https://bugzilla.mozilla.org/show_bug.cgi?id=1208059
- https://bugzilla.mozilla.org/show_bug.cgi?id=1212305
- https://bugzilla.mozilla.org/show_bug.cgi?id=1212305
- https://bugzilla.mozilla.org/show_bug.cgi?id=1219330
- https://bugzilla.mozilla.org/show_bug.cgi?id=1219330
- https://bugzilla.mozilla.org/show_bug.cgi?id=1221421
- https://bugzilla.mozilla.org/show_bug.cgi?id=1221421
- https://bugzilla.mozilla.org/show_bug.cgi?id=1221904
- https://bugzilla.mozilla.org/show_bug.cgi?id=1221904
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7203
Buffer overflow in the DirectWriteFontInfo::LoadFontFamilyData function in gfx/thebes/gfxDWriteFontList.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted font-family name.
- FEDORA-2015-51b1105902
- FEDORA-2015-51b1105902
- FEDORA-2015-7ab3d3afcf
- FEDORA-2015-7ab3d3afcf
- openSUSE-SU-2015:2353
- openSUSE-SU-2015:2353
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0308
- http://www.mozilla.org/security/announce/2015/mfsa2015-144.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-144.html
- 79280
- 79280
- 1034426
- 1034426
- USN-2833-1
- USN-2833-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1201183
- https://bugzilla.mozilla.org/show_bug.cgi?id=1201183
- https://hg.mozilla.org/mozilla-central/rev/e1bcc04808cc
- https://hg.mozilla.org/mozilla-central/rev/e1bcc04808cc
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7204
Mozilla Firefox before 43.0 does not properly store the properties of unboxed objects, which allows remote attackers to execute arbitrary code via crafted JavaScript variable assignments.
- FEDORA-2015-51b1105902
- FEDORA-2015-51b1105902
- FEDORA-2015-7ab3d3afcf
- FEDORA-2015-7ab3d3afcf
- openSUSE-SU-2015:2353
- openSUSE-SU-2015:2353
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0308
- http://www.mozilla.org/security/announce/2015/mfsa2015-135.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-135.html
- 79280
- 79280
- 1034426
- 1034426
- USN-2833-1
- USN-2833-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1216130
- https://bugzilla.mozilla.org/show_bug.cgi?id=1216130
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7205
Integer underflow in the RTPReceiverVideo::ParseRtpPacket function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 might allow remote attackers to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a crafted WebRTC RTP packet.
- FEDORA-2015-51b1105902
- FEDORA-2015-51b1105902
- FEDORA-2015-7ab3d3afcf
- FEDORA-2015-7ab3d3afcf
- SUSE-SU-2015:2334
- SUSE-SU-2015:2334
- SUSE-SU-2015:2335
- SUSE-SU-2015:2335
- SUSE-SU-2015:2336
- SUSE-SU-2015:2336
- openSUSE-SU-2015:2380
- openSUSE-SU-2015:2380
- openSUSE-SU-2015:2406
- openSUSE-SU-2015:2406
- openSUSE-SU-2015:2353
- openSUSE-SU-2015:2353
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0308
- RHSA-2015:2657
- RHSA-2015:2657
- DSA-3422
- DSA-3422
- DSA-3432
- DSA-3432
- http://www.mozilla.org/security/announce/2015/mfsa2015-145.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-145.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 79279
- 79279
- 1034426
- 1034426
- USN-2833-1
- USN-2833-1
- USN-2859-1
- USN-2859-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1220493
- https://bugzilla.mozilla.org/show_bug.cgi?id=1220493
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7207
Mozilla Firefox before 43.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls, a related issue to CVE-2015-1300.
- FEDORA-2015-51b1105902
- FEDORA-2015-51b1105902
- FEDORA-2015-7ab3d3afcf
- FEDORA-2015-7ab3d3afcf
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- openSUSE-SU-2015:2353
- openSUSE-SU-2015:2353
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0308
- http://www.mozilla.org/security/announce/2015/mfsa2015-136.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-136.html
- 79280
- 79280
- 1034426
- 1034426
- USN-2833-1
- USN-2833-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1185256
- https://bugzilla.mozilla.org/show_bug.cgi?id=1185256
- https://github.com/w3c/resource-timing/issues/29
- https://github.com/w3c/resource-timing/issues/29
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7208
Mozilla Firefox before 43.0 stores cookies containing vertical tab characters, which allows remote attackers to obtain sensitive information by reading HTTP Cookie headers.
- FEDORA-2015-51b1105902
- FEDORA-2015-51b1105902
- FEDORA-2015-7ab3d3afcf
- FEDORA-2015-7ab3d3afcf
- openSUSE-SU-2016:0306
- openSUSE-SU-2016:0306
- openSUSE-SU-2016:0309
- openSUSE-SU-2016:0309
- openSUSE-SU-2015:2353
- openSUSE-SU-2015:2353
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0308
- http://www.mozilla.org/security/announce/2015/mfsa2015-137.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-137.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-04.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-04.html
- 79280
- 79280
- 1034426
- 1034426
- 1034825
- 1034825
- USN-2833-1
- USN-2833-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1191423
- https://bugzilla.mozilla.org/show_bug.cgi?id=1191423
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7210
Use-after-free vulnerability in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering attempted use of a data channel that has been closed by a WebRTC function.
- FEDORA-2015-51b1105902
- FEDORA-2015-51b1105902
- FEDORA-2015-7ab3d3afcf
- FEDORA-2015-7ab3d3afcf
- SUSE-SU-2015:2334
- SUSE-SU-2015:2334
- SUSE-SU-2015:2335
- SUSE-SU-2015:2335
- SUSE-SU-2015:2336
- SUSE-SU-2015:2336
- openSUSE-SU-2015:2380
- openSUSE-SU-2015:2380
- openSUSE-SU-2015:2406
- openSUSE-SU-2015:2406
- openSUSE-SU-2015:2353
- openSUSE-SU-2015:2353
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0308
- RHSA-2015:2657
- RHSA-2015:2657
- DSA-3422
- DSA-3422
- http://www.mozilla.org/security/announce/2015/mfsa2015-138.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-138.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 79283
- 79283
- 1034426
- 1034426
- USN-2833-1
- USN-2833-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1218326
- https://bugzilla.mozilla.org/show_bug.cgi?id=1218326
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7211
Mozilla Firefox before 43.0 mishandles the # (number sign) character in a data: URI, which allows remote attackers to spoof web sites via unspecified vectors.
- FEDORA-2015-51b1105902
- FEDORA-2015-51b1105902
- FEDORA-2015-7ab3d3afcf
- FEDORA-2015-7ab3d3afcf
- openSUSE-SU-2015:2353
- openSUSE-SU-2015:2353
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0308
- http://www.mozilla.org/security/announce/2015/mfsa2015-141.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-141.html
- 79280
- 79280
- 1034426
- 1034426
- USN-2833-1
- USN-2833-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1221444
- https://bugzilla.mozilla.org/show_bug.cgi?id=1221444
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7212
Integer overflow in the mozilla::layers::BufferTextureClient::AllocateForSurface function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering a graphics operation that requires a large texture allocation.
- FEDORA-2015-51b1105902
- FEDORA-2015-51b1105902
- FEDORA-2015-7ab3d3afcf
- FEDORA-2015-7ab3d3afcf
- SUSE-SU-2015:2334
- SUSE-SU-2015:2334
- SUSE-SU-2015:2335
- SUSE-SU-2015:2335
- SUSE-SU-2015:2336
- SUSE-SU-2015:2336
- openSUSE-SU-2015:2380
- openSUSE-SU-2015:2380
- openSUSE-SU-2015:2406
- openSUSE-SU-2015:2406
- openSUSE-SU-2015:2353
- openSUSE-SU-2015:2353
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0308
- RHSA-2015:2657
- RHSA-2015:2657
- DSA-3422
- DSA-3422
- DSA-3432
- DSA-3432
- http://www.mozilla.org/security/announce/2015/mfsa2015-139.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-139.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 79279
- 79279
- 1034426
- 1034426
- USN-2833-1
- USN-2833-1
- USN-2859-1
- USN-2859-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1222809
- https://bugzilla.mozilla.org/show_bug.cgi?id=1222809
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7213
Integer overflow in the MPEG4Extractor::readMetaData function in MPEG4Extractor.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 on 64-bit platforms allows remote attackers to execute arbitrary code via a crafted MP4 video file that triggers a buffer overflow.
- FEDORA-2015-51b1105902
- FEDORA-2015-51b1105902
- FEDORA-2015-7ab3d3afcf
- FEDORA-2015-7ab3d3afcf
- SUSE-SU-2015:2334
- SUSE-SU-2015:2334
- SUSE-SU-2015:2335
- SUSE-SU-2015:2335
- SUSE-SU-2015:2336
- SUSE-SU-2015:2336
- openSUSE-SU-2015:2380
- openSUSE-SU-2015:2380
- openSUSE-SU-2015:2406
- openSUSE-SU-2015:2406
- openSUSE-SU-2015:2353
- openSUSE-SU-2015:2353
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0308
- RHSA-2015:2657
- RHSA-2015:2657
- DSA-3422
- DSA-3422
- DSA-3432
- DSA-3432
- http://www.mozilla.org/security/announce/2015/mfsa2015-146.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-146.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 79279
- 79279
- 1034426
- 1034426
- USN-2833-1
- USN-2833-1
- USN-2859-1
- USN-2859-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1206211
- https://bugzilla.mozilla.org/show_bug.cgi?id=1206211
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7214
Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and view-source: URIs.
- FEDORA-2015-51b1105902
- FEDORA-2015-51b1105902
- FEDORA-2015-7ab3d3afcf
- FEDORA-2015-7ab3d3afcf
- SUSE-SU-2015:2334
- SUSE-SU-2015:2334
- SUSE-SU-2015:2335
- SUSE-SU-2015:2335
- SUSE-SU-2015:2336
- SUSE-SU-2015:2336
- openSUSE-SU-2015:2380
- openSUSE-SU-2015:2380
- openSUSE-SU-2015:2406
- openSUSE-SU-2015:2406
- openSUSE-SU-2015:2353
- openSUSE-SU-2015:2353
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0308
- RHSA-2015:2657
- RHSA-2015:2657
- DSA-3422
- DSA-3422
- DSA-3432
- DSA-3432
- http://www.mozilla.org/security/announce/2015/mfsa2015-149.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-149.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 79279
- 79279
- 1034426
- 1034426
- USN-2833-1
- USN-2833-1
- USN-2859-1
- USN-2859-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1228950
- https://bugzilla.mozilla.org/show_bug.cgi?id=1228950
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7215
The importScripts function in the Web Workers API implementation in Mozilla Firefox before 43.0 allows remote attackers to bypass the Same Origin Policy by triggering use of the no-cors mode in the fetch API to attempt resource access that throws an exception, leading to information disclosure after a rethrow.
- FEDORA-2015-51b1105902
- FEDORA-2015-51b1105902
- FEDORA-2015-7ab3d3afcf
- FEDORA-2015-7ab3d3afcf
- openSUSE-SU-2015:2353
- openSUSE-SU-2015:2353
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0308
- http://www.mozilla.org/security/announce/2015/mfsa2015-140.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-140.html
- 79280
- 79280
- 1034426
- 1034426
- USN-2833-1
- USN-2833-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1160890
- https://bugzilla.mozilla.org/show_bug.cgi?id=1160890
- https://github.com/whatwg/html/issues/164
- https://github.com/whatwg/html/issues/164
- https://github.com/whatwg/html/pull/166
- https://github.com/whatwg/html/pull/166
- GLSA-201512-10
- GLSA-201512-10
- https://www.w3.org/Bugs/Public/show_bug.cgi?id=28961
- https://www.w3.org/Bugs/Public/show_bug.cgi?id=28961
Modified: 2024-11-21
CVE-2015-7218
The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service (integer underflow, assertion failure, and application exit) via a single-byte header frame that triggers incorrect memory allocation.
- FEDORA-2015-51b1105902
- FEDORA-2015-51b1105902
- FEDORA-2015-7ab3d3afcf
- FEDORA-2015-7ab3d3afcf
- openSUSE-SU-2015:2353
- openSUSE-SU-2015:2353
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0308
- http://www.mozilla.org/security/announce/2015/mfsa2015-142.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-142.html
- 79280
- 79280
- 1034426
- 1034426
- USN-2833-1
- USN-2833-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1194818
- https://bugzilla.mozilla.org/show_bug.cgi?id=1194818
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7219
The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service (integer underflow, assertion failure, and application exit) via a malformed PushPromise frame that triggers decompressed-buffer length miscalculation and incorrect memory allocation.
- FEDORA-2015-51b1105902
- FEDORA-2015-51b1105902
- FEDORA-2015-7ab3d3afcf
- FEDORA-2015-7ab3d3afcf
- openSUSE-SU-2015:2353
- openSUSE-SU-2015:2353
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0308
- http://www.mozilla.org/security/announce/2015/mfsa2015-142.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-142.html
- 79280
- 79280
- 1034426
- 1034426
- USN-2833-1
- USN-2833-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1194820
- https://bugzilla.mozilla.org/show_bug.cgi?id=1194820
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7220
Buffer overflow in the XDRBuffer::grow function in js/src/vm/Xdr.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code.
- FEDORA-2015-51b1105902
- FEDORA-2015-51b1105902
- FEDORA-2015-7ab3d3afcf
- FEDORA-2015-7ab3d3afcf
- openSUSE-SU-2015:2353
- openSUSE-SU-2015:2353
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0308
- http://www.mozilla.org/security/announce/2015/mfsa2015-144.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-144.html
- 79280
- 79280
- 1034426
- 1034426
- USN-2833-1
- USN-2833-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1178033
- https://bugzilla.mozilla.org/show_bug.cgi?id=1178033
- https://hg.mozilla.org/mozilla-central/rev/e4b9e72f934f
- https://hg.mozilla.org/mozilla-central/rev/e4b9e72f934f
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7221
Buffer overflow in the nsDeque::GrowCapacity function in xpcom/glue/nsDeque.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a deque size change.
- FEDORA-2015-51b1105902
- FEDORA-2015-51b1105902
- FEDORA-2015-7ab3d3afcf
- FEDORA-2015-7ab3d3afcf
- openSUSE-SU-2015:2353
- openSUSE-SU-2015:2353
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0308
- http://www.mozilla.org/security/announce/2015/mfsa2015-144.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-144.html
- 79280
- 79280
- 1034426
- 1034426
- USN-2833-1
- USN-2833-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1199400
- https://bugzilla.mozilla.org/show_bug.cgi?id=1199400
- https://hg.mozilla.org/mozilla-central/rev/7fd961937687
- https://hg.mozilla.org/mozilla-central/rev/7fd961937687
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7222
Integer underflow in the Metadata::setData function in MetaData.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect memory allocation and application crash) via an MP4 video file with crafted covr metadata that triggers a buffer overflow.
- FEDORA-2015-51b1105902
- FEDORA-2015-51b1105902
- FEDORA-2015-7ab3d3afcf
- FEDORA-2015-7ab3d3afcf
- SUSE-SU-2015:2334
- SUSE-SU-2015:2334
- SUSE-SU-2015:2335
- SUSE-SU-2015:2335
- SUSE-SU-2015:2336
- SUSE-SU-2015:2336
- openSUSE-SU-2015:2380
- openSUSE-SU-2015:2380
- openSUSE-SU-2015:2406
- openSUSE-SU-2015:2406
- openSUSE-SU-2015:2353
- openSUSE-SU-2015:2353
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0308
- RHSA-2015:2657
- RHSA-2015:2657
- DSA-3422
- DSA-3422
- http://www.mozilla.org/security/announce/2015/mfsa2015-147.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-147.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- 79279
- 79279
- 1034426
- 1034426
- USN-2833-1
- USN-2833-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1216748
- https://bugzilla.mozilla.org/show_bug.cgi?id=1216748
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7223
The WebExtension APIs in Mozilla Firefox before 43.0 allow remote attackers to gain privileges, and possibly obtain sensitive information or conduct cross-site scripting (XSS) attacks, via a crafted web site.
- FEDORA-2015-51b1105902
- FEDORA-2015-51b1105902
- FEDORA-2015-7ab3d3afcf
- FEDORA-2015-7ab3d3afcf
- openSUSE-SU-2015:2353
- openSUSE-SU-2015:2353
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0308
- http://www.mozilla.org/security/announce/2015/mfsa2015-148.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-148.html
- 79280
- 79280
- 1034426
- 1034426
- USN-2833-1
- USN-2833-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1226423
- https://bugzilla.mozilla.org/show_bug.cgi?id=1226423
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-7327
Mozilla Firefox before 41.0 does not properly restrict the availability of High Resolution Time API times, which allows remote attackers to track last-level cache access, and consequently obtain sensitive information, via crafted JavaScript code that makes performance.now calls.
- http://arxiv.org/abs/1502.07373
- http://arxiv.org/abs/1502.07373
- http://www.mozilla.org/security/announce/2015/mfsa2015-114.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-114.html
- 1033640
- 1033640
- https://bugzilla.mozilla.org/show_bug.cgi?id=1153672
- https://bugzilla.mozilla.org/show_bug.cgi?id=1153672
- https://bugzilla.mozilla.org/show_bug.cgi?id=1167489
- https://bugzilla.mozilla.org/show_bug.cgi?id=1167489
Modified: 2024-11-21
CVE-2015-7575
Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.
- SUSE-SU-2016:0256
- SUSE-SU-2016:0256
- openSUSE-SU-2016:0263
- openSUSE-SU-2016:0263
- SUSE-SU-2016:0265
- SUSE-SU-2016:0265
- openSUSE-SU-2016:0268
- openSUSE-SU-2016:0268
- SUSE-SU-2016:0269
- SUSE-SU-2016:0269
- openSUSE-SU-2016:0270
- openSUSE-SU-2016:0270
- openSUSE-SU-2016:0272
- openSUSE-SU-2016:0272
- openSUSE-SU-2016:0279
- openSUSE-SU-2016:0279
- openSUSE-SU-2015:2405
- openSUSE-SU-2015:2405
- openSUSE-SU-2016:0007
- openSUSE-SU-2016:0007
- openSUSE-SU-2016:0161
- openSUSE-SU-2016:0161
- openSUSE-SU-2016:0162
- openSUSE-SU-2016:0162
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0307
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0308
- openSUSE-SU-2016:0488
- openSUSE-SU-2016:0488
- openSUSE-SU-2016:0605
- openSUSE-SU-2016:0605
- RHSA-2016:0049
- RHSA-2016:0049
- RHSA-2016:0050
- RHSA-2016:0050
- RHSA-2016:0053
- RHSA-2016:0053
- RHSA-2016:0054
- RHSA-2016:0054
- RHSA-2016:0055
- RHSA-2016:0055
- RHSA-2016:0056
- RHSA-2016:0056
- DSA-3436
- DSA-3436
- DSA-3437
- DSA-3437
- DSA-3457
- DSA-3457
- DSA-3458
- DSA-3458
- DSA-3465
- DSA-3465
- DSA-3491
- DSA-3491
- DSA-3688
- DSA-3688
- http://www.mozilla.org/security/announce/2015/mfsa2015-150.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-150.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 79684
- 79684
- 91787
- 91787
- 1034541
- 1034541
- 1036467
- 1036467
- USN-2863-1
- USN-2863-1
- USN-2864-1
- USN-2864-1
- USN-2865-1
- USN-2865-1
- USN-2866-1
- USN-2866-1
- USN-2884-1
- USN-2884-1
- USN-2904-1
- USN-2904-1
- RHSA-2016:1430
- RHSA-2016:1430
- https://bugzilla.mozilla.org/show_bug.cgi?id=1158489
- https://bugzilla.mozilla.org/show_bug.cgi?id=1158489
- https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.20.2_release_notes
- https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.20.2_release_notes
- GLSA-201701-46
- GLSA-201701-46
- GLSA-201706-18
- GLSA-201706-18
- GLSA-201801-15
- GLSA-201801-15
- https://security.netapp.com/advisory/ntap-20160225-0001/
- https://security.netapp.com/advisory/ntap-20160225-0001/
Modified: 2024-11-21
CVE-2016-1521
The directrun function in directmachine.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not validate a certain skip operation, which allows remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.
- http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html
- http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html
- FEDORA-2016-4154a4d0ba
- FEDORA-2016-4154a4d0ba
- FEDORA-2016-338a7e9925
- FEDORA-2016-338a7e9925
- SUSE-SU-2016:0779
- SUSE-SU-2016:0779
- openSUSE-SU-2016:0791
- openSUSE-SU-2016:0791
- openSUSE-SU-2016:0875
- openSUSE-SU-2016:0875
- RHSA-2016:0197
- RHSA-2016:0197
- RHSA-2016:0258
- RHSA-2016:0258
- RHSA-2016:0594
- RHSA-2016:0594
- DSA-3479
- DSA-3479
- http://www.mozilla.org/security/announce/2016/mfsa2016-14.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-14.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 82991
- 82991
- USN-2902-1
- USN-2902-1
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- GLSA-201701-35
- GLSA-201701-35
- GLSA-201701-63
- GLSA-201701-63
Modified: 2024-11-21
CVE-2016-1930
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2016:0306
- openSUSE-SU-2016:0306
- openSUSE-SU-2016:0309
- openSUSE-SU-2016:0309
- openSUSE-SU-2016:0310
- openSUSE-SU-2016:0310
- SUSE-SU-2016:0338
- SUSE-SU-2016:0338
- openSUSE-SU-2016:0488
- openSUSE-SU-2016:0488
- openSUSE-SU-2016:0492
- openSUSE-SU-2016:0492
- RHSA-2016:0071
- RHSA-2016:0071
- RHSA-2016:0258
- RHSA-2016:0258
- DSA-3457
- DSA-3457
- DSA-3491
- DSA-3491
- http://www.mozilla.org/security/announce/2016/mfsa2016-01.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-01.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 81953
- 81953
- 1034825
- 1034825
- USN-2880-1
- USN-2880-1
- USN-2880-2
- USN-2880-2
- USN-2904-1
- USN-2904-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1221385
- https://bugzilla.mozilla.org/show_bug.cgi?id=1221385
- https://bugzilla.mozilla.org/show_bug.cgi?id=1223670
- https://bugzilla.mozilla.org/show_bug.cgi?id=1223670
- https://bugzilla.mozilla.org/show_bug.cgi?id=1224200
- https://bugzilla.mozilla.org/show_bug.cgi?id=1224200
- https://bugzilla.mozilla.org/show_bug.cgi?id=1230483
- https://bugzilla.mozilla.org/show_bug.cgi?id=1230483
- https://bugzilla.mozilla.org/show_bug.cgi?id=1230639
- https://bugzilla.mozilla.org/show_bug.cgi?id=1230639
- https://bugzilla.mozilla.org/show_bug.cgi?id=1230668
- https://bugzilla.mozilla.org/show_bug.cgi?id=1230668
- https://bugzilla.mozilla.org/show_bug.cgi?id=1230686
- https://bugzilla.mozilla.org/show_bug.cgi?id=1230686
- https://bugzilla.mozilla.org/show_bug.cgi?id=1233152
- https://bugzilla.mozilla.org/show_bug.cgi?id=1233152
- https://bugzilla.mozilla.org/show_bug.cgi?id=1233346
- https://bugzilla.mozilla.org/show_bug.cgi?id=1233346
- https://bugzilla.mozilla.org/show_bug.cgi?id=1233925
- https://bugzilla.mozilla.org/show_bug.cgi?id=1233925
- https://bugzilla.mozilla.org/show_bug.cgi?id=1234280
- https://bugzilla.mozilla.org/show_bug.cgi?id=1234280
- https://bugzilla.mozilla.org/show_bug.cgi?id=1234571
- https://bugzilla.mozilla.org/show_bug.cgi?id=1234571
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1931
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to uninitialized memory encountered during brotli data compression, and other vectors.
- openSUSE-SU-2016:0306
- openSUSE-SU-2016:0306
- openSUSE-SU-2016:0309
- openSUSE-SU-2016:0309
- http://www.mozilla.org/security/announce/2016/mfsa2016-01.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-01.html
- 81953
- 81953
- 1034825
- 1034825
- USN-2880-1
- USN-2880-1
- USN-2880-2
- USN-2880-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1180064
- https://bugzilla.mozilla.org/show_bug.cgi?id=1180064
- https://bugzilla.mozilla.org/show_bug.cgi?id=1186973
- https://bugzilla.mozilla.org/show_bug.cgi?id=1186973
- https://bugzilla.mozilla.org/show_bug.cgi?id=1206675
- https://bugzilla.mozilla.org/show_bug.cgi?id=1206675
- https://bugzilla.mozilla.org/show_bug.cgi?id=1207298
- https://bugzilla.mozilla.org/show_bug.cgi?id=1207298
- https://bugzilla.mozilla.org/show_bug.cgi?id=1209358
- https://bugzilla.mozilla.org/show_bug.cgi?id=1209358
- https://bugzilla.mozilla.org/show_bug.cgi?id=1209365
- https://bugzilla.mozilla.org/show_bug.cgi?id=1209365
- https://bugzilla.mozilla.org/show_bug.cgi?id=1209366
- https://bugzilla.mozilla.org/show_bug.cgi?id=1209366
- https://bugzilla.mozilla.org/show_bug.cgi?id=1209368
- https://bugzilla.mozilla.org/show_bug.cgi?id=1209368
- https://bugzilla.mozilla.org/show_bug.cgi?id=1209546
- https://bugzilla.mozilla.org/show_bug.cgi?id=1209546
- https://bugzilla.mozilla.org/show_bug.cgi?id=1222015
- https://bugzilla.mozilla.org/show_bug.cgi?id=1222015
- https://bugzilla.mozilla.org/show_bug.cgi?id=1229825
- https://bugzilla.mozilla.org/show_bug.cgi?id=1229825
- https://bugzilla.mozilla.org/show_bug.cgi?id=1231121
- https://bugzilla.mozilla.org/show_bug.cgi?id=1231121
- https://bugzilla.mozilla.org/show_bug.cgi?id=1234576
- https://bugzilla.mozilla.org/show_bug.cgi?id=1234576
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1933
Integer overflow in the image-deinterlacing functionality in Mozilla Firefox before 44.0 allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted GIF image.
- openSUSE-SU-2016:0306
- openSUSE-SU-2016:0306
- openSUSE-SU-2016:0309
- openSUSE-SU-2016:0309
- http://www.mozilla.org/security/announce/2016/mfsa2016-02.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-02.html
- 81956
- 81956
- 1034825
- 1034825
- USN-2880-1
- USN-2880-1
- USN-2880-2
- USN-2880-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1231761
- https://bugzilla.mozilla.org/show_bug.cgi?id=1231761
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1935
Buffer overflow in the BufferSubData function in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 allows remote attackers to execute arbitrary code via crafted WebGL content.
- openSUSE-SU-2016:0306
- openSUSE-SU-2016:0306
- openSUSE-SU-2016:0309
- openSUSE-SU-2016:0309
- openSUSE-SU-2016:0310
- openSUSE-SU-2016:0310
- SUSE-SU-2016:0338
- SUSE-SU-2016:0338
- openSUSE-SU-2016:0488
- openSUSE-SU-2016:0488
- openSUSE-SU-2016:0492
- openSUSE-SU-2016:0492
- RHSA-2016:0071
- RHSA-2016:0071
- RHSA-2016:0258
- RHSA-2016:0258
- DSA-3457
- DSA-3457
- DSA-3491
- DSA-3491
- http://www.mozilla.org/security/announce/2016/mfsa2016-03.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-03.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 81952
- 81952
- 1034825
- 1034825
- USN-2880-1
- USN-2880-1
- USN-2880-2
- USN-2880-2
- USN-2904-1
- USN-2904-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1220450
- https://bugzilla.mozilla.org/show_bug.cgi?id=1220450
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1937
The protocol-handler dialog in Mozilla Firefox before 44.0 allows remote attackers to conduct clickjacking attacks via a crafted web site that triggers a single-click action in a situation where a double-click action was intended.
- openSUSE-SU-2016:0306
- openSUSE-SU-2016:0306
- openSUSE-SU-2016:0309
- openSUSE-SU-2016:0309
- http://www.mozilla.org/security/announce/2016/mfsa2016-06.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-06.html
- 81957
- 81957
- 1034825
- 1034825
- USN-2880-1
- USN-2880-1
- USN-2880-2
- USN-2880-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=724353
- https://bugzilla.mozilla.org/show_bug.cgi?id=724353
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1939
Mozilla Firefox before 44.0 stores cookies with names containing vertical tab characters, which allows remote attackers to obtain sensitive information by reading HTTP Cookie headers. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-7208.
- openSUSE-SU-2016:0306
- openSUSE-SU-2016:0306
- openSUSE-SU-2016:0309
- openSUSE-SU-2016:0309
- http://www.mozilla.org/security/announce/2016/mfsa2016-04.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-04.html
- 1034825
- 1034825
- USN-2880-1
- USN-2880-1
- USN-2880-2
- USN-2880-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1233784
- https://bugzilla.mozilla.org/show_bug.cgi?id=1233784
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1942
Mozilla Firefox before 44.0 allows user-assisted remote attackers to spoof a trailing substring in the address bar by leveraging a user's paste of a (1) wyciwyg: URI or (2) resource: URI.
- openSUSE-SU-2016:0306
- openSUSE-SU-2016:0306
- openSUSE-SU-2016:0309
- openSUSE-SU-2016:0309
- http://www.mozilla.org/security/announce/2016/mfsa2016-09.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-09.html
- 81948
- 81948
- 1034825
- 1034825
- USN-2880-1
- USN-2880-1
- USN-2880-2
- USN-2880-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1189082
- https://bugzilla.mozilla.org/show_bug.cgi?id=1189082
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1946
The MoofParser::Metadata function in binding/MoofParser.cpp in libstagefright in Mozilla Firefox before 44.0 does not limit the size of read operations, which might allow remote attackers to cause a denial of service (integer overflow and buffer overflow) or possibly have unspecified other impact via crafted metadata.
- openSUSE-SU-2016:0306
- openSUSE-SU-2016:0306
- openSUSE-SU-2016:0309
- openSUSE-SU-2016:0309
- http://www.mozilla.org/security/announce/2016/mfsa2016-10.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-10.html
- 81950
- 81950
- 1034825
- 1034825
- USN-2880-1
- USN-2880-1
- USN-2880-2
- USN-2880-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1232069
- https://bugzilla.mozilla.org/show_bug.cgi?id=1232069
- https://hg.mozilla.org/mozilla-central/rev/2a57c0a0cf19
- https://hg.mozilla.org/mozilla-central/rev/2a57c0a0cf19
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1949
Mozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers and plugins, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that triggers spoofed responses to requests that use NPAPI, as demonstrated by a request for a crossdomain.xml file.
- openSUSE-SU-2016:0489
- openSUSE-SU-2016:0489
- openSUSE-SU-2016:0553
- openSUSE-SU-2016:0553
- http://www.mozilla.org/security/announce/2016/mfsa2016-13.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-13.html
- 1035007
- 1035007
- USN-2893-1
- USN-2893-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1245724
- https://bugzilla.mozilla.org/show_bug.cgi?id=1245724
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1952
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- http://www.mozilla.org/security/announce/2016/mfsa2016-16.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-16.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1123661
- https://bugzilla.mozilla.org/show_bug.cgi?id=1123661
- https://bugzilla.mozilla.org/show_bug.cgi?id=1221872
- https://bugzilla.mozilla.org/show_bug.cgi?id=1221872
- https://bugzilla.mozilla.org/show_bug.cgi?id=1224979
- https://bugzilla.mozilla.org/show_bug.cgi?id=1224979
- https://bugzilla.mozilla.org/show_bug.cgi?id=1234578
- https://bugzilla.mozilla.org/show_bug.cgi?id=1234578
- https://bugzilla.mozilla.org/show_bug.cgi?id=1241217
- https://bugzilla.mozilla.org/show_bug.cgi?id=1241217
- https://bugzilla.mozilla.org/show_bug.cgi?id=1242279
- https://bugzilla.mozilla.org/show_bug.cgi?id=1242279
- https://bugzilla.mozilla.org/show_bug.cgi?id=1244250
- https://bugzilla.mozilla.org/show_bug.cgi?id=1244250
- https://bugzilla.mozilla.org/show_bug.cgi?id=1244995
- https://bugzilla.mozilla.org/show_bug.cgi?id=1244995
- https://bugzilla.mozilla.org/show_bug.cgi?id=1249685
- https://bugzilla.mozilla.org/show_bug.cgi?id=1249685
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1953
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to js/src/jit/arm/Assembler-arm.cpp, and unknown other vectors.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- http://www.mozilla.org/security/announce/2016/mfsa2016-16.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-16.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1199171
- https://bugzilla.mozilla.org/show_bug.cgi?id=1199171
- https://bugzilla.mozilla.org/show_bug.cgi?id=1205163
- https://bugzilla.mozilla.org/show_bug.cgi?id=1205163
- https://bugzilla.mozilla.org/show_bug.cgi?id=1207958
- https://bugzilla.mozilla.org/show_bug.cgi?id=1207958
- https://bugzilla.mozilla.org/show_bug.cgi?id=1224361
- https://bugzilla.mozilla.org/show_bug.cgi?id=1224361
- https://bugzilla.mozilla.org/show_bug.cgi?id=1224363
- https://bugzilla.mozilla.org/show_bug.cgi?id=1224363
- https://bugzilla.mozilla.org/show_bug.cgi?id=1224369
- https://bugzilla.mozilla.org/show_bug.cgi?id=1224369
- https://bugzilla.mozilla.org/show_bug.cgi?id=1225618
- https://bugzilla.mozilla.org/show_bug.cgi?id=1225618
- https://bugzilla.mozilla.org/show_bug.cgi?id=1234425
- https://bugzilla.mozilla.org/show_bug.cgi?id=1234425
- https://bugzilla.mozilla.org/show_bug.cgi?id=1236519
- https://bugzilla.mozilla.org/show_bug.cgi?id=1236519
- https://bugzilla.mozilla.org/show_bug.cgi?id=1238558
- https://bugzilla.mozilla.org/show_bug.cgi?id=1238558
- https://bugzilla.mozilla.org/show_bug.cgi?id=1238935
- https://bugzilla.mozilla.org/show_bug.cgi?id=1238935
- https://bugzilla.mozilla.org/show_bug.cgi?id=1241731
- https://bugzilla.mozilla.org/show_bug.cgi?id=1241731
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243555
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243555
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243583
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243583
- https://bugzilla.mozilla.org/show_bug.cgi?id=1245866
- https://bugzilla.mozilla.org/show_bug.cgi?id=1245866
- https://bugzilla.mozilla.org/show_bug.cgi?id=1247236
- https://bugzilla.mozilla.org/show_bug.cgi?id=1247236
- https://bugzilla.mozilla.org/show_bug.cgi?id=1248794
- https://bugzilla.mozilla.org/show_bug.cgi?id=1248794
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1954
The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not prevent use of a non-HTTP report-uri for a Content Security Policy (CSP) violation report, which allows remote attackers to cause a denial of service (data overwrite) or possibly gain privileges by specifying a URL of a local file.
- http://hg.mozilla.org/releases/mozilla-release/rev/5154bb929236
- http://hg.mozilla.org/releases/mozilla-release/rev/5154bb929236
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-17.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-17.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243178
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243178
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1955
Mozilla Firefox before 45.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy (CSP) violation report that contains path information associated with an IFRAME element.
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- http://www.mozilla.org/security/announce/2016/mfsa2016-18.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-18.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1208946
- https://bugzilla.mozilla.org/show_bug.cgi?id=1208946
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1957
Memory leak in libstagefright in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to cause a denial of service (memory consumption) via an MPEG-4 file that triggers a delete operation on an array.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-20.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-20.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1227052
- https://bugzilla.mozilla.org/show_bug.cgi?id=1227052
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1958
browser/base/content/browser.js in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to spoof the address bar via a javascript: URL.
- http://hg.mozilla.org/releases/mozilla-release/rev/80ce3f1ffe03
- http://hg.mozilla.org/releases/mozilla-release/rev/80ce3f1ffe03
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- DSA-3510
- DSA-3510
- http://www.mozilla.org/security/announce/2016/mfsa2016-21.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-21.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1228754
- https://bugzilla.mozilla.org/show_bug.cgi?id=1228754
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1959
The ServiceWorkerManager class in Mozilla Firefox before 45.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via unspecified use of the Clients API.
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- http://www.mozilla.org/security/announce/2016/mfsa2016-22.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-22.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1234949
- https://bugzilla.mozilla.org/show_bug.cgi?id=1234949
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1960
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-23.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-23.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2934-1
- USN-2934-1
- http://zerodayinitiative.com/advisories/ZDI-16-198/
- http://zerodayinitiative.com/advisories/ZDI-16-198/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1246014
- https://bugzilla.mozilla.org/show_bug.cgi?id=1246014
- GLSA-201605-06
- GLSA-201605-06
- 42484
- 42484
- 44294
- 44294
Modified: 2024-11-21
CVE-2016-1961
Use-after-free vulnerability in the nsHTMLDocument::SetBody function in dom/html/nsHTMLDocument.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of a root element, aka ZDI-CAN-3574.
- http://hg.mozilla.org/releases/mozilla-release/rev/b208427885d3
- http://hg.mozilla.org/releases/mozilla-release/rev/b208427885d3
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-24.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-24.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2934-1
- USN-2934-1
- http://zerodayinitiative.com/advisories/ZDI-16-199/
- http://zerodayinitiative.com/advisories/ZDI-16-199/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1249377
- https://bugzilla.mozilla.org/show_bug.cgi?id=1249377
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1962
Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of WebRTC data-channel connections.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- DSA-3510
- DSA-3510
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-25.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-25.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1240760
- https://bugzilla.mozilla.org/show_bug.cgi?id=1240760
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1963
The FileReader class in Mozilla Firefox before 45.0 allows local users to gain privileges or cause a denial of service (memory corruption) by changing a file during a FileReader API read operation.
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- http://www.mozilla.org/security/announce/2016/mfsa2016-26.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-26.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1238440
- https://bugzilla.mozilla.org/show_bug.cgi?id=1238440
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1964
Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging mishandling of XML transformations.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-27.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-27.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243335
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243335
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1965
Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers to spoof the address bar via vectors involving the history.back method and the location.protocol property.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- DSA-3510
- DSA-3510
- http://www.mozilla.org/security/announce/2016/mfsa2016-28.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-28.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1245264
- https://bugzilla.mozilla.org/show_bug.cgi?id=1245264
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1966
The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference and memory corruption) via a crafted NPAPI plugin.
- http://hg.mozilla.org/releases/mozilla-release/rev/f0d2911a9a4e
- http://hg.mozilla.org/releases/mozilla-release/rev/f0d2911a9a4e
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- DSA-3510
- DSA-3510
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-31.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-31.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1246054
- https://bugzilla.mozilla.org/show_bug.cgi?id=1246054
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1967
Mozilla Firefox before 45.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls after restoring a browser session. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-7207.
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- http://www.mozilla.org/security/announce/2016/mfsa2016-29.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-29.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1246956
- https://bugzilla.mozilla.org/show_bug.cgi?id=1246956
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1968
Integer underflow in Brotli, as used in Mozilla Firefox before 45.0, allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted data with brotli compression.
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- http://www.mozilla.org/security/announce/2016/mfsa2016-30.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-30.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1246742
- https://bugzilla.mozilla.org/show_bug.cgi?id=1246742
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1969
The setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.6.1, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted Graphite smart font.
Modified: 2024-11-21
CVE-2016-1973
Race condition in the GetStaticInstance function in the WebRTC implementation in Mozilla Firefox before 45.0 might allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via unspecified vectors.
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- http://www.mozilla.org/security/announce/2016/mfsa2016-33.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-33.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1219339
- https://bugzilla.mozilla.org/show_bug.cgi?id=1219339
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1974
The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not verify that memory allocation succeeds, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via crafted Unicode data in an HTML, XML, or SVG document.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-34.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-34.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1228103
- https://bugzilla.mozilla.org/show_bug.cgi?id=1228103
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1975
Multiple race conditions in dom/media/systemservices/CamerasChild.cpp in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
- http://hg.mozilla.org/releases/mozilla-release/rev/bafc86c12e63
- http://hg.mozilla.org/releases/mozilla-release/rev/bafc86c12e63
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- http://www.mozilla.org/security/announce/2016/mfsa2016-32.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-32.html
- 84220
- 84220
- 1035215
- 1035215
- https://bugzilla.mozilla.org/show_bug.cgi?id=1230768
- https://bugzilla.mozilla.org/show_bug.cgi?id=1230768
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1977
The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted Graphite smart font.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3515
- DSA-3515
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 84222
- 84222
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2927-1
- USN-2927-1
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1248876
- https://bugzilla.mozilla.org/show_bug.cgi?id=1248876
- GLSA-201605-06
- GLSA-201605-06
- GLSA-201701-63
- GLSA-201701-63
Modified: 2024-11-21
CVE-2016-2790
The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3515
- DSA-3515
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 84222
- 84222
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2927-1
- USN-2927-1
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243464
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243464
- GLSA-201605-06
- GLSA-201605-06
- GLSA-201701-63
- GLSA-201701-63
Modified: 2024-11-21
CVE-2016-2791
The graphite2::GlyphCache::glyph function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3515
- DSA-3515
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 84222
- 84222
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2927-1
- USN-2927-1
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243473
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243473
- GLSA-201605-06
- GLSA-201605-06
- GLSA-201701-63
- GLSA-201701-63
Modified: 2024-11-21
CVE-2016-2792
The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2800.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3515
- DSA-3515
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 84222
- 84222
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2927-1
- USN-2927-1
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243482
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243482
- GLSA-201605-06
- GLSA-201605-06
- GLSA-201701-63
- GLSA-201701-63
Modified: 2024-11-21
CVE-2016-2793
CachedCmap.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3515
- DSA-3515
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 84222
- 84222
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2927-1
- USN-2927-1
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243513
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243513
- GLSA-201605-06
- GLSA-201605-06
- GLSA-201701-63
- GLSA-201701-63
Modified: 2024-11-21
CVE-2016-2794
The graphite2::TtfUtil::CmapSubtable12NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3515
- DSA-3515
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 84222
- 84222
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2927-1
- USN-2927-1
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243526
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243526
- GLSA-201605-06
- GLSA-201605-06
- GLSA-201701-63
- GLSA-201701-63
Modified: 2024-11-21
CVE-2016-2795
The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3515
- DSA-3515
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 84222
- 84222
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2927-1
- USN-2927-1
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243597
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243597
- GLSA-201605-06
- GLSA-201605-06
- GLSA-201701-63
- GLSA-201701-63
Modified: 2024-11-21
CVE-2016-2796
Heap-based buffer overflow in the graphite2::vm::Machine::Code::Code function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3515
- DSA-3515
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 84222
- 84222
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2927-1
- USN-2927-1
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243816
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243816
- GLSA-201605-06
- GLSA-201605-06
- GLSA-201701-63
- GLSA-201701-63
Modified: 2024-11-21
CVE-2016-2797
The graphite2::TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2801.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3515
- DSA-3515
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 84222
- 84222
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2927-1
- USN-2927-1
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243823
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243823
- GLSA-201605-06
- GLSA-201605-06
- GLSA-201701-63
- GLSA-201701-63
Modified: 2024-11-21
CVE-2016-2798
The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3515
- DSA-3515
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 84222
- 84222
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2927-1
- USN-2927-1
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1248805
- https://bugzilla.mozilla.org/show_bug.cgi?id=1248805
- GLSA-201605-06
- GLSA-201605-06
- GLSA-201701-63
- GLSA-201701-63
Modified: 2024-11-21
CVE-2016-2799
Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3515
- DSA-3515
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 84222
- 84222
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2927-1
- USN-2927-1
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1249081
- https://bugzilla.mozilla.org/show_bug.cgi?id=1249081
- GLSA-201605-06
- GLSA-201605-06
- GLSA-201701-63
- GLSA-201701-63
Modified: 2024-11-21
CVE-2016-2800
The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2792.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3515
- DSA-3515
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 84222
- 84222
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2927-1
- USN-2927-1
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1249338
- https://bugzilla.mozilla.org/show_bug.cgi?id=1249338
- GLSA-201605-06
- GLSA-201605-06
- GLSA-201701-63
- GLSA-201701-63
Modified: 2024-11-21
CVE-2016-2801
The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2797.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3515
- DSA-3515
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 84222
- 84222
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2927-1
- USN-2927-1
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1249920
- https://bugzilla.mozilla.org/show_bug.cgi?id=1249920
- GLSA-201605-06
- GLSA-201605-06
- GLSA-201701-63
- GLSA-201701-63
Modified: 2024-11-21
CVE-2016-2802
The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3515
- DSA-3515
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-37.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 84222
- 84222
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2927-1
- USN-2927-1
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1248804
- https://bugzilla.mozilla.org/show_bug.cgi?id=1248804
- GLSA-201605-06
- GLSA-201605-06
- GLSA-201701-63
- GLSA-201701-63
Modified: 2024-11-21
CVE-2016-2804
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2016:1211
- openSUSE-SU-2016:1211
- openSUSE-SU-2016:1251
- openSUSE-SU-2016:1251
- http://www.mozilla.org/security/announce/2016/mfsa2016-39.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-39.html
- 1035692
- 1035692
- USN-2936-1
- USN-2936-1
- USN-2936-2
- USN-2936-2
- USN-2936-3
- USN-2936-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1141382
- https://bugzilla.mozilla.org/show_bug.cgi?id=1141382
- https://bugzilla.mozilla.org/show_bug.cgi?id=1155328
- https://bugzilla.mozilla.org/show_bug.cgi?id=1155328
- https://bugzilla.mozilla.org/show_bug.cgi?id=1229855
- https://bugzilla.mozilla.org/show_bug.cgi?id=1229855
- https://bugzilla.mozilla.org/show_bug.cgi?id=1240880
- https://bugzilla.mozilla.org/show_bug.cgi?id=1240880
- https://bugzilla.mozilla.org/show_bug.cgi?id=1249183
- https://bugzilla.mozilla.org/show_bug.cgi?id=1249183
- https://bugzilla.mozilla.org/show_bug.cgi?id=1255298
- https://bugzilla.mozilla.org/show_bug.cgi?id=1255298
- GLSA-201701-15
- GLSA-201701-15
Modified: 2024-11-21
CVE-2016-2806
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0 and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2016:1211
- openSUSE-SU-2016:1211
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1251
- openSUSE-SU-2016:1251
- RHSA-2016:0695
- RHSA-2016:0695
- DSA-3601
- DSA-3601
- http://www.mozilla.org/security/announce/2016/mfsa2016-39.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-39.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- 1035692
- 1035692
- USN-2936-1
- USN-2936-1
- USN-2936-2
- USN-2936-2
- USN-2936-3
- USN-2936-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1212328
- https://bugzilla.mozilla.org/show_bug.cgi?id=1212328
- https://bugzilla.mozilla.org/show_bug.cgi?id=1228882
- https://bugzilla.mozilla.org/show_bug.cgi?id=1228882
- https://bugzilla.mozilla.org/show_bug.cgi?id=1231919
- https://bugzilla.mozilla.org/show_bug.cgi?id=1231919
- https://bugzilla.mozilla.org/show_bug.cgi?id=1238592
- https://bugzilla.mozilla.org/show_bug.cgi?id=1238592
- https://bugzilla.mozilla.org/show_bug.cgi?id=1242668
- https://bugzilla.mozilla.org/show_bug.cgi?id=1242668
- https://bugzilla.mozilla.org/show_bug.cgi?id=1242810
- https://bugzilla.mozilla.org/show_bug.cgi?id=1242810
- https://bugzilla.mozilla.org/show_bug.cgi?id=1251922
- https://bugzilla.mozilla.org/show_bug.cgi?id=1251922
- https://bugzilla.mozilla.org/show_bug.cgi?id=1253099
- https://bugzilla.mozilla.org/show_bug.cgi?id=1253099
- https://bugzilla.mozilla.org/show_bug.cgi?id=1254122
- https://bugzilla.mozilla.org/show_bug.cgi?id=1254122
- https://bugzilla.mozilla.org/show_bug.cgi?id=1255949
- https://bugzilla.mozilla.org/show_bug.cgi?id=1255949
- https://bugzilla.mozilla.org/show_bug.cgi?id=1256065
- https://bugzilla.mozilla.org/show_bug.cgi?id=1256065
- https://bugzilla.mozilla.org/show_bug.cgi?id=1258231
- https://bugzilla.mozilla.org/show_bug.cgi?id=1258231
- https://bugzilla.mozilla.org/show_bug.cgi?id=1260439
- https://bugzilla.mozilla.org/show_bug.cgi?id=1260439
- GLSA-201701-15
- GLSA-201701-15
Modified: 2024-11-21
CVE-2016-2807
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2016:1211
- openSUSE-SU-2016:1211
- SUSE-SU-2016:1258
- SUSE-SU-2016:1258
- SUSE-SU-2016:1352
- SUSE-SU-2016:1352
- SUSE-SU-2016:1374
- SUSE-SU-2016:1374
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1251
- openSUSE-SU-2016:1251
- RHSA-2016:0695
- RHSA-2016:0695
- RHSA-2016:1041
- RHSA-2016:1041
- DSA-3559
- DSA-3559
- DSA-3576
- DSA-3576
- http://www.mozilla.org/security/announce/2016/mfsa2016-39.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-39.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- 1035692
- 1035692
- USN-2936-1
- USN-2936-1
- USN-2936-2
- USN-2936-2
- USN-2936-3
- USN-2936-3
- USN-2973-1
- USN-2973-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1187420
- https://bugzilla.mozilla.org/show_bug.cgi?id=1187420
- https://bugzilla.mozilla.org/show_bug.cgi?id=1252707
- https://bugzilla.mozilla.org/show_bug.cgi?id=1252707
- https://bugzilla.mozilla.org/show_bug.cgi?id=1254164
- https://bugzilla.mozilla.org/show_bug.cgi?id=1254164
- https://bugzilla.mozilla.org/show_bug.cgi?id=1254622
- https://bugzilla.mozilla.org/show_bug.cgi?id=1254622
- https://bugzilla.mozilla.org/show_bug.cgi?id=1254876
- https://bugzilla.mozilla.org/show_bug.cgi?id=1254876
- GLSA-201701-15
- GLSA-201701-15
Modified: 2024-11-21
CVE-2016-2808
The watch implementation in the JavaScript engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code or cause a denial of service (generation-count overflow, out-of-bounds HashMap write access, and application crash) via a crafted web site.
- openSUSE-SU-2016:1211
- openSUSE-SU-2016:1211
- SUSE-SU-2016:1258
- SUSE-SU-2016:1258
- SUSE-SU-2016:1352
- SUSE-SU-2016:1352
- SUSE-SU-2016:1374
- SUSE-SU-2016:1374
- openSUSE-SU-2016:1251
- openSUSE-SU-2016:1251
- RHSA-2016:0695
- RHSA-2016:0695
- DSA-3559
- DSA-3559
- http://www.mozilla.org/security/announce/2016/mfsa2016-47.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-47.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- 1035692
- 1035692
- USN-2936-1
- USN-2936-1
- USN-2936-2
- USN-2936-2
- USN-2936-3
- USN-2936-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1246061
- https://bugzilla.mozilla.org/show_bug.cgi?id=1246061
- GLSA-201701-15
- GLSA-201701-15
Modified: 2024-11-21
CVE-2016-2811
Use-after-free vulnerability in the ServiceWorkerInfo class in the Service Worker subsystem in Mozilla Firefox before 46.0 allows remote attackers to execute arbitrary code via vectors related to the BeginReading method.
- openSUSE-SU-2016:1211
- openSUSE-SU-2016:1211
- openSUSE-SU-2016:1251
- openSUSE-SU-2016:1251
- http://www.mozilla.org/security/announce/2016/mfsa2016-42.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-42.html
- 1035692
- 1035692
- USN-2936-1
- USN-2936-1
- USN-2936-2
- USN-2936-2
- USN-2936-3
- USN-2936-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1252330
- https://bugzilla.mozilla.org/show_bug.cgi?id=1252330
- GLSA-201701-15
- GLSA-201701-15
Modified: 2024-11-21
CVE-2016-2812
Race condition in the get implementation in the ServiceWorkerManager class in the Service Worker subsystem in Mozilla Firefox before 46.0 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted web site.
- openSUSE-SU-2016:1211
- openSUSE-SU-2016:1211
- openSUSE-SU-2016:1251
- openSUSE-SU-2016:1251
- http://www.mozilla.org/security/announce/2016/mfsa2016-42.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-42.html
- 1035692
- 1035692
- USN-2936-1
- USN-2936-1
- USN-2936-2
- USN-2936-2
- USN-2936-3
- USN-2936-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1261776
- https://bugzilla.mozilla.org/show_bug.cgi?id=1261776
- GLSA-201701-15
- GLSA-201701-15
Modified: 2024-11-21
CVE-2016-2814
Heap-based buffer overflow in the stagefright::SampleTable::parseSampleCencInfo function in libstagefright in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code via crafted CENC offsets that lead to mismanagement of the sizes table.
- openSUSE-SU-2016:1211
- openSUSE-SU-2016:1211
- SUSE-SU-2016:1258
- SUSE-SU-2016:1258
- SUSE-SU-2016:1352
- SUSE-SU-2016:1352
- SUSE-SU-2016:1374
- SUSE-SU-2016:1374
- openSUSE-SU-2016:1251
- openSUSE-SU-2016:1251
- RHSA-2016:0695
- RHSA-2016:0695
- DSA-3559
- DSA-3559
- http://www.mozilla.org/security/announce/2016/mfsa2016-44.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-44.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- 1035692
- 1035692
- USN-2936-1
- USN-2936-1
- USN-2936-2
- USN-2936-2
- USN-2936-3
- USN-2936-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1254721
- https://bugzilla.mozilla.org/show_bug.cgi?id=1254721
- GLSA-201701-15
- GLSA-201701-15
Modified: 2024-11-21
CVE-2016-2816
Mozilla Firefox before 46.0 allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via the multipart/x-mixed-replace content type.
- openSUSE-SU-2016:1211
- openSUSE-SU-2016:1211
- openSUSE-SU-2016:1251
- openSUSE-SU-2016:1251
- http://www.mozilla.org/security/announce/2016/mfsa2016-45.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-45.html
- 1035692
- 1035692
- USN-2936-1
- USN-2936-1
- USN-2936-2
- USN-2936-2
- USN-2936-3
- USN-2936-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1223743
- https://bugzilla.mozilla.org/show_bug.cgi?id=1223743
- GLSA-201701-15
- GLSA-201701-15
Modified: 2024-11-21
CVE-2016-2817
The WebExtension sandbox feature in browser/components/extensions/ext-tabs.js in Mozilla Firefox before 46.0 does not properly restrict principal inheritance during chrome.tabs.create and chrome.tabs.update API calls, which allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted extension that accesses a (1) javascript: or (2) data: URL.
- openSUSE-SU-2016:1211
- openSUSE-SU-2016:1211
- openSUSE-SU-2016:1251
- openSUSE-SU-2016:1251
- http://www.mozilla.org/security/announce/2016/mfsa2016-46.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-46.html
- 1035692
- 1035692
- USN-2936-1
- USN-2936-1
- USN-2936-2
- USN-2936-2
- USN-2936-3
- USN-2936-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1227462
- https://bugzilla.mozilla.org/show_bug.cgi?id=1227462
- GLSA-201701-15
- GLSA-201701-15
Modified: 2024-11-21
CVE-2016-2820
The Firefox Health Reports (aka FHR or about:healthreport) feature in Mozilla Firefox before 46.0 does not properly restrict the origin of events, which makes it easier for remote attackers to modify sharing preferences by leveraging access to the remote-report IFRAME element.
- openSUSE-SU-2016:1211
- openSUSE-SU-2016:1211
- openSUSE-SU-2016:1251
- openSUSE-SU-2016:1251
- http://www.mozilla.org/security/announce/2016/mfsa2016-48.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-48.html
- 1035692
- 1035692
- USN-2936-1
- USN-2936-1
- USN-2936-2
- USN-2936-2
- USN-2936-3
- USN-2936-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=870870
- https://bugzilla.mozilla.org/show_bug.cgi?id=870870
- GLSA-201701-15
- GLSA-201701-15
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
Closed bugs
Добавить поддержку GStreamer 1.0
Package thunderbird updated to version 45.3.0-alt0.M70C.1 for branch c7 in task 168870.
Closed vulnerabilities
BDU:2015-09884
Уязвимости браузера Firefox, позволяющие удалённому злоумышленнику вызвать отказ в обслуживании
BDU:2015-09885
Уязвимости браузера Firefox ESR, позволяющие удалённому злоумышленнику вызвать отказ в обслуживании
BDU:2015-09886
Уязвимости почтового клиента Thunderbird, позволяющие удалённому злоумышленнику вызвать отказ в обслуживании
BDU:2015-09888
Уязвимость браузера Firefox, позволяющая удалённому злоумышленнику выполнить произвольный JavaScript-код
BDU:2015-09889
Уязвимость браузера Firefox ESR, позволяющая удалённому злоумышленнику выполнить произвольный JavaScript-код
BDU:2015-09890
Уязвимость почтового клиента Thunderbird, позволяющая удалённому злоумышленнику выполнить произвольный JavaScript-код
BDU:2015-09893
Уязвимость браузера Firefox, позволяющая удалённому злоумышленнику подделать межсайтовые запросы
BDU:2015-09894
Уязвимость браузера Firefox ESR, позволяющая удалённому злоумышленнику подделать межсайтовые запросы
BDU:2015-09895
Уязвимость почтового клиента Thunderbird, позволяющая удалённому злоумышленнику подделать межсайтовые запросы
BDU:2015-09900
Уязвимость браузера Firefox, позволяющая удалённому злоумышленнику выполнить произвольный JavaScript-код
BDU:2015-09901
Уязвимость браузера Firefox ESR, позволяющая удалённому злоумышленнику выполнить произвольный JavaScript-код
BDU:2015-09902
Уязвимость почтового клиента Thunderbird, позволяющая удалённому злоумышленнику выполнить произвольный JavaScript-код
BDU:2015-10552
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-10553
Уязвимость браузера Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-10554
Уязвимость почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-10555
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-10556
Уязвимость браузера Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-10557
Уязвимость почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2015-10559
Уязвимость браузера Firefox, позволяющая нарушителю выполнить произвольный код на стороне клиента
BDU:2015-10560
Уязвимость браузера Firefox ESR, позволяющая нарушителю выполнить произвольный код на стороне клиента
BDU:2015-10561
Уязвимость почтового клиента Thunderbird, позволяющая нарушителю выполнить произвольный код на стороне клиента
BDU:2015-10564
Уязвимость браузера Firefox, позволяющая нарушителю читать данные из неинициализированных областей памяти
BDU:2015-10565
Уязвимость браузера Firefox ESR, позволяющая нарушителю читать данные из неинициализированных областей памяти
BDU:2015-10566
Уязвимость почтового клиента Thunderbird, позволяющая нарушителю читать данные из неинициализированных областей памяти
BDU:2015-10567
Уязвимость браузера Firefox, позволяющая нарушителю читать данные из неинициализированных областей памяти
BDU:2015-10568
Уязвимость браузера Firefox ESR, позволяющая нарушителю читать данные из неинициализированных областей памяти
BDU:2015-10569
Уязвимость почтового клиента Thunderbird, позволяющая нарушителю читать данные из неинициализированных областей памяти
BDU:2015-10570
Уязвимость браузера Firefox, позволяющая нарушителю читать данные из неинициализированных областей памяти
BDU:2015-10571
Уязвимость браузера Firefox ESR, позволяющая нарушителю читать данные из неинициализированных областей памяти
BDU:2015-10572
Уязвимость почтового клиента Thunderbird, позволяющая нарушителю читать данные из неинициализированных областей памяти
BDU:2015-10573
Уязвимость браузера Firefox, позволяющая нарушителю получить доступ к содержимому ячеек памяти
BDU:2015-10574
Уязвимость браузера Firefox ESR, позволяющая нарушителю получить доступ к содержимому ячеек памяти
BDU:2015-10575
Уязвимость почтового клиента Thunderbird, позволяющая нарушителю получить доступ к содержимому ячеек памяти
BDU:2015-10576
Уязвимость браузера Firefox, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2015-10577
Уязвимость браузера Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2015-10578
Уязвимость почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2015-10812
Уязвимость браузера Firefox, позволяющая нарушителю повлиять на работу программы
BDU:2015-10813
Уязвимость браузера Firefox ESR, позволяющая нарушителю повлиять на работу программы
BDU:2015-10814
Уязвимость почтового клиента Thunderbird, позволяющая нарушителю повлиять на работу программы
BDU:2015-10815
Уязвимость браузера Firefox, позволяющая нарушителю повлиять на работу программы
BDU:2015-10816
Уязвимость браузера Firefox ESR, позволяющая нарушителю повлиять на работу программы
BDU:2015-10817
Уязвимость почтового клиента Thunderbird, позволяющая нарушителю повлиять на работу программы
BDU:2016-00573
Уязвимость браузеров Firefox ESR и Firefox, программного средства рендеринга Graphite 2, почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании, получить конфиденциальную информацию или выполнить произвольный код
BDU:2016-00574
Уязвимость браузера Firefox ESR, программного средства рендеринга Graphite 2, почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-00575
Уязвимость браузера Firefox ESR, программного средства рендеринга Graphite 2, почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2016-00576
Уязвимость браузера Firefox ESR, программного средства рендеринга Graphite 2, почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании или получить конфиденциальную информацию
BDU:2016-00744
Уязвимость почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-00752
Уязвимость почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-00754
Уязвимость почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-00757
Уязвимость почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код
BDU:2016-00758
Уязвимость почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-00761
Уязвимость почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2016-00764
Уязвимость почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или повысить свои привилегии
BDU:2016-00765
Уязвимости почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющие нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2016-00766
Уязвимости почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющие нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2021-03335
Уязвимость браузера Mozilla Firefox, вызванная переполнением буфера, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2011-3079
The Inter-process Communication (IPC) implementation in Google Chrome before 18.0.1025.168, as used in Mozilla Firefox before 38.0 and other products, does not properly validate messages, which has unspecified impact and attack vectors.
- http://code.google.com/p/chromium/issues/detail?id=117627
- http://googlechromereleases.blogspot.com/2012/04/stable-channel-update_30.html
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0934
- 81645
- RHSA-2015:1012
- 48992
- DSA-3260
- http://www.mozilla.org/security/announce/2015/mfsa2015-57.html
- 53309
- 1027001
- https://bugzilla.mozilla.org/show_bug.cgi?id=1087565
- chrome-ipc-validation-code-execution(75271)
- oval:org.mitre.oval:def:14964
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
- http://code.google.com/p/chromium/issues/detail?id=117627
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
- oval:org.mitre.oval:def:14964
- chrome-ipc-validation-code-execution(75271)
- https://bugzilla.mozilla.org/show_bug.cgi?id=1087565
- 1027001
- 53309
- http://www.mozilla.org/security/announce/2015/mfsa2015-57.html
- DSA-3260
- 48992
- RHSA-2015:1012
- 81645
- openSUSE-SU-2015:0934
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0892
- http://googlechromereleases.blogspot.com/2012/04/stable-channel-update_30.html
Modified: 2024-11-21
CVE-2014-8634
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- http://linux.oracle.com/errata/ELSA-2015-0046.html
- http://linux.oracle.com/errata/ELSA-2015-0046.html
- http://linux.oracle.com/errata/ELSA-2015-0047.html
- http://linux.oracle.com/errata/ELSA-2015-0047.html
- openSUSE-SU-2015:0077
- openSUSE-SU-2015:0077
- SUSE-SU-2015:0171
- SUSE-SU-2015:0171
- SUSE-SU-2015:0173
- SUSE-SU-2015:0173
- SUSE-SU-2015:0180
- SUSE-SU-2015:0180
- openSUSE-SU-2015:0192
- openSUSE-SU-2015:0192
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0133
- openSUSE-SU-2015:0133
- RHSA-2015:0046
- RHSA-2015:0046
- RHSA-2015:0047
- RHSA-2015:0047
- 62237
- 62237
- 62242
- 62242
- 62250
- 62250
- 62253
- 62253
- 62259
- 62259
- 62273
- 62273
- 62274
- 62274
- 62283
- 62283
- 62293
- 62293
- 62304
- 62304
- 62313
- 62313
- 62315
- 62315
- 62316
- 62316
- 62418
- 62418
- 62446
- 62446
- 62657
- 62657
- 62790
- 62790
- DSA-3127
- DSA-3127
- DSA-3132
- DSA-3132
- http://www.mozilla.org/security/announce/2014/mfsa2015-01.html
- http://www.mozilla.org/security/announce/2014/mfsa2015-01.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 72049
- 72049
- 1031533
- 1031533
- 1031534
- 1031534
- USN-2460-1
- USN-2460-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1109889
- https://bugzilla.mozilla.org/show_bug.cgi?id=1109889
- https://bugzilla.mozilla.org/show_bug.cgi?id=1111737
- https://bugzilla.mozilla.org/show_bug.cgi?id=1111737
- firefox-cve20148634-code-exec(99955)
- firefox-cve20148634-code-exec(99955)
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-8638
The navigator.sendBeacon implementation in Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 omits the CORS Origin header, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site.
- http://linux.oracle.com/errata/ELSA-2015-0046.html
- http://linux.oracle.com/errata/ELSA-2015-0046.html
- http://linux.oracle.com/errata/ELSA-2015-0047.html
- http://linux.oracle.com/errata/ELSA-2015-0047.html
- openSUSE-SU-2015:0077
- openSUSE-SU-2015:0077
- SUSE-SU-2015:0171
- SUSE-SU-2015:0171
- SUSE-SU-2015:0173
- SUSE-SU-2015:0173
- SUSE-SU-2015:0180
- SUSE-SU-2015:0180
- openSUSE-SU-2015:0192
- openSUSE-SU-2015:0192
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0133
- openSUSE-SU-2015:0133
- RHSA-2015:0046
- RHSA-2015:0046
- RHSA-2015:0047
- RHSA-2015:0047
- 62237
- 62237
- 62242
- 62242
- 62250
- 62250
- 62253
- 62253
- 62259
- 62259
- 62273
- 62273
- 62274
- 62274
- 62283
- 62283
- 62293
- 62293
- 62304
- 62304
- 62313
- 62313
- 62315
- 62315
- 62316
- 62316
- 62418
- 62418
- 62446
- 62446
- 62657
- 62657
- 62790
- 62790
- DSA-3127
- DSA-3127
- DSA-3132
- DSA-3132
- http://www.mozilla.org/security/announce/2014/mfsa2015-03.html
- http://www.mozilla.org/security/announce/2014/mfsa2015-03.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 72047
- 72047
- 1031533
- 1031533
- 1031534
- 1031534
- USN-2460-1
- USN-2460-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1080987
- https://bugzilla.mozilla.org/show_bug.cgi?id=1080987
- firefox-cve20148638-csrf(99958)
- firefox-cve20148638-csrf(99958)
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-8639
Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 (aka Proxy Authentication Required) status code, which allows remote HTTP proxy servers to conduct session fixation attacks by providing a cookie name that corresponds to the session cookie of the origin server.
- http://linux.oracle.com/errata/ELSA-2015-0046.html
- http://linux.oracle.com/errata/ELSA-2015-0046.html
- http://linux.oracle.com/errata/ELSA-2015-0047.html
- http://linux.oracle.com/errata/ELSA-2015-0047.html
- openSUSE-SU-2015:0077
- openSUSE-SU-2015:0077
- SUSE-SU-2015:0171
- SUSE-SU-2015:0171
- SUSE-SU-2015:0173
- SUSE-SU-2015:0173
- SUSE-SU-2015:0180
- SUSE-SU-2015:0180
- openSUSE-SU-2015:0192
- openSUSE-SU-2015:0192
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0133
- openSUSE-SU-2015:0133
- RHSA-2015:0046
- RHSA-2015:0046
- RHSA-2015:0047
- RHSA-2015:0047
- 62237
- 62237
- 62242
- 62242
- 62250
- 62250
- 62253
- 62253
- 62259
- 62259
- 62273
- 62273
- 62274
- 62274
- 62283
- 62283
- 62293
- 62293
- 62304
- 62304
- 62313
- 62313
- 62315
- 62315
- 62316
- 62316
- 62418
- 62418
- 62446
- 62446
- 62657
- 62657
- 62790
- 62790
- DSA-3127
- DSA-3127
- DSA-3132
- DSA-3132
- http://www.mozilla.org/security/announce/2014/mfsa2015-04.html
- http://www.mozilla.org/security/announce/2014/mfsa2015-04.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 72046
- 72046
- 1031533
- 1031533
- 1031534
- 1031534
- USN-2460-1
- USN-2460-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1095859
- https://bugzilla.mozilla.org/show_bug.cgi?id=1095859
- firefox-cve20148639-session-hijacking(99959)
- firefox-cve20148639-session-hijacking(99959)
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0801
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818.
- openSUSE-SU-2015:0677
- openSUSE-SU-2015:0677
- SUSE-SU-2015:0704
- SUSE-SU-2015:0704
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- RHSA-2015:0766
- RHSA-2015:0766
- RHSA-2015:0771
- RHSA-2015:0771
- DSA-3211
- DSA-3211
- DSA-3212
- DSA-3212
- http://www.mozilla.org/security/announce/2015/mfsa2015-40.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-40.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 73455
- 73455
- 1031996
- 1031996
- 1032000
- 1032000
- USN-2550-1
- USN-2550-1
- USN-2552-1
- USN-2552-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1146339
- https://bugzilla.mozilla.org/show_bug.cgi?id=1146339
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-0807
The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site, a similar issue to CVE-2014-8638.
- openSUSE-SU-2015:0677
- openSUSE-SU-2015:0677
- SUSE-SU-2015:0704
- SUSE-SU-2015:0704
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- RHSA-2015:0766
- RHSA-2015:0766
- RHSA-2015:0771
- RHSA-2015:0771
- DSA-3211
- DSA-3211
- DSA-3212
- DSA-3212
- http://www.mozilla.org/security/announce/2015/mfsa2015-37.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-37.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 73457
- 73457
- 1031996
- 1031996
- 1032000
- 1032000
- USN-2550-1
- USN-2550-1
- USN-2552-1
- USN-2552-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1111834
- https://bugzilla.mozilla.org/show_bug.cgi?id=1111834
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-0815
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2015:0677
- openSUSE-SU-2015:0677
- SUSE-SU-2015:0704
- SUSE-SU-2015:0704
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- RHSA-2015:0766
- RHSA-2015:0766
- RHSA-2015:0771
- RHSA-2015:0771
- DSA-3211
- DSA-3211
- DSA-3212
- DSA-3212
- http://www.mozilla.org/security/announce/2015/mfsa2015-30.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-30.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 73466
- 73466
- 1031996
- 1031996
- 1032000
- 1032000
- USN-2550-1
- USN-2550-1
- USN-2552-1
- USN-2552-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1036515
- https://bugzilla.mozilla.org/show_bug.cgi?id=1036515
- https://bugzilla.mozilla.org/show_bug.cgi?id=1137326
- https://bugzilla.mozilla.org/show_bug.cgi?id=1137326
- https://bugzilla.mozilla.org/show_bug.cgi?id=1138199
- https://bugzilla.mozilla.org/show_bug.cgi?id=1138199
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-0816
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js.
- openSUSE-SU-2015:0677
- openSUSE-SU-2015:0677
- SUSE-SU-2015:0704
- SUSE-SU-2015:0704
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- RHSA-2015:0766
- RHSA-2015:0766
- RHSA-2015:0771
- RHSA-2015:0771
- DSA-3211
- DSA-3211
- DSA-3212
- DSA-3212
- http://www.mozilla.org/security/announce/2015/mfsa2015-33.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-33.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 73461
- 73461
- 1031996
- 1031996
- 1032000
- 1032000
- USN-2550-1
- USN-2550-1
- USN-2552-1
- USN-2552-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1144991
- https://bugzilla.mozilla.org/show_bug.cgi?id=1144991
- GLSA-201512-10
- GLSA-201512-10
- 37958
- 37958
Modified: 2024-11-21
CVE-2015-0822
The Form Autocompletion feature in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to read arbitrary files via crafted JavaScript code.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- SUSE-SU-2015:0412
- SUSE-SU-2015:0412
- SUSE-SU-2015:0446
- SUSE-SU-2015:0446
- SUSE-SU-2015:0447
- SUSE-SU-2015:0447
- openSUSE-SU-2015:0448
- openSUSE-SU-2015:0448
- openSUSE-SU-2015:0567
- openSUSE-SU-2015:0567
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- RHSA-2015:0265
- RHSA-2015:0265
- RHSA-2015:0266
- RHSA-2015:0266
- RHSA-2015:0642
- RHSA-2015:0642
- DSA-3174
- DSA-3174
- DSA-3179
- DSA-3179
- http://www.mozilla.org/security/announce/2015/mfsa2015-24.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-24.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 72756
- 72756
- 1031791
- 1031791
- 1031792
- 1031792
- USN-2505-1
- USN-2505-1
- USN-2506-1
- USN-2506-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1110557
- https://bugzilla.mozilla.org/show_bug.cgi?id=1110557
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0827
Heap-based buffer overflow in the mozilla::gfx::CopyRect function in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to obtain sensitive information from uninitialized process memory via a malformed SVG graphic.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- SUSE-SU-2015:0412
- SUSE-SU-2015:0412
- SUSE-SU-2015:0446
- SUSE-SU-2015:0446
- SUSE-SU-2015:0447
- SUSE-SU-2015:0447
- openSUSE-SU-2015:0448
- openSUSE-SU-2015:0448
- openSUSE-SU-2015:0567
- openSUSE-SU-2015:0567
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- RHSA-2015:0265
- RHSA-2015:0265
- RHSA-2015:0266
- RHSA-2015:0266
- RHSA-2015:0642
- RHSA-2015:0642
- DSA-3174
- DSA-3174
- DSA-3179
- DSA-3179
- http://www.mozilla.org/security/announce/2015/mfsa2015-19.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-19.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 72755
- 72755
- 1031791
- 1031791
- 1031792
- 1031792
- USN-2505-1
- USN-2505-1
- USN-2506-1
- USN-2506-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1117304
- https://bugzilla.mozilla.org/show_bug.cgi?id=1117304
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0831
Use-after-free vulnerability in the mozilla::dom::IndexedDB::IDBObjectStore::CreateIndex function in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted content that is improperly handled during IndexedDB index creation.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- SUSE-SU-2015:0412
- SUSE-SU-2015:0412
- SUSE-SU-2015:0446
- SUSE-SU-2015:0446
- SUSE-SU-2015:0447
- SUSE-SU-2015:0447
- openSUSE-SU-2015:0448
- openSUSE-SU-2015:0448
- openSUSE-SU-2015:0567
- openSUSE-SU-2015:0567
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- RHSA-2015:0265
- RHSA-2015:0265
- RHSA-2015:0266
- RHSA-2015:0266
- RHSA-2015:0642
- RHSA-2015:0642
- DSA-3174
- DSA-3174
- DSA-3179
- DSA-3179
- http://www.mozilla.org/security/announce/2015/mfsa2015-16.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-16.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 72746
- 72746
- 1031791
- 1031791
- 1031792
- 1031792
- USN-2505-1
- USN-2505-1
- USN-2506-1
- USN-2506-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1130541
- https://bugzilla.mozilla.org/show_bug.cgi?id=1130541
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-0836
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2015:0404
- openSUSE-SU-2015:0404
- SUSE-SU-2015:0412
- SUSE-SU-2015:0412
- SUSE-SU-2015:0446
- SUSE-SU-2015:0446
- SUSE-SU-2015:0447
- SUSE-SU-2015:0447
- openSUSE-SU-2015:0448
- openSUSE-SU-2015:0448
- openSUSE-SU-2015:0567
- openSUSE-SU-2015:0567
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0570
- openSUSE-SU-2015:0570
- RHSA-2015:0265
- RHSA-2015:0265
- RHSA-2015:0266
- RHSA-2015:0266
- RHSA-2015:0642
- RHSA-2015:0642
- DSA-3174
- DSA-3174
- DSA-3179
- DSA-3179
- http://www.mozilla.org/security/announce/2015/mfsa2015-11.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-11.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 72742
- 72742
- 1031791
- 1031791
- 1031792
- 1031792
- USN-2505-1
- USN-2505-1
- USN-2506-1
- USN-2506-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1096138
- https://bugzilla.mozilla.org/show_bug.cgi?id=1096138
- https://bugzilla.mozilla.org/show_bug.cgi?id=1107009
- https://bugzilla.mozilla.org/show_bug.cgi?id=1107009
- https://bugzilla.mozilla.org/show_bug.cgi?id=1111243
- https://bugzilla.mozilla.org/show_bug.cgi?id=1111243
- https://bugzilla.mozilla.org/show_bug.cgi?id=1111248
- https://bugzilla.mozilla.org/show_bug.cgi?id=1111248
- https://bugzilla.mozilla.org/show_bug.cgi?id=1115776
- https://bugzilla.mozilla.org/show_bug.cgi?id=1115776
- https://bugzilla.mozilla.org/show_bug.cgi?id=1117406
- https://bugzilla.mozilla.org/show_bug.cgi?id=1117406
- https://bugzilla.mozilla.org/show_bug.cgi?id=1119579
- https://bugzilla.mozilla.org/show_bug.cgi?id=1119579
- https://bugzilla.mozilla.org/show_bug.cgi?id=1123882
- https://bugzilla.mozilla.org/show_bug.cgi?id=1123882
- https://bugzilla.mozilla.org/show_bug.cgi?id=1124018
- https://bugzilla.mozilla.org/show_bug.cgi?id=1124018
- https://bugzilla.mozilla.org/show_bug.cgi?id=1128196
- https://bugzilla.mozilla.org/show_bug.cgi?id=1128196
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2015-2708
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:0892
- SUSE-SU-2015:0960
- SUSE-SU-2015:0960
- SUSE-SU-2015:0978
- SUSE-SU-2015:0978
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0934
- openSUSE-SU-2015:0934
- RHSA-2015:0988
- RHSA-2015:0988
- RHSA-2015:1012
- RHSA-2015:1012
- DSA-3260
- DSA-3260
- DSA-3264
- DSA-3264
- http://www.mozilla.org/security/announce/2015/mfsa2015-46.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-46.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 74615
- 74615
- USN-2602-1
- USN-2602-1
- USN-2603-1
- USN-2603-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1120655
- https://bugzilla.mozilla.org/show_bug.cgi?id=1120655
- https://bugzilla.mozilla.org/show_bug.cgi?id=1143299
- https://bugzilla.mozilla.org/show_bug.cgi?id=1143299
- https://bugzilla.mozilla.org/show_bug.cgi?id=1151139
- https://bugzilla.mozilla.org/show_bug.cgi?id=1151139
- https://bugzilla.mozilla.org/show_bug.cgi?id=1152177
- https://bugzilla.mozilla.org/show_bug.cgi?id=1152177
- GLSA-201605-06
- GLSA-201605-06
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
Modified: 2024-11-21
CVE-2015-2710
Heap-based buffer overflow in the SVGTextFrame class in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code via crafted SVG graphics data in conjunction with a crafted Cascading Style Sheets (CSS) token sequence.
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:0892
- SUSE-SU-2015:0960
- SUSE-SU-2015:0960
- SUSE-SU-2015:0978
- SUSE-SU-2015:0978
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0934
- openSUSE-SU-2015:0934
- RHSA-2015:0988
- RHSA-2015:0988
- RHSA-2015:1012
- RHSA-2015:1012
- DSA-3260
- DSA-3260
- DSA-3264
- DSA-3264
- http://www.mozilla.org/security/announce/2015/mfsa2015-48.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-48.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 74611
- 74611
- USN-2602-1
- USN-2602-1
- USN-2603-1
- USN-2603-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1149542
- https://bugzilla.mozilla.org/show_bug.cgi?id=1149542
- GLSA-201605-06
- GLSA-201605-06
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
Modified: 2024-11-21
CVE-2015-2713
Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a document containing crafted text in conjunction with a Cascading Style Sheets (CSS) token sequence containing properties related to vertical text.
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:0892
- SUSE-SU-2015:0960
- SUSE-SU-2015:0960
- SUSE-SU-2015:0978
- SUSE-SU-2015:0978
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0934
- openSUSE-SU-2015:0934
- RHSA-2015:0988
- RHSA-2015:0988
- RHSA-2015:1012
- RHSA-2015:1012
- DSA-3260
- DSA-3260
- DSA-3264
- DSA-3264
- http://www.mozilla.org/security/announce/2015/mfsa2015-51.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-51.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 74611
- 74611
- USN-2602-1
- USN-2602-1
- USN-2603-1
- USN-2603-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1153478
- https://bugzilla.mozilla.org/show_bug.cgi?id=1153478
- GLSA-201605-06
- GLSA-201605-06
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
Modified: 2024-11-21
CVE-2015-2716
Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.
- openSUSE-SU-2015:0892
- openSUSE-SU-2015:0892
- SUSE-SU-2015:0960
- SUSE-SU-2015:0960
- SUSE-SU-2015:0978
- SUSE-SU-2015:0978
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:0934
- openSUSE-SU-2015:0934
- RHSA-2015:0988
- RHSA-2015:0988
- RHSA-2015:1012
- RHSA-2015:1012
- DSA-3260
- DSA-3260
- DSA-3264
- DSA-3264
- http://www.mozilla.org/security/announce/2015/mfsa2015-54.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-54.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 74611
- 74611
- USN-2602-1
- USN-2602-1
- USN-2603-1
- USN-2603-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1140537
- https://bugzilla.mozilla.org/show_bug.cgi?id=1140537
- https://hg.mozilla.org/releases/mozilla-esr31/rev/2f3e78643f5c
- https://hg.mozilla.org/releases/mozilla-esr31/rev/2f3e78643f5c
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365
- GLSA-201605-06
- GLSA-201605-06
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7
- https://www.tenable.com/security/tns-2016-20
- https://www.tenable.com/security/tns-2016-20
Modified: 2024-11-21
CVE-2015-2724
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- DSA-3300
- DSA-3300
- DSA-3324
- DSA-3324
- http://www.mozilla.org/security/announce/2015/mfsa2015-59.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-59.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- USN-2673-1
- USN-2673-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1143679
- https://bugzilla.mozilla.org/show_bug.cgi?id=1143679
- https://bugzilla.mozilla.org/show_bug.cgi?id=1154876
- https://bugzilla.mozilla.org/show_bug.cgi?id=1154876
- https://bugzilla.mozilla.org/show_bug.cgi?id=1160884
- https://bugzilla.mozilla.org/show_bug.cgi?id=1160884
- https://bugzilla.mozilla.org/show_bug.cgi?id=1164567
- https://bugzilla.mozilla.org/show_bug.cgi?id=1164567
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2725
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- http://www.mozilla.org/security/announce/2015/mfsa2015-59.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-59.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1056410
- https://bugzilla.mozilla.org/show_bug.cgi?id=1056410
- https://bugzilla.mozilla.org/show_bug.cgi?id=1151650
- https://bugzilla.mozilla.org/show_bug.cgi?id=1151650
- https://bugzilla.mozilla.org/show_bug.cgi?id=1156861
- https://bugzilla.mozilla.org/show_bug.cgi?id=1156861
- https://bugzilla.mozilla.org/show_bug.cgi?id=1159321
- https://bugzilla.mozilla.org/show_bug.cgi?id=1159321
- https://bugzilla.mozilla.org/show_bug.cgi?id=1159973
- https://bugzilla.mozilla.org/show_bug.cgi?id=1159973
- https://bugzilla.mozilla.org/show_bug.cgi?id=1163359
- https://bugzilla.mozilla.org/show_bug.cgi?id=1163359
- https://bugzilla.mozilla.org/show_bug.cgi?id=1163852
- https://bugzilla.mozilla.org/show_bug.cgi?id=1163852
- https://bugzilla.mozilla.org/show_bug.cgi?id=1172076
- https://bugzilla.mozilla.org/show_bug.cgi?id=1172076
- https://bugzilla.mozilla.org/show_bug.cgi?id=1172397
- https://bugzilla.mozilla.org/show_bug.cgi?id=1172397
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2729
The AudioParamTimeline::AudioNodeInputValue function in the Web Audio implementation in Mozilla Firefox before 39.0 and Firefox ESR 38.x before 38.1 does not properly calculate an oscillator rendering range, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspecified vectors.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- RHSA-2015:1207
- RHSA-2015:1207
- http://www.mozilla.org/security/announce/2015/mfsa2015-62.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-62.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1122218
- https://bugzilla.mozilla.org/show_bug.cgi?id=1122218
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2731
Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allows remote attackers to execute arbitrary code by leveraging client-side JavaScript that triggers removal of a DOM object on the basis of a Content Policy.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- DSA-3300
- DSA-3300
- http://www.mozilla.org/security/announce/2015/mfsa2015-63.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-63.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1149891
- https://bugzilla.mozilla.org/show_bug.cgi?id=1149891
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2734
The CairoTextureClientD3D9::BorrowDrawTarget function in the Direct3D 9 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- DSA-3300
- DSA-3300
- DSA-3324
- DSA-3324
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- USN-2673-1
- USN-2673-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1166082
- https://bugzilla.mozilla.org/show_bug.cgi?id=1166082
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2735
nsZipArchive.cpp in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- DSA-3300
- DSA-3300
- DSA-3324
- DSA-3324
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- USN-2673-1
- USN-2673-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1166900
- https://bugzilla.mozilla.org/show_bug.cgi?id=1166900
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2736
The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- DSA-3300
- DSA-3300
- DSA-3324
- DSA-3324
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- USN-2673-1
- USN-2673-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1167888
- https://bugzilla.mozilla.org/show_bug.cgi?id=1167888
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2737
The rx::d3d11::SetBufferData function in the Direct3D 11 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- DSA-3300
- DSA-3300
- DSA-3324
- DSA-3324
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- USN-2673-1
- USN-2673-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1167332
- https://bugzilla.mozilla.org/show_bug.cgi?id=1167332
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2738
The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- DSA-3300
- DSA-3300
- DSA-3324
- DSA-3324
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- USN-2673-1
- USN-2673-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1167356
- https://bugzilla.mozilla.org/show_bug.cgi?id=1167356
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2739
The ArrayBufferBuilder::append function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which has unspecified impact and attack vectors.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- DSA-3300
- DSA-3300
- DSA-3324
- DSA-3324
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- USN-2673-1
- USN-2673-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1168207
- https://bugzilla.mozilla.org/show_bug.cgi?id=1168207
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2015-2740
Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 might allow remote attackers to cause a denial of service or have unspecified other impact via unknown vectors.
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1229
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- SUSE-SU-2015:1268
- SUSE-SU-2015:1268
- SUSE-SU-2015:1269
- SUSE-SU-2015:1269
- SUSE-SU-2015:1449
- SUSE-SU-2015:1449
- RHSA-2015:1207
- RHSA-2015:1207
- RHSA-2015:1455
- RHSA-2015:1455
- DSA-3300
- DSA-3300
- DSA-3324
- DSA-3324
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-66.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- 75541
- 75541
- 1032783
- 1032783
- 1032784
- 1032784
- USN-2656-1
- USN-2656-1
- USN-2656-2
- USN-2656-2
- USN-2673-1
- USN-2673-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1170809
- https://bugzilla.mozilla.org/show_bug.cgi?id=1170809
- GLSA-201512-10
- GLSA-201512-10
Modified: 2024-11-21
CVE-2016-1521
The directrun function in directmachine.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not validate a certain skip operation, which allows remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.
- http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html
- http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html
- FEDORA-2016-4154a4d0ba
- FEDORA-2016-4154a4d0ba
- FEDORA-2016-338a7e9925
- FEDORA-2016-338a7e9925
- SUSE-SU-2016:0779
- SUSE-SU-2016:0779
- openSUSE-SU-2016:0791
- openSUSE-SU-2016:0791
- openSUSE-SU-2016:0875
- openSUSE-SU-2016:0875
- RHSA-2016:0197
- RHSA-2016:0197
- RHSA-2016:0258
- RHSA-2016:0258
- RHSA-2016:0594
- RHSA-2016:0594
- DSA-3479
- DSA-3479
- http://www.mozilla.org/security/announce/2016/mfsa2016-14.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-14.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 82991
- 82991
- USN-2902-1
- USN-2902-1
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- GLSA-201701-35
- GLSA-201701-35
- GLSA-201701-63
- GLSA-201701-63
Modified: 2024-11-21
CVE-2016-1522
Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.
- http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html
- http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html
- FEDORA-2016-4154a4d0ba
- FEDORA-2016-4154a4d0ba
- FEDORA-2016-338a7e9925
- FEDORA-2016-338a7e9925
- openSUSE-SU-2016:0791
- openSUSE-SU-2016:0791
- RHSA-2016:0197
- RHSA-2016:0197
- RHSA-2016:0258
- RHSA-2016:0258
- RHSA-2016:0594
- RHSA-2016:0594
- DSA-3479
- DSA-3479
- http://www.mozilla.org/security/announce/2016/mfsa2016-14.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-14.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 82991
- 82991
- USN-2902-1
- USN-2902-1
- GLSA-201701-35
- GLSA-201701-35
- GLSA-201701-63
- GLSA-201701-63
Modified: 2024-11-21
CVE-2016-1523
The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font.
- http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html
- http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html
- FEDORA-2016-4154a4d0ba
- FEDORA-2016-4154a4d0ba
- FEDORA-2016-338a7e9925
- FEDORA-2016-338a7e9925
- SUSE-SU-2016:0554
- SUSE-SU-2016:0554
- SUSE-SU-2016:0564
- SUSE-SU-2016:0564
- SUSE-SU-2016:0779
- SUSE-SU-2016:0779
- openSUSE-SU-2016:0791
- openSUSE-SU-2016:0791
- openSUSE-SU-2016:0875
- openSUSE-SU-2016:0875
- RHSA-2016:0197
- RHSA-2016:0197
- RHSA-2016:0258
- RHSA-2016:0258
- RHSA-2016:0594
- RHSA-2016:0594
- DSA-3477
- DSA-3477
- DSA-3479
- DSA-3479
- DSA-3491
- DSA-3491
- http://www.mozilla.org/security/announce/2016/mfsa2016-14.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-14.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 82991
- 82991
- 1035017
- 1035017
- USN-2902-1
- USN-2902-1
- USN-2904-1
- USN-2904-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1246093
- https://bugzilla.mozilla.org/show_bug.cgi?id=1246093
- GLSA-201605-06
- GLSA-201605-06
- GLSA-201701-35
- GLSA-201701-35
- GLSA-201701-63
- GLSA-201701-63
Modified: 2024-11-21
CVE-2016-1526
The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.
- http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html
- http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html
- FEDORA-2016-4154a4d0ba
- FEDORA-2016-4154a4d0ba
- FEDORA-2016-338a7e9925
- FEDORA-2016-338a7e9925
- SUSE-SU-2016:0779
- SUSE-SU-2016:0779
- openSUSE-SU-2016:0791
- openSUSE-SU-2016:0791
- openSUSE-SU-2016:0875
- openSUSE-SU-2016:0875
- RHSA-2016:0594
- RHSA-2016:0594
- RHSA-2016:0695
- RHSA-2016:0695
- DSA-3479
- DSA-3479
- http://www.mozilla.org/security/announce/2016/mfsa2016-14.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-14.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- 82991
- 82991
- USN-2902-1
- USN-2902-1
- GLSA-201701-35
- GLSA-201701-35
- GLSA-201701-63
- GLSA-201701-63
Modified: 2024-11-21
CVE-2016-1952
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- http://www.mozilla.org/security/announce/2016/mfsa2016-16.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-16.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1123661
- https://bugzilla.mozilla.org/show_bug.cgi?id=1123661
- https://bugzilla.mozilla.org/show_bug.cgi?id=1221872
- https://bugzilla.mozilla.org/show_bug.cgi?id=1221872
- https://bugzilla.mozilla.org/show_bug.cgi?id=1224979
- https://bugzilla.mozilla.org/show_bug.cgi?id=1224979
- https://bugzilla.mozilla.org/show_bug.cgi?id=1234578
- https://bugzilla.mozilla.org/show_bug.cgi?id=1234578
- https://bugzilla.mozilla.org/show_bug.cgi?id=1241217
- https://bugzilla.mozilla.org/show_bug.cgi?id=1241217
- https://bugzilla.mozilla.org/show_bug.cgi?id=1242279
- https://bugzilla.mozilla.org/show_bug.cgi?id=1242279
- https://bugzilla.mozilla.org/show_bug.cgi?id=1244250
- https://bugzilla.mozilla.org/show_bug.cgi?id=1244250
- https://bugzilla.mozilla.org/show_bug.cgi?id=1244995
- https://bugzilla.mozilla.org/show_bug.cgi?id=1244995
- https://bugzilla.mozilla.org/show_bug.cgi?id=1249685
- https://bugzilla.mozilla.org/show_bug.cgi?id=1249685
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1953
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to js/src/jit/arm/Assembler-arm.cpp, and unknown other vectors.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- http://www.mozilla.org/security/announce/2016/mfsa2016-16.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-16.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=1199171
- https://bugzilla.mozilla.org/show_bug.cgi?id=1199171
- https://bugzilla.mozilla.org/show_bug.cgi?id=1205163
- https://bugzilla.mozilla.org/show_bug.cgi?id=1205163
- https://bugzilla.mozilla.org/show_bug.cgi?id=1207958
- https://bugzilla.mozilla.org/show_bug.cgi?id=1207958
- https://bugzilla.mozilla.org/show_bug.cgi?id=1224361
- https://bugzilla.mozilla.org/show_bug.cgi?id=1224361
- https://bugzilla.mozilla.org/show_bug.cgi?id=1224363
- https://bugzilla.mozilla.org/show_bug.cgi?id=1224363
- https://bugzilla.mozilla.org/show_bug.cgi?id=1224369
- https://bugzilla.mozilla.org/show_bug.cgi?id=1224369
- https://bugzilla.mozilla.org/show_bug.cgi?id=1225618
- https://bugzilla.mozilla.org/show_bug.cgi?id=1225618
- https://bugzilla.mozilla.org/show_bug.cgi?id=1234425
- https://bugzilla.mozilla.org/show_bug.cgi?id=1234425
- https://bugzilla.mozilla.org/show_bug.cgi?id=1236519
- https://bugzilla.mozilla.org/show_bug.cgi?id=1236519
- https://bugzilla.mozilla.org/show_bug.cgi?id=1238558
- https://bugzilla.mozilla.org/show_bug.cgi?id=1238558
- https://bugzilla.mozilla.org/show_bug.cgi?id=1238935
- https://bugzilla.mozilla.org/show_bug.cgi?id=1238935
- https://bugzilla.mozilla.org/show_bug.cgi?id=1241731
- https://bugzilla.mozilla.org/show_bug.cgi?id=1241731
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243555
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243555
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243583
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243583
- https://bugzilla.mozilla.org/show_bug.cgi?id=1245866
- https://bugzilla.mozilla.org/show_bug.cgi?id=1245866
- https://bugzilla.mozilla.org/show_bug.cgi?id=1247236
- https://bugzilla.mozilla.org/show_bug.cgi?id=1247236
- https://bugzilla.mozilla.org/show_bug.cgi?id=1248794
- https://bugzilla.mozilla.org/show_bug.cgi?id=1248794
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1954
The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not prevent use of a non-HTTP report-uri for a Content Security Policy (CSP) violation report, which allows remote attackers to cause a denial of service (data overwrite) or possibly gain privileges by specifying a URL of a local file.
- http://hg.mozilla.org/releases/mozilla-release/rev/5154bb929236
- http://hg.mozilla.org/releases/mozilla-release/rev/5154bb929236
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-17.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-17.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243178
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243178
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1957
Memory leak in libstagefright in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to cause a denial of service (memory consumption) via an MPEG-4 file that triggers a delete operation on an array.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-20.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-20.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1227052
- https://bugzilla.mozilla.org/show_bug.cgi?id=1227052
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1960
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-23.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-23.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2934-1
- USN-2934-1
- http://zerodayinitiative.com/advisories/ZDI-16-198/
- http://zerodayinitiative.com/advisories/ZDI-16-198/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1246014
- https://bugzilla.mozilla.org/show_bug.cgi?id=1246014
- GLSA-201605-06
- GLSA-201605-06
- 42484
- 42484
- 44294
- 44294
Modified: 2024-11-21
CVE-2016-1961
Use-after-free vulnerability in the nsHTMLDocument::SetBody function in dom/html/nsHTMLDocument.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of a root element, aka ZDI-CAN-3574.
- http://hg.mozilla.org/releases/mozilla-release/rev/b208427885d3
- http://hg.mozilla.org/releases/mozilla-release/rev/b208427885d3
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-24.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-24.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2934-1
- USN-2934-1
- http://zerodayinitiative.com/advisories/ZDI-16-199/
- http://zerodayinitiative.com/advisories/ZDI-16-199/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1249377
- https://bugzilla.mozilla.org/show_bug.cgi?id=1249377
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1964
Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging mishandling of XML transformations.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-27.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-27.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243335
- https://bugzilla.mozilla.org/show_bug.cgi?id=1243335
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1966
The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference and memory corruption) via a crafted NPAPI plugin.
- http://hg.mozilla.org/releases/mozilla-release/rev/f0d2911a9a4e
- http://hg.mozilla.org/releases/mozilla-release/rev/f0d2911a9a4e
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- DSA-3510
- DSA-3510
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-31.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-31.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1246054
- https://bugzilla.mozilla.org/show_bug.cgi?id=1246054
- GLSA-201605-06
- GLSA-201605-06
Modified: 2024-11-21
CVE-2016-1974
The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not verify that memory allocation succeeds, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via crafted Unicode data in an HTML, XML, or SVG document.
- SUSE-SU-2016:0727
- SUSE-SU-2016:0727
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0731
- openSUSE-SU-2016:0733
- openSUSE-SU-2016:0733
- SUSE-SU-2016:0777
- SUSE-SU-2016:0777
- SUSE-SU-2016:0820
- SUSE-SU-2016:0820
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0876
- openSUSE-SU-2016:0894
- openSUSE-SU-2016:0894
- SUSE-SU-2016:0909
- SUSE-SU-2016:0909
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1767
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1769
- openSUSE-SU-2016:1778
- openSUSE-SU-2016:1778
- DSA-3510
- DSA-3510
- DSA-3520
- DSA-3520
- http://www.mozilla.org/security/announce/2016/mfsa2016-34.html
- http://www.mozilla.org/security/announce/2016/mfsa2016-34.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1035215
- 1035215
- USN-2917-1
- USN-2917-1
- USN-2917-2
- USN-2917-2
- USN-2917-3
- USN-2917-3
- USN-2934-1
- USN-2934-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1228103
- https://bugzilla.mozilla.org/show_bug.cgi?id=1228103
- GLSA-201605-06
- GLSA-201605-06
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
Closed vulnerabilities
BDU:2014-00115
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании
BDU:2014-00116
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании
BDU:2014-00126
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании
BDU:2014-00133
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании
BDU:2014-00137
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании
BDU:2014-00142
Уязвимость браузера Google Chrome, позволяющая злоумышленнику обойти правила ограничения домена
BDU:2014-00145
Уязвимость браузера Google Chrome, позволяющая злоумышленнику внедрить произвольный веб-сценарий или HTML-код
BDU:2014-00148
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании
BDU:2014-00151
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании
BDU:2014-00152
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании
BDU:2014-00155
Уязвимость браузера Google Chrome, позволяющая злоумышленнику внедрить произвольный веб-сценарий или HTML-код
BDU:2014-00156
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании
BDU:2014-00157
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании
BDU:2014-00167
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании, связанный с целочисленным переполнением в функциях замены данных
BDU:2014-00168
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании
BDU:2014-00173
Уязвимость браузера Google Chrome, позволяющая злоумышленнику обойти ограничения песочницы
BDU:2014-00175
Уязвимость браузера Google Chrome, позволяющая злоумышленнику подменить URL-адреса
BDU:2014-00178
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании
BDU:2014-00181
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании
BDU:2014-00182
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании
BDU:2014-00187
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании
BDU:2014-00195
Уязвимость браузера Google Chrome, позволяющая злоумышленнику подменить интерфейс пользователя
BDU:2014-00199
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании
BDU:2014-00200
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании
BDU:2014-00209
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании
BDU:2014-00212
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании
BDU:2014-00330
Уязвимость браузера Google Chrome, позволяющая злоумышленнику выполнить произвольный код или вызвать отказ в обслуживании
BDU:2014-00331
Уязвимость браузера Google Chrome, позволяющая злоумышленнику выполнить произвольный код или вызвать отказ в обслуживании
BDU:2014-00332
Уязвимость браузера Google Chrome, позволяющая злоумышленнику выполнить произвольный код или вызвать отказ в обслуживании
BDU:2015-00099
Уязвимость браузера Google Chrome, позволяющая злоумышленнику обойти ограничения песочницы
BDU:2015-00100
Уязвимость браузера Google Chrome, позволяющая злоумышленнику вызвать отказ в обслуживании
BDU:2015-00192
Уязвимость браузера Google Chrome, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-00193
Уязвимость браузера Google Chrome, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-00194
Уязвимость браузера Google Chrome, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-00195
Уязвимость браузера Google Chrome, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-00199
Уязвимости браузера Google Chrome, позволяющие удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-00202
Уязвимости браузера Google Chrome, позволяющие удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-00236
Уязвимость браузера Google Chrome, позволяющая удаленному злоумышленнику нарушить конфиденциальность и целостность защищаемой информации
BDU:2015-00237
Уязвимость браузера Google Chrome, позволяющая удаленному злоумышленнику нарушить конфиденциальность и целостность защищаемой информации
BDU:2015-00238
Уязвимость браузера Google Chrome, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-00239
Уязвимость браузера Google Chrome, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-00240
Уязвимость браузера Google Chrome, позволяющая удаленному злоумышленнику нарушить доступность защищаемой информации
BDU:2015-00241
Уязвимость браузера Google Chrome, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-00242
Уязвимость браузера Google Chrome, позволяющая удаленному злоумышленнику нарушить доступность защищаемой информации
BDU:2015-00243
Уязвимость браузера Google Chrome, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-00450
Уязвимость браузера Firefox, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-00466
Уязвимость программного обеспечения Firefox ESR, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-00677
Уязвимость программного обеспечения SeaMonkey, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-00709
Уязвимость программного обеспечения Thunderbird, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-10003
Уязвимость программной платформы Oracle Fusion Middleware, позволяющая удаленному нарушителю подменить RSA-подпись
Modified: 2024-11-21
CVE-2014-1568
Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a "signature malleability" issue.
- http://googlechromereleases.blogspot.com/2014/09/stable-channel-update_24.html
- http://googlechromereleases.blogspot.com/2014/09/stable-channel-update_24.html
- http://googlechromereleases.blogspot.com/2014/09/stable-channel-update-for-chrome-os_24.html
- http://googlechromereleases.blogspot.com/2014/09/stable-channel-update-for-chrome-os_24.html
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
- SUSE-SU-2014:1220
- SUSE-SU-2014:1220
- openSUSE-SU-2014:1224
- openSUSE-SU-2014:1224
- openSUSE-SU-2014:1232
- openSUSE-SU-2014:1232
- RHSA-2014:1307
- RHSA-2014:1307
- RHSA-2014:1354
- RHSA-2014:1354
- RHSA-2014:1371
- RHSA-2014:1371
- 61540
- 61540
- 61574
- 61574
- 61575
- 61575
- 61576
- 61576
- 61583
- 61583
- DSA-3033
- DSA-3033
- DSA-3034
- DSA-3034
- DSA-3037
- DSA-3037
- VU#772676
- VU#772676
- http://www.mozilla.org/security/announce/2014/mfsa2014-73.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-73.html
- http://www.novell.com/support/kb/doc.php?id=7015701
- http://www.novell.com/support/kb/doc.php?id=7015701
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
- http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- 70116
- 70116
- USN-2360-1
- USN-2360-1
- USN-2360-2
- USN-2360-2
- USN-2361-1
- USN-2361-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1064636
- https://bugzilla.mozilla.org/show_bug.cgi?id=1064636
- https://bugzilla.mozilla.org/show_bug.cgi?id=1069405
- https://bugzilla.mozilla.org/show_bug.cgi?id=1069405
- mozilla-nss-cve20141568-sec-bypass(96194)
- mozilla-nss-cve20141568-sec-bypass(96194)
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1716
Cross-site scripting (XSS) vulnerability in the Runtime_SetPrototype function in runtime.cc in Google V8, as used in Google Chrome before 34.0.1847.116, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- openSUSE-SU-2014:0601
- openSUSE-SU-2014:0601
- GLSA-201408-16
- GLSA-201408-16
- DSA-2905
- DSA-2905
- https://code.google.com/p/chromium/issues/detail?id=354123
- https://code.google.com/p/chromium/issues/detail?id=354123
- https://code.google.com/p/v8/source/detail?r=20138
- https://code.google.com/p/v8/source/detail?r=20138
Modified: 2024-11-21
CVE-2014-1717
Google V8, as used in Google Chrome before 34.0.1847.116, does not properly use numeric casts during handling of typed arrays, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JavaScript code.
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- openSUSE-SU-2014:0601
- openSUSE-SU-2014:0601
- GLSA-201408-16
- GLSA-201408-16
- DSA-2905
- DSA-2905
- https://code.google.com/p/chromium/issues/detail?id=353004
- https://code.google.com/p/chromium/issues/detail?id=353004
- https://code.google.com/p/v8/source/detail?r=20020
- https://code.google.com/p/v8/source/detail?r=20020
Modified: 2024-11-21
CVE-2014-1718
Integer overflow in the SoftwareFrameManager::SwapToNewFrame function in content/browser/renderer_host/software_frame_manager.cc in the software compositor in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted mapping of a large amount of renderer memory.
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- openSUSE-SU-2014:0601
- openSUSE-SU-2014:0601
- GLSA-201408-16
- GLSA-201408-16
- DSA-2905
- DSA-2905
- https://code.google.com/p/chromium/issues/detail?id=348332
- https://code.google.com/p/chromium/issues/detail?id=348332
- https://src.chromium.org/viewvc/chrome?revision=257417&view=revision
- https://src.chromium.org/viewvc/chrome?revision=257417&view=revision
- https://src.chromium.org/viewvc/chrome?revision=258418&view=revision
- https://src.chromium.org/viewvc/chrome?revision=258418&view=revision
- https://src.chromium.org/viewvc/chrome?revision=260969&view=revision
- https://src.chromium.org/viewvc/chrome?revision=260969&view=revision
- https://src.chromium.org/viewvc/chrome?revision=261817&view=revision
- https://src.chromium.org/viewvc/chrome?revision=261817&view=revision
Modified: 2024-11-21
CVE-2014-1719
Use-after-free vulnerability in the WebSharedWorkerStub::OnTerminateWorkerContext function in content/worker/websharedworker_stub.cc in the Web Workers implementation in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via vectors that trigger a SharedWorker termination during script loading.
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- openSUSE-SU-2014:0601
- openSUSE-SU-2014:0601
- GLSA-201408-16
- GLSA-201408-16
- DSA-2905
- DSA-2905
- https://code.google.com/p/chromium/issues/detail?id=343661
- https://code.google.com/p/chromium/issues/detail?id=343661
- https://src.chromium.org/viewvc/chrome?revision=252010&view=revision
- https://src.chromium.org/viewvc/chrome?revision=252010&view=revision
Modified: 2024-11-21
CVE-2014-1720
Use-after-free vulnerability in the HTMLBodyElement::insertedInto function in core/html/HTMLBodyElement.cpp in Blink, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving attributes.
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- openSUSE-SU-2014:0601
- openSUSE-SU-2014:0601
- GLSA-201408-16
- GLSA-201408-16
- DSA-2905
- DSA-2905
- https://code.google.com/p/chromium/issues/detail?id=356095
- https://code.google.com/p/chromium/issues/detail?id=356095
- https://src.chromium.org/viewvc/blink?revision=170216&view=revision
- https://src.chromium.org/viewvc/blink?revision=170216&view=revision
Modified: 2024-11-21
CVE-2014-1721
Google V8, as used in Google Chrome before 34.0.1847.116, does not properly implement lazy deoptimization, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code, as demonstrated by improper handling of a heap allocation of a number outside the Small Integer (aka smi) range.
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- openSUSE-SU-2014:0601
- openSUSE-SU-2014:0601
- GLSA-201408-16
- GLSA-201408-16
- DSA-2905
- DSA-2905
- https://code.google.com/p/chromium/issues/detail?id=350434
- https://code.google.com/p/chromium/issues/detail?id=350434
- https://code.google.com/p/v8/source/detail?r=19834
- https://code.google.com/p/v8/source/detail?r=19834
Modified: 2024-11-21
CVE-2014-1722
Use-after-free vulnerability in the RenderBlock::addChildIgnoringAnonymousColumnBlocks function in core/rendering/RenderBlock.cpp in Blink, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving addition of a child node.
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- openSUSE-SU-2014:0601
- openSUSE-SU-2014:0601
- GLSA-201408-16
- GLSA-201408-16
- DSA-2905
- DSA-2905
- https://code.google.com/p/chromium/issues/detail?id=330626
- https://code.google.com/p/chromium/issues/detail?id=330626
- https://src.chromium.org/viewvc/blink?revision=164405&view=revision
- https://src.chromium.org/viewvc/blink?revision=164405&view=revision
Modified: 2024-11-21
CVE-2014-1723
The UnescapeURLWithOffsetsImpl function in net/base/escape.cc in Google Chrome before 34.0.1847.116 does not properly handle bidirectional Internationalized Resource Identifiers (IRIs), which makes it easier for remote attackers to spoof URLs via crafted use of right-to-left (RTL) Unicode text.
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- openSUSE-SU-2014:0601
- openSUSE-SU-2014:0601
- GLSA-201408-16
- GLSA-201408-16
- DSA-2905
- DSA-2905
- https://code.google.com/p/chromium/issues/detail?id=337746
- https://code.google.com/p/chromium/issues/detail?id=337746
- https://src.chromium.org/viewvc/chrome?revision=254091&view=revision
- https://src.chromium.org/viewvc/chrome?revision=254091&view=revision
Modified: 2024-11-21
CVE-2014-1724
Use-after-free vulnerability in Free(b)soft Laboratory Speech Dispatcher 0.7.1, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service (application hang) or possibly have unspecified other impact via a text-to-speech request.
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- openSUSE-SU-2014:0601
- openSUSE-SU-2014:0601
- GLSA-201408-16
- GLSA-201408-16
- DSA-2905
- DSA-2905
- https://code.google.com/p/chromium/issues/detail?id=327295
- https://code.google.com/p/chromium/issues/detail?id=327295
- https://src.chromium.org/viewvc/chrome?revision=259109&view=revision
- https://src.chromium.org/viewvc/chrome?revision=259109&view=revision
Modified: 2024-11-21
CVE-2014-1725
The base64DecodeInternal function in wtf/text/Base64.cpp in Blink, as used in Google Chrome before 34.0.1847.116, does not properly handle string data composed exclusively of whitespace characters, which allows remote attackers to cause a denial of service (out-of-bounds read) via a window.atob method call.
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- openSUSE-SU-2014:0601
- openSUSE-SU-2014:0601
- GLSA-201408-16
- GLSA-201408-16
- DSA-2905
- DSA-2905
- https://code.google.com/p/chromium/issues/detail?id=357332
- https://code.google.com/p/chromium/issues/detail?id=357332
- https://src.chromium.org/viewvc/blink?revision=170264&view=revision
- https://src.chromium.org/viewvc/blink?revision=170264&view=revision
Modified: 2024-11-21
CVE-2014-1726
The drag implementation in Google Chrome before 34.0.1847.116 allows user-assisted remote attackers to bypass the Same Origin Policy and forge local pathnames by leveraging renderer access.
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- openSUSE-SU-2014:0601
- openSUSE-SU-2014:0601
- GLSA-201408-16
- GLSA-201408-16
- DSA-2905
- DSA-2905
- https://code.google.com/p/chromium/issues/detail?id=346135
- https://code.google.com/p/chromium/issues/detail?id=346135
- https://src.chromium.org/viewvc/chrome?revision=259353&view=revision
- https://src.chromium.org/viewvc/chrome?revision=259353&view=revision
Modified: 2024-11-21
CVE-2014-1727
Use-after-free vulnerability in content/renderer/renderer_webcolorchooser_impl.h in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to forms.
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- openSUSE-SU-2014:0601
- openSUSE-SU-2014:0601
- GLSA-201408-16
- GLSA-201408-16
- DSA-2905
- DSA-2905
- https://code.google.com/p/chromium/issues/detail?id=342735
- https://code.google.com/p/chromium/issues/detail?id=342735
- https://src.chromium.org/viewvc/chrome?revision=255276&view=revision
- https://src.chromium.org/viewvc/chrome?revision=255276&view=revision
Modified: 2024-11-21
CVE-2014-1728
Multiple unspecified vulnerabilities in Google Chrome before 34.0.1847.116 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- openSUSE-SU-2014:0601
- openSUSE-SU-2014:0601
- GLSA-201408-16
- GLSA-201408-16
- DSA-2905
- DSA-2905
- https://code.google.com/p/chromium/issues/detail?id=345820
- https://code.google.com/p/chromium/issues/detail?id=345820
- https://code.google.com/p/chromium/issues/detail?id=347262
- https://code.google.com/p/chromium/issues/detail?id=347262
- https://code.google.com/p/chromium/issues/detail?id=348319
- https://code.google.com/p/chromium/issues/detail?id=348319
- https://code.google.com/p/chromium/issues/detail?id=350533
- https://code.google.com/p/chromium/issues/detail?id=350533
- https://code.google.com/p/chromium/issues/detail?id=350537
- https://code.google.com/p/chromium/issues/detail?id=350537
- https://code.google.com/p/chromium/issues/detail?id=350863
- https://code.google.com/p/chromium/issues/detail?id=350863
- https://code.google.com/p/chromium/issues/detail?id=351815
- https://code.google.com/p/chromium/issues/detail?id=351815
- https://code.google.com/p/chromium/issues/detail?id=352982
- https://code.google.com/p/chromium/issues/detail?id=352982
- https://code.google.com/p/chromium/issues/detail?id=353013
- https://code.google.com/p/chromium/issues/detail?id=353013
- https://code.google.com/p/chromium/issues/detail?id=354297
- https://code.google.com/p/chromium/issues/detail?id=354297
- https://code.google.com/p/chromium/issues/detail?id=355586
- https://code.google.com/p/chromium/issues/detail?id=355586
- https://code.google.com/p/chromium/issues/detail?id=356235
- https://code.google.com/p/chromium/issues/detail?id=356235
- https://code.google.com/p/chromium/issues/detail?id=356517
- https://code.google.com/p/chromium/issues/detail?id=356517
- https://code.google.com/p/chromium/issues/detail?id=358059
- https://code.google.com/p/chromium/issues/detail?id=358059
- https://code.google.com/p/chromium/issues/detail?id=360298
- https://code.google.com/p/chromium/issues/detail?id=360298
Modified: 2024-11-21
CVE-2014-1729
Multiple unspecified vulnerabilities in Google V8 before 3.24.35.22, as used in Google Chrome before 34.0.1847.116, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update.html
- openSUSE-SU-2014:0601
- openSUSE-SU-2014:0601
- GLSA-201408-16
- GLSA-201408-16
- DSA-2905
- DSA-2905
- https://code.google.com/p/chromium/issues/detail?id=345820
- https://code.google.com/p/chromium/issues/detail?id=345820
- https://code.google.com/p/chromium/issues/detail?id=347262
- https://code.google.com/p/chromium/issues/detail?id=347262
- https://code.google.com/p/chromium/issues/detail?id=348319
- https://code.google.com/p/chromium/issues/detail?id=348319
- https://code.google.com/p/chromium/issues/detail?id=350863
- https://code.google.com/p/chromium/issues/detail?id=350863
- https://code.google.com/p/chromium/issues/detail?id=352982
- https://code.google.com/p/chromium/issues/detail?id=352982
- https://code.google.com/p/chromium/issues/detail?id=355586
- https://code.google.com/p/chromium/issues/detail?id=355586
- https://code.google.com/p/chromium/issues/detail?id=358059
- https://code.google.com/p/chromium/issues/detail?id=358059
- https://code.google.com/p/v8/source/detail?r=19572
- https://code.google.com/p/v8/source/detail?r=19572
- https://code.google.com/p/v8/source/detail?r=19584
- https://code.google.com/p/v8/source/detail?r=19584
- https://code.google.com/p/v8/source/detail?r=19923
- https://code.google.com/p/v8/source/detail?r=19923
- https://code.google.com/p/v8/source/detail?r=20033
- https://code.google.com/p/v8/source/detail?r=20033
- https://code.google.com/p/v8/source/detail?r=20345
- https://code.google.com/p/v8/source/detail?r=20345
- https://code.google.com/p/v8/source/detail?r=20409
- https://code.google.com/p/v8/source/detail?r=20409
Modified: 2024-11-21
CVE-2014-1731
core/html/HTMLSelectElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly check renderer state upon a focus event, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion" for SELECT elements.
- APPLE-SA-2014-05-21-1
- APPLE-SA-2014-05-21-1
- APPLE-SA-2014-06-30-3
- APPLE-SA-2014-06-30-3
- APPLE-SA-2014-06-30-4
- APPLE-SA-2014-06-30-4
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html
- openSUSE-SU-2014:0668
- openSUSE-SU-2014:0668
- openSUSE-SU-2014:0669
- openSUSE-SU-2014:0669
- 58301
- 58301
- 60372
- 60372
- GLSA-201408-16
- GLSA-201408-16
- http://support.apple.com/kb/HT6254
- http://support.apple.com/kb/HT6254
- DSA-2920
- DSA-2920
- 67572
- 67572
- https://code.google.com/p/chromium/issues/detail?id=349903
- https://code.google.com/p/chromium/issues/detail?id=349903
- https://src.chromium.org/viewvc/blink?revision=171216&view=revision
- https://src.chromium.org/viewvc/blink?revision=171216&view=revision
- https://support.apple.com/kb/HT6537
- https://support.apple.com/kb/HT6537
Modified: 2024-11-21
CVE-2014-1732
Use-after-free vulnerability in browser/ui/views/speech_recognition_bubble_views.cc in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via an INPUT element that triggers the presence of a Speech Recognition Bubble window for an incorrect duration.
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html
- openSUSE-SU-2014:0668
- openSUSE-SU-2014:0668
- openSUSE-SU-2014:0669
- openSUSE-SU-2014:0669
- 58301
- 58301
- GLSA-201408-16
- GLSA-201408-16
- DSA-2920
- DSA-2920
- https://code.google.com/p/chromium/issues/detail?id=352851
- https://code.google.com/p/chromium/issues/detail?id=352851
- https://src.chromium.org/viewvc/chrome?revision=261737&view=revision
- https://src.chromium.org/viewvc/chrome?revision=261737&view=revision
Modified: 2024-11-21
CVE-2014-1733
The PointerCompare function in codegen.cc in Seccomp-BPF, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly merge blocks, which might allow remote attackers to bypass intended sandbox restrictions by leveraging renderer access.
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html
- http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html
- openSUSE-SU-2014:0668
- openSUSE-SU-2014:0668
- openSUSE-SU-2014:0669
- openSUSE-SU-2014:0669
- 58301
- 58301
- GLSA-201408-16
- GLSA-201408-16
- DSA-2920
- DSA-2920
- https://code.google.com/p/chromium/issues/detail?id=351103
- https://code.google.com/p/chromium/issues/detail?id=351103
- https://src.chromium.org/viewvc/chrome?revision=260157&view=revision
- https://src.chromium.org/viewvc/chrome?revision=260157&view=revision
Modified: 2024-11-21
CVE-2014-1740
Multiple use-after-free vulnerabilities in net/websockets/websocket_job.cc in the WebSockets implementation in Google Chrome before 34.0.1847.137 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to WebSocketJob deletion.
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update.html
- openSUSE-SU-2014:0783
- openSUSE-SU-2014:0783
- 59155
- 59155
- 60372
- 60372
- GLSA-201408-16
- GLSA-201408-16
- DSA-2930
- DSA-2930
- 67374
- 67374
- 1030240
- 1030240
- https://code.google.com/p/chromium/issues/detail?id=358038
- https://code.google.com/p/chromium/issues/detail?id=358038
- https://src.chromium.org/viewvc/chrome?revision=261707&view=revision
- https://src.chromium.org/viewvc/chrome?revision=261707&view=revision
Modified: 2024-11-21
CVE-2014-1741
Multiple integer overflows in the replace-data functionality in the CharacterData interface implementation in core/dom/CharacterData.cpp in Blink, as used in Google Chrome before 34.0.1847.137, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to ranges.
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update.html
- openSUSE-SU-2014:0783
- openSUSE-SU-2014:0783
- 59155
- 59155
- 60372
- 60372
- GLSA-201408-16
- GLSA-201408-16
- DSA-2930
- DSA-2930
- 67376
- 67376
- 1030240
- 1030240
- https://code.google.com/p/chromium/issues/detail?id=349898
- https://code.google.com/p/chromium/issues/detail?id=349898
- https://src.chromium.org/viewvc/blink?revision=171165&view=revision
- https://src.chromium.org/viewvc/blink?revision=171165&view=revision
Modified: 2024-11-21
CVE-2014-1742
Use-after-free vulnerability in the FrameSelection::updateAppearance function in core/editing/FrameSelection.cpp in Blink, as used in Google Chrome before 34.0.1847.137, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper RenderObject handling.
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update.html
- openSUSE-SU-2014:0783
- openSUSE-SU-2014:0783
- 59155
- 59155
- 60372
- 60372
- GLSA-201408-16
- GLSA-201408-16
- DSA-2930
- DSA-2930
- 67375
- 67375
- 1030240
- 1030240
- https://code.google.com/p/chromium/issues/detail?id=356690
- https://code.google.com/p/chromium/issues/detail?id=356690
- https://src.chromium.org/viewvc/blink?revision=171440&view=revision
- https://src.chromium.org/viewvc/blink?revision=171440&view=revision
Modified: 2024-11-21
CVE-2014-1743
Use-after-free vulnerability in the StyleElement::removedFromDocument function in core/dom/StyleElement.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code that triggers tree mutation.
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html
- openSUSE-SU-2014:0783
- openSUSE-SU-2014:0783
- 58920
- 58920
- 59155
- 59155
- 60372
- 60372
- GLSA-201408-16
- GLSA-201408-16
- DSA-2939
- DSA-2939
- 1030270
- 1030270
- https://code.google.com/p/chromium/issues/detail?id=356653
- https://code.google.com/p/chromium/issues/detail?id=356653
- https://src.chromium.org/viewvc/blink?revision=170702&view=revision
- https://src.chromium.org/viewvc/blink?revision=170702&view=revision
Modified: 2024-11-21
CVE-2014-1744
Integer overflow in the AudioInputRendererHost::OnCreateStream function in content/browser/renderer_host/media/audio_input_renderer_host.cc in Google Chrome before 35.0.1916.114 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a large shared-memory allocation.
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html
- openSUSE-SU-2014:0783
- openSUSE-SU-2014:0783
- 58920
- 58920
- 59155
- 59155
- 60372
- 60372
- GLSA-201408-16
- GLSA-201408-16
- DSA-2939
- DSA-2939
- 1030270
- 1030270
- https://code.google.com/p/chromium/issues/detail?id=359454
- https://code.google.com/p/chromium/issues/detail?id=359454
- https://src.chromium.org/viewvc/chrome?revision=261549&view=revision
- https://src.chromium.org/viewvc/chrome?revision=261549&view=revision
Modified: 2024-11-21
CVE-2014-1745
Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger removal of an SVGFontFaceElement object, related to core/svg/SVGFontFaceElement.cpp.
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html
- openSUSE-SU-2014:0783
- openSUSE-SU-2014:0783
- 58920
- 58920
- 59155
- 59155
- GLSA-201408-16
- GLSA-201408-16
- DSA-2939
- DSA-2939
- [oss-security] 20240206 WebKitGTK and WPE WebKit Security Advisory WSA-2024-0001
- [oss-security] 20240206 WebKitGTK and WPE WebKit Security Advisory WSA-2024-0001
- 1030270
- 1030270
- https://code.google.com/p/chromium/issues/detail?id=346192
- https://code.google.com/p/chromium/issues/detail?id=346192
- https://src.chromium.org/viewvc/blink?revision=167993&view=revision
- https://src.chromium.org/viewvc/blink?revision=167993&view=revision
Modified: 2024-11-21
CVE-2014-1746
The InMemoryUrlProtocol::Read function in media/filters/in_memory_url_protocol.cc in Google Chrome before 35.0.1916.114 relies on an insufficiently large integer data type, which allows remote attackers to cause a denial of service (out-of-bounds read) via vectors that trigger use of a large buffer.
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html
- openSUSE-SU-2014:0783
- openSUSE-SU-2014:0783
- 58920
- 58920
- 59155
- 59155
- 60372
- 60372
- GLSA-201408-16
- GLSA-201408-16
- DSA-2939
- DSA-2939
- 1030270
- 1030270
- https://code.google.com/p/chromium/issues/detail?id=364065
- https://code.google.com/p/chromium/issues/detail?id=364065
- https://src.chromium.org/viewvc/chrome?revision=267280&view=revision
- https://src.chromium.org/viewvc/chrome?revision=267280&view=revision
Modified: 2024-11-21
CVE-2014-1747
Cross-site scripting (XSS) vulnerability in the DocumentLoader::maybeCreateArchive function in core/loader/DocumentLoader.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to inject arbitrary web script or HTML via crafted MHTML content, aka "Universal XSS (UXSS)."
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html
- openSUSE-SU-2014:0783
- openSUSE-SU-2014:0783
- 58920
- 58920
- 59155
- 59155
- GLSA-201408-16
- GLSA-201408-16
- DSA-2939
- DSA-2939
- 1030270
- 1030270
- https://code.google.com/p/chromium/issues/detail?id=330663
- https://code.google.com/p/chromium/issues/detail?id=330663
- https://src.chromium.org/viewvc/blink?revision=169499&view=revision
- https://src.chromium.org/viewvc/blink?revision=169499&view=revision
Modified: 2024-11-21
CVE-2014-1748
The ScrollView::paint function in platform/scroll/ScrollView.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to spoof the UI by extending scrollbar painting into the parent frame.
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html
- APPLE-SA-2014-12-2-1
- APPLE-SA-2014-12-2-1
- openSUSE-SU-2014:0783
- openSUSE-SU-2014:0783
- openSUSE-SU-2016:0915
- openSUSE-SU-2016:0915
- 58920
- 58920
- 59155
- 59155
- 60372
- 60372
- GLSA-201408-16
- GLSA-201408-16
- http://support.apple.com/kb/HT6596
- http://support.apple.com/kb/HT6596
- DSA-2939
- DSA-2939
- 1030270
- 1030270
- USN-2937-1
- USN-2937-1
- https://code.google.com/p/chromium/issues/detail?id=331168
- https://code.google.com/p/chromium/issues/detail?id=331168
- https://src.chromium.org/viewvc/blink?revision=170625&view=revision
- https://src.chromium.org/viewvc/blink?revision=170625&view=revision
Modified: 2024-11-21
CVE-2014-1749
Multiple unspecified vulnerabilities in Google Chrome before 35.0.1916.114 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html
- openSUSE-SU-2014:0783
- openSUSE-SU-2014:0783
- 58920
- 58920
- 59155
- 59155
- GLSA-201408-16
- GLSA-201408-16
- DSA-2939
- DSA-2939
- 1030270
- 1030270
- https://code.google.com/p/chromium/issues/detail?id=374649
- https://code.google.com/p/chromium/issues/detail?id=374649
Modified: 2024-11-21
CVE-2014-3152
Integer underflow in the LCodeGen::PrepareKeyedOperand function in arm/lithium-codegen-arm.cc in Google V8 before 3.25.28.16, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a negative key value.
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html
- FEDORA-2015-6890
- FEDORA-2015-6890
- FEDORA-2015-6908
- FEDORA-2015-6908
- FEDORA-2015-6845
- FEDORA-2015-6845
- openSUSE-SU-2014:0783
- openSUSE-SU-2014:0783
- 58920
- 58920
- 59155
- 59155
- 60372
- 60372
- DSA-2939
- DSA-2939
- 1030270
- 1030270
- https://code.google.com/p/chromium/issues/detail?id=358057
- https://code.google.com/p/chromium/issues/detail?id=358057
- https://code.google.com/p/v8/source/detail?r=20363
- https://code.google.com/p/v8/source/detail?r=20363
Modified: 2024-11-21
CVE-2014-3154
Use-after-free vulnerability in the ChildThread::Shutdown function in content/child/child_thread.cc in the filesystem API in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to a Blink shutdown.
- http://googlechromereleases.blogspot.com/2014/06/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/06/stable-channel-update.html
- 58585
- 58585
- 59090
- 59090
- 60061
- 60061
- 60372
- 60372
- GLSA-201408-16
- GLSA-201408-16
- DSA-2959
- DSA-2959
- 67977
- 67977
- https://code.google.com/p/chromium/issues/detail?id=369525
- https://code.google.com/p/chromium/issues/detail?id=369525
- https://src.chromium.org/viewvc/blink?revision=173620&view=revision
- https://src.chromium.org/viewvc/blink?revision=173620&view=revision
- https://src.chromium.org/viewvc/chrome?revision=269345&view=revision
- https://src.chromium.org/viewvc/chrome?revision=269345&view=revision
Modified: 2024-11-21
CVE-2014-3155
net/spdy/spdy_write_queue.cc in the SPDY implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service (out-of-bounds read) by leveraging incorrect queue maintenance.
- http://googlechromereleases.blogspot.com/2014/06/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/06/stable-channel-update.html
- 58585
- 58585
- 59090
- 59090
- 60061
- 60061
- 60372
- 60372
- GLSA-201408-16
- GLSA-201408-16
- DSA-2959
- DSA-2959
- 67980
- 67980
- https://code.google.com/p/chromium/issues/detail?id=369539
- https://code.google.com/p/chromium/issues/detail?id=369539
- https://src.chromium.org/viewvc/chrome?revision=267984&view=revision
- https://src.chromium.org/viewvc/chrome?revision=267984&view=revision
- https://src.chromium.org/viewvc/chrome?revision=268730&view=revision
- https://src.chromium.org/viewvc/chrome?revision=268730&view=revision
- https://src.chromium.org/viewvc/chrome?revision=269246&view=revision
- https://src.chromium.org/viewvc/chrome?revision=269246&view=revision
Modified: 2024-11-21
CVE-2014-3156
Buffer overflow in the clipboard implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unexpected bitmap data, related to content/renderer/renderer_clipboard_client.cc and content/renderer/webclipboard_impl.cc.
- http://googlechromereleases.blogspot.com/2014/06/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/06/stable-channel-update.html
- 58585
- 58585
- 59090
- 59090
- 60061
- 60061
- GLSA-201408-16
- GLSA-201408-16
- DSA-2959
- DSA-2959
- 67981
- 67981
- https://code.google.com/p/chromium/issues/detail?id=369621
- https://code.google.com/p/chromium/issues/detail?id=369621
- https://src.chromium.org/viewvc/chrome?revision=271730&view=revision
- https://src.chromium.org/viewvc/chrome?revision=271730&view=revision
Modified: 2024-11-21
CVE-2014-3157
Heap-based buffer overflow in the FFmpegVideoDecoder::GetVideoBuffer function in media/filters/ffmpeg_video_decoder.cc in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging VideoFrame data structures that are too small for proper interaction with an underlying FFmpeg library.
- http://googlechromereleases.blogspot.com/2014/06/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/06/stable-channel-update.html
- 58585
- 58585
- 59090
- 59090
- 60061
- 60061
- 60372
- 60372
- GLSA-201408-16
- GLSA-201408-16
- DSA-2959
- DSA-2959
- 67972
- 67972
- https://code.google.com/p/chromium/issues/detail?id=368980
- https://code.google.com/p/chromium/issues/detail?id=368980
- https://src.chromium.org/viewvc/chrome?revision=268831&view=revision
- https://src.chromium.org/viewvc/chrome?revision=268831&view=revision
Modified: 2024-11-21
CVE-2014-3160
The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the Same Origin Policy via a crafted file.
- http://googlechromereleases.blogspot.com/2014/07/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/07/stable-channel-update.html
- 60061
- 60061
- 60372
- 60372
- GLSA-201408-16
- GLSA-201408-16
- DSA-3039
- DSA-3039
- 68677
- 68677
- https://code.google.com/p/chromium/issues/detail?id=380885
- https://code.google.com/p/chromium/issues/detail?id=380885
- https://src.chromium.org/viewvc/blink?revision=176084&view=revision
- https://src.chromium.org/viewvc/blink?revision=176084&view=revision
Modified: 2024-11-21
CVE-2014-3165
Use-after-free vulnerability in modules/websockets/WorkerThreadableWebSocketChannel.cpp in the Web Sockets implementation in Blink, as used in Google Chrome before 36.0.1985.143, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an unexpectedly long lifetime of a temporary object during method completion.
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update.html
- 59904
- 59904
- 60798
- 60798
- GLSA-201408-16
- GLSA-201408-16
- DSA-3039
- DSA-3039
- 69201
- 69201
- 1030732
- 1030732
- https://code.google.com/p/chromium/issues/detail?id=390174
- https://code.google.com/p/chromium/issues/detail?id=390174
- google-chrome-cve20143165-code-exec(95247)
- google-chrome-cve20143165-code-exec(95247)
- https://src.chromium.org/viewvc/blink?revision=177359&view=revision
- https://src.chromium.org/viewvc/blink?revision=177359&view=revision
Modified: 2024-11-21
CVE-2014-3166
The Public Key Pinning (PKP) implementation in Google Chrome before 36.0.1985.143 on Windows, OS X, and Linux, and before 36.0.1985.135 on Android, does not correctly consider the properties of SPDY connections, which allows remote attackers to obtain sensitive information by leveraging the use of multiple domain names.
- http://googlechromereleases.blogspot.com/2014/08/chrome-for-android-update.html
- http://googlechromereleases.blogspot.com/2014/08/chrome-for-android-update.html
- http://googlechromereleases.blogspot.com/2014/08/chrome-for-ios-update.html
- http://googlechromereleases.blogspot.com/2014/08/chrome-for-ios-update.html
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update.html
- 59693
- 59693
- 59904
- 59904
- 60685
- 60685
- 60798
- 60798
- GLSA-201408-16
- GLSA-201408-16
- DSA-3039
- DSA-3039
- [tls] 20140810 Re: Inter-protocol attacks
- [tls] 20140810 Re: Inter-protocol attacks
- 69202
- 69202
- 1030732
- 1030732
- https://code.google.com/p/chromium/issues/detail?id=398925
- https://code.google.com/p/chromium/issues/detail?id=398925
- https://src.chromium.org/viewvc/chrome?revision=286598&view=revision
- https://src.chromium.org/viewvc/chrome?revision=286598&view=revision
- https://src.chromium.org/viewvc/chrome?revision=288435&view=revision
- https://src.chromium.org/viewvc/chrome?revision=288435&view=revision
Modified: 2024-11-21
CVE-2014-3167
Multiple unspecified vulnerabilities in Google Chrome before 36.0.1985.143 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update.html
- 59904
- 59904
- 60798
- 60798
- GLSA-201408-16
- GLSA-201408-16
- DSA-3039
- DSA-3039
- 69203
- 69203
- 1030732
- 1030732
- https://code.google.com/p/chromium/issues/detail?id=400950
- https://code.google.com/p/chromium/issues/detail?id=400950
- google-chrome-cve20143167-unspec(95249)
- google-chrome-cve20143167-unspec(95249)
Modified: 2024-11-21
CVE-2014-3168
Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 37.0.2062.94, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper caching associated with animation.
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
- openSUSE-SU-2014:1151
- openSUSE-SU-2014:1151
- 60268
- 60268
- 60424
- 60424
- 61482
- 61482
- GLSA-201408-16
- GLSA-201408-16
- DSA-3039
- DSA-3039
- 69398
- 69398
- 1030767
- 1030767
- https://crbug.com/369860
- https://crbug.com/369860
- google-chrome-cve20143168-code-exec(95468)
- google-chrome-cve20143168-code-exec(95468)
- https://src.chromium.org/viewvc/blink?revision=174338&view=revision
- https://src.chromium.org/viewvc/blink?revision=174338&view=revision
- https://src.chromium.org/viewvc/blink?revision=174923&view=revision
- https://src.chromium.org/viewvc/blink?revision=174923&view=revision
Modified: 2024-11-21
CVE-2014-3169
Use-after-free vulnerability in core/dom/ContainerNode.cpp in the DOM implementation in Blink, as used in Google Chrome before 37.0.2062.94, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging script execution that occurs before notification of node removal.
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
- openSUSE-SU-2014:1151
- openSUSE-SU-2014:1151
- 60268
- 60268
- 60424
- 60424
- 61482
- 61482
- GLSA-201408-16
- GLSA-201408-16
- DSA-3039
- DSA-3039
- 69405
- 69405
- 1030767
- 1030767
- https://crbug.com/387389
- https://crbug.com/387389
- google-chrome-cve20143169-code-exec(95469)
- google-chrome-cve20143169-code-exec(95469)
- https://src.chromium.org/viewvc/blink?revision=178976&view=revision
- https://src.chromium.org/viewvc/blink?revision=178976&view=revision
Modified: 2024-11-21
CVE-2014-3170
extensions/common/url_pattern.cc in Google Chrome before 37.0.2062.94 does not prevent use of a '\0' character in a host name, which allows remote attackers to spoof the extension permission dialog by relying on truncation after this character.
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
- openSUSE-SU-2014:1151
- openSUSE-SU-2014:1151
- 60268
- 60268
- 61482
- 61482
- GLSA-201408-16
- GLSA-201408-16
- DSA-3039
- DSA-3039
- 69400
- 69400
- 1030767
- 1030767
- https://crbug.com/390624
- https://crbug.com/390624
- google-chrome-cve20143170-spoofing(95470)
- google-chrome-cve20143170-spoofing(95470)
- https://src.chromium.org/viewvc/chrome?revision=285492&view=revision
- https://src.chromium.org/viewvc/chrome?revision=285492&view=revision
Modified: 2024-11-21
CVE-2014-3171
Use-after-free vulnerability in the V8 bindings in Blink, as used in Google Chrome before 37.0.2062.94, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper use of HashMap add operations instead of HashMap set operations, related to bindings/core/v8/DOMWrapperMap.h and bindings/core/v8/SerializedScriptValue.cpp.
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
- openSUSE-SU-2014:1151
- openSUSE-SU-2014:1151
- 60268
- 60268
- 60424
- 60424
- 61482
- 61482
- GLSA-201408-16
- GLSA-201408-16
- DSA-3039
- DSA-3039
- 69406
- 69406
- 1030767
- 1030767
- https://crbug.com/390928
- https://crbug.com/390928
- google-chrome-cve20143171-code-exec(95471)
- google-chrome-cve20143171-code-exec(95471)
- https://src.chromium.org/viewvc/blink?revision=178823&view=revision
- https://src.chromium.org/viewvc/blink?revision=178823&view=revision
Modified: 2024-11-21
CVE-2014-3172
The Debugger extension API in browser/extensions/api/debugger/debugger_api.cc in Google Chrome before 37.0.2062.94 does not validate a tab's URL before an attach operation, which allows remote attackers to bypass intended access limitations via an extension that uses a restricted URL, as demonstrated by a chrome:// URL.
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
- openSUSE-SU-2014:1151
- openSUSE-SU-2014:1151
- 60268
- 60268
- 61482
- 61482
- GLSA-201408-16
- GLSA-201408-16
- DSA-3039
- DSA-3039
- 69401
- 69401
- 1030767
- 1030767
- https://crbug.com/367567
- https://crbug.com/367567
- google-chrome-cve20143172-unspec(95472)
- google-chrome-cve20143172-unspec(95472)
- https://src.chromium.org/viewvc/chrome?revision=280354&view=revision
- https://src.chromium.org/viewvc/chrome?revision=280354&view=revision
Modified: 2024-11-21
CVE-2014-3173
The WebGL implementation in Google Chrome before 37.0.2062.94 does not ensure that clear calls interact properly with the state of a draw buffer, which allows remote attackers to cause a denial of service (read of uninitialized memory) via a crafted CANVAS element, related to gpu/command_buffer/service/framebuffer_manager.cc and gpu/command_buffer/service/gles2_cmd_decoder.cc.
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
- openSUSE-SU-2014:1151
- openSUSE-SU-2014:1151
- 60268
- 60268
- 60424
- 60424
- 61482
- 61482
- GLSA-201408-16
- GLSA-201408-16
- DSA-3039
- DSA-3039
- 69403
- 69403
- 1030767
- 1030767
- https://crbug.com/376951
- https://crbug.com/376951
- google-chrome-cve20143173-info-disc(95473)
- google-chrome-cve20143173-info-disc(95473)
- https://src.chromium.org/viewvc/chrome?revision=275338&view=revision
- https://src.chromium.org/viewvc/chrome?revision=275338&view=revision
Modified: 2024-11-21
CVE-2014-3174
modules/webaudio/BiquadDSPKernel.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 37.0.2062.94, does not properly consider concurrent threads during attempts to update biquad filter coefficients, which allows remote attackers to cause a denial of service (read of uninitialized memory) via crafted API calls.
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
- openSUSE-SU-2014:1151
- openSUSE-SU-2014:1151
- 60268
- 60268
- 60424
- 60424
- 61482
- 61482
- GLSA-201408-16
- GLSA-201408-16
- DSA-3039
- DSA-3039
- 69407
- 69407
- 1030767
- 1030767
- https://crbug.com/389219
- https://crbug.com/389219
- google-chrome-cve20143174-info-disc(95474)
- google-chrome-cve20143174-info-disc(95474)
- https://src.chromium.org/viewvc/blink?revision=177250&view=revision
- https://src.chromium.org/viewvc/blink?revision=177250&view=revision
Modified: 2024-11-21
CVE-2014-3175
Multiple unspecified vulnerabilities in Google Chrome before 37.0.2062.94 allow attackers to cause a denial of service or possibly have other impact via unknown vectors, related to the load_truetype_glyph function in truetype/ttgload.c in FreeType and other functions in other components.
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
- openSUSE-SU-2014:1151
- openSUSE-SU-2014:1151
- 60268
- 60268
- 60424
- 60424
- GLSA-201408-16
- GLSA-201408-16
- DSA-3039
- DSA-3039
- 69402
- 69402
- 1030767
- 1030767
- https://code.google.com/p/chromium/issues/detail?id=149871
- https://code.google.com/p/chromium/issues/detail?id=149871
- https://code.google.com/p/chromium/issues/detail?id=337572
- https://code.google.com/p/chromium/issues/detail?id=337572
- https://code.google.com/p/chromium/issues/detail?id=350782
- https://code.google.com/p/chromium/issues/detail?id=350782
- https://code.google.com/p/chromium/issues/detail?id=357452
- https://code.google.com/p/chromium/issues/detail?id=357452
- https://code.google.com/p/chromium/issues/detail?id=364062
- https://code.google.com/p/chromium/issues/detail?id=364062
- https://code.google.com/p/chromium/issues/detail?id=366687
- https://code.google.com/p/chromium/issues/detail?id=366687
- https://code.google.com/p/chromium/issues/detail?id=367991
- https://code.google.com/p/chromium/issues/detail?id=367991
- https://code.google.com/p/chromium/issues/detail?id=368978
- https://code.google.com/p/chromium/issues/detail?id=368978
- https://code.google.com/p/chromium/issues/detail?id=372410
- https://code.google.com/p/chromium/issues/detail?id=372410
- https://code.google.com/p/chromium/issues/detail?id=372413
- https://code.google.com/p/chromium/issues/detail?id=372413
- https://code.google.com/p/chromium/issues/detail?id=379656
- https://code.google.com/p/chromium/issues/detail?id=379656
- https://code.google.com/p/chromium/issues/detail?id=381031
- https://code.google.com/p/chromium/issues/detail?id=381031
- https://code.google.com/p/chromium/issues/detail?id=381244
- https://code.google.com/p/chromium/issues/detail?id=381244
- https://code.google.com/p/chromium/issues/detail?id=381521
- https://code.google.com/p/chromium/issues/detail?id=381521
- https://code.google.com/p/chromium/issues/detail?id=382240
- https://code.google.com/p/chromium/issues/detail?id=382240
- https://code.google.com/p/chromium/issues/detail?id=382241
- https://code.google.com/p/chromium/issues/detail?id=382241
- https://code.google.com/p/chromium/issues/detail?id=382242
- https://code.google.com/p/chromium/issues/detail?id=382242
- https://code.google.com/p/chromium/issues/detail?id=382243
- https://code.google.com/p/chromium/issues/detail?id=382243
- https://code.google.com/p/chromium/issues/detail?id=382601
- https://code.google.com/p/chromium/issues/detail?id=382601
- https://code.google.com/p/chromium/issues/detail?id=382606
- https://code.google.com/p/chromium/issues/detail?id=382606
- https://code.google.com/p/chromium/issues/detail?id=382639
- https://code.google.com/p/chromium/issues/detail?id=382639
- https://code.google.com/p/chromium/issues/detail?id=382656
- https://code.google.com/p/chromium/issues/detail?id=382656
- https://code.google.com/p/chromium/issues/detail?id=382820
- https://code.google.com/p/chromium/issues/detail?id=382820
- https://code.google.com/p/chromium/issues/detail?id=383703
- https://code.google.com/p/chromium/issues/detail?id=383703
- https://code.google.com/p/chromium/issues/detail?id=384662
- https://code.google.com/p/chromium/issues/detail?id=384662
- https://code.google.com/p/chromium/issues/detail?id=387016
- https://code.google.com/p/chromium/issues/detail?id=387016
- https://code.google.com/p/chromium/issues/detail?id=387315
- https://code.google.com/p/chromium/issues/detail?id=387315
- https://code.google.com/p/chromium/issues/detail?id=387371
- https://code.google.com/p/chromium/issues/detail?id=387371
- https://code.google.com/p/chromium/issues/detail?id=388771
- https://code.google.com/p/chromium/issues/detail?id=388771
- https://code.google.com/p/chromium/issues/detail?id=389216
- https://code.google.com/p/chromium/issues/detail?id=389216
- https://code.google.com/p/chromium/issues/detail?id=389280
- https://code.google.com/p/chromium/issues/detail?id=389280
- https://code.google.com/p/chromium/issues/detail?id=389285
- https://code.google.com/p/chromium/issues/detail?id=389285
- https://code.google.com/p/chromium/issues/detail?id=389316
- https://code.google.com/p/chromium/issues/detail?id=389316
- https://code.google.com/p/chromium/issues/detail?id=389570
- https://code.google.com/p/chromium/issues/detail?id=389570
- https://code.google.com/p/chromium/issues/detail?id=390176
- https://code.google.com/p/chromium/issues/detail?id=390176
- https://code.google.com/p/chromium/issues/detail?id=390304
- https://code.google.com/p/chromium/issues/detail?id=390304
- https://code.google.com/p/chromium/issues/detail?id=393938
- https://code.google.com/p/chromium/issues/detail?id=393938
- https://code.google.com/p/chromium/issues/detail?id=394026
- https://code.google.com/p/chromium/issues/detail?id=394026
- https://code.google.com/p/chromium/issues/detail?id=395972
- https://code.google.com/p/chromium/issues/detail?id=395972
- https://code.google.com/p/chromium/issues/detail?id=396255
- https://code.google.com/p/chromium/issues/detail?id=396255
- https://code.google.com/p/chromium/issues/detail?id=397258
- https://code.google.com/p/chromium/issues/detail?id=397258
- https://crbug.com/406143
- https://crbug.com/406143
- google-chrome-cve20143175-unspec(95475)
- google-chrome-cve20143175-unspec(95475)
Modified: 2024-11-21
CVE-2014-3176
Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions, IPC, the sync API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3177.
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
- openSUSE-SU-2014:1151
- openSUSE-SU-2014:1151
- 60268
- 60268
- 61482
- 61482
- GLSA-201408-16
- GLSA-201408-16
- DSA-3039
- DSA-3039
- 69404
- 69404
- 1030767
- 1030767
- https://crbug.com/386988
- https://crbug.com/386988
- google-chrome-cve20143176-code-exec(95476)
- google-chrome-cve20143176-code-exec(95476)
Modified: 2024-11-21
CVE-2014-3177
Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions, IPC, the sync API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3176.
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
- http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
- openSUSE-SU-2014:1151
- openSUSE-SU-2014:1151
- 60268
- 60268
- 61482
- 61482
- GLSA-201408-16
- GLSA-201408-16
- DSA-3039
- DSA-3039
- 69404
- 69404
- 1030767
- 1030767
- https://crbug.com/386988
- https://crbug.com/386988
- google-chrome-cve20143177-code-exec(95477)
- google-chrome-cve20143177-code-exec(95477)
Modified: 2024-11-21
CVE-2014-3178
Use-after-free vulnerability in core/dom/Node.cpp in Blink, as used in Google Chrome before 37.0.2062.120, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of render-tree inconsistencies.
- http://googlechromereleases.blogspot.com/2014/09/stable-channel-update_9.html
- http://googlechromereleases.blogspot.com/2014/09/stable-channel-update_9.html
- 61446
- 61446
- GLSA-201409-06
- GLSA-201409-06
- DSA-3039
- DSA-3039
- 69709
- 69709
- https://crbug.com/401362
- https://crbug.com/401362
- google-chrome-cve20143178-code-exec(95815)
- google-chrome-cve20143178-code-exec(95815)
- https://src.chromium.org/viewvc/blink?revision=180539&view=revision
- https://src.chromium.org/viewvc/blink?revision=180539&view=revision
Modified: 2024-11-21
CVE-2014-3188
Google Chrome before 38.0.2125.101 and Chrome OS before 38.0.2125.101 do not properly handle the interaction of IPC and Google V8, which allows remote attackers to execute arbitrary code via vectors involving JSON data, related to improper parsing of an escaped index by ParseJsonObject in json-parser.h.
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update-for-chrome-os.html
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update-for-chrome-os.html
- RHSA-2014:1626
- RHSA-2014:1626
- https://code.google.com/p/v8/source/detail?r=24125
- https://code.google.com/p/v8/source/detail?r=24125
- https://crbug.com/416449
- https://crbug.com/416449
Modified: 2024-11-21
CVE-2014-3189
The chrome_pdf::CopyImage function in pdf/draw_utils.cc in the PDFium component in Google Chrome before 38.0.2125.101 does not properly validate image-data dimensions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via unknown vectors.
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- RHSA-2014:1626
- RHSA-2014:1626
- 70273
- 70273
- https://codereview.chromium.org/519873002/
- https://codereview.chromium.org/519873002/
- https://crbug.com/398384
- https://crbug.com/398384
Modified: 2024-11-21
CVE-2014-3190
Use-after-free vulnerability in the Event::currentTarget function in core/events/Event.cpp in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code that accesses the path property of an Event object.
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- RHSA-2014:1626
- RHSA-2014:1626
- 70273
- 70273
- https://crbug.com/400476
- https://crbug.com/400476
- https://src.chromium.org/viewvc/blink?revision=181234&view=revision
- https://src.chromium.org/viewvc/blink?revision=181234&view=revision
Modified: 2024-11-21
CVE-2014-3191
Use-after-free vulnerability in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers a widget-position update that improperly interacts with the render tree, related to the FrameView::updateLayoutAndStyleForPainting function in core/frame/FrameView.cpp and the RenderLayerScrollableArea::setScrollOffset function in core/rendering/RenderLayerScrollableArea.cpp.
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- RHSA-2014:1626
- RHSA-2014:1626
- 70273
- 70273
- https://crbug.com/402407
- https://crbug.com/402407
- https://src.chromium.org/viewvc/blink?revision=180681&view=revision
- https://src.chromium.org/viewvc/blink?revision=180681&view=revision
Modified: 2024-11-21
CVE-2014-3192
Use-after-free vulnerability in the ProcessingInstruction::setXSLStyleSheet function in core/dom/ProcessingInstruction.cpp in the DOM implementation in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- APPLE-SA-2015-01-27-1
- APPLE-SA-2015-01-27-1
- APPLE-SA-2015-01-27-2
- APPLE-SA-2015-01-27-2
- APPLE-SA-2015-01-27-3
- APPLE-SA-2015-01-27-3
- APPLE-SA-2015-06-30-6
- APPLE-SA-2015-06-30-6
- RHSA-2014:1626
- RHSA-2014:1626
- http://support.apple.com/HT204243
- http://support.apple.com/HT204243
- http://support.apple.com/HT204245
- http://support.apple.com/HT204245
- http://support.apple.com/HT204246
- http://support.apple.com/HT204246
- 70273
- 70273
- 1031647
- 1031647
- https://crbug.com/403276
- https://crbug.com/403276
- https://src.chromium.org/viewvc/blink?revision=182309&view=revision
- https://src.chromium.org/viewvc/blink?revision=182309&view=revision
- https://support.apple.com/kb/HT204949
- https://support.apple.com/kb/HT204949
Modified: 2024-11-21
CVE-2014-3193
The SessionService::GetLastSession function in browser/sessions/session_service.cc in Google Chrome before 38.0.2125.101 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors that leverage "type confusion" for callback processing.
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- RHSA-2014:1626
- RHSA-2014:1626
- 70273
- 70273
- https://codereview.chromium.org/500143002/
- https://codereview.chromium.org/500143002/
- https://crbug.com/399655
- https://crbug.com/399655
Modified: 2024-11-21
CVE-2014-3194
Use-after-free vulnerability in the Web Workers implementation in Google Chrome before 38.0.2125.101 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Modified: 2024-11-21
CVE-2014-3195
Google V8, as used in Google Chrome before 38.0.2125.101, does not properly track JavaScript heap-memory allocations as allocations of uninitialized memory and does not properly concatenate arrays of double-precision floating-point numbers, which allows remote attackers to obtain sensitive information via crafted JavaScript code, related to the PagedSpace::AllocateRaw and NewSpace::AllocateRaw functions in heap/spaces-inl.h, the LargeObjectSpace::AllocateRaw function in heap/spaces.cc, and the Runtime_ArrayConcat function in runtime.cc.
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- RHSA-2014:1626
- RHSA-2014:1626
- 70273
- 70273
- https://code.google.com/p/v8/source/detail?r=23144
- https://code.google.com/p/v8/source/detail?r=23144
- https://code.google.com/p/v8/source/detail?r=23268
- https://code.google.com/p/v8/source/detail?r=23268
- https://crbug.com/403409
- https://crbug.com/403409
Modified: 2024-11-21
CVE-2014-3196
base/memory/shared_memory_win.cc in Google Chrome before 38.0.2125.101 on Windows does not properly implement read-only restrictions on shared memory, which allows attackers to bypass a sandbox protection mechanism via unspecified vectors.
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- 70273
- 70273
- https://crbug.com/338538
- https://crbug.com/338538
- https://src.chromium.org/viewvc/chrome?revision=285195&view=revision
- https://src.chromium.org/viewvc/chrome?revision=285195&view=revision
- https://src.chromium.org/viewvc/chrome?revision=288152&view=revision
- https://src.chromium.org/viewvc/chrome?revision=288152&view=revision
Modified: 2024-11-21
CVE-2014-3197
The NavigationScheduler::schedulePageBlock function in core/loader/NavigationScheduler.cpp in Blink, as used in Google Chrome before 38.0.2125.101, does not properly provide substitute data for pages blocked by the XSS auditor, which allows remote attackers to obtain sensitive information via a crafted web site.
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- RHSA-2014:1626
- RHSA-2014:1626
- 70273
- 70273
- https://crbug.com/396544
- https://crbug.com/396544
- https://src.chromium.org/viewvc/blink?revision=179240&view=revision
- https://src.chromium.org/viewvc/blink?revision=179240&view=revision
Modified: 2024-11-21
CVE-2014-3198
The Instance::HandleInputEvent function in pdf/instance.cc in the PDFium component in Google Chrome before 38.0.2125.101 interprets a certain -1 value as an index instead of a no-visible-page error code, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- RHSA-2014:1626
- RHSA-2014:1626
- 70273
- 70273
- https://codereview.chromium.org/560133004
- https://codereview.chromium.org/560133004
- https://crbug.com/415307
- https://crbug.com/415307
Modified: 2024-11-21
CVE-2014-3199
The wrap function in bindings/core/v8/custom/V8EventCustom.cpp in the V8 bindings in Blink, as used in Google Chrome before 38.0.2125.101, has an erroneous fallback outcome for wrapper-selection failures, which allows remote attackers to cause a denial of service via vectors that trigger stopping a worker process that had been handling an Event object.
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- RHSA-2014:1626
- RHSA-2014:1626
- 70273
- 70273
- https://crbug.com/395411
- https://crbug.com/395411
- https://src.chromium.org/viewvc/blink?revision=179340&view=revision
- https://src.chromium.org/viewvc/blink?revision=179340&view=revision
Modified: 2024-11-21
CVE-2014-3200
Multiple unspecified vulnerabilities in Google Chrome before 38.0.2125.101 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html
- RHSA-2014:1626
- RHSA-2014:1626
- 70273
- 70273
- https://code.google.com/p/chromium/issues/detail?id=348333
- https://code.google.com/p/chromium/issues/detail?id=348333
- https://code.google.com/p/chromium/issues/detail?id=355438
- https://code.google.com/p/chromium/issues/detail?id=355438
- https://code.google.com/p/chromium/issues/detail?id=360433
- https://code.google.com/p/chromium/issues/detail?id=360433
- https://code.google.com/p/chromium/issues/detail?id=365141
- https://code.google.com/p/chromium/issues/detail?id=365141
- https://code.google.com/p/chromium/issues/detail?id=374052
- https://code.google.com/p/chromium/issues/detail?id=374052
- https://code.google.com/p/chromium/issues/detail?id=377416
- https://code.google.com/p/chromium/issues/detail?id=377416
- https://code.google.com/p/chromium/issues/detail?id=379458
- https://code.google.com/p/chromium/issues/detail?id=379458
- https://code.google.com/p/chromium/issues/detail?id=381696
- https://code.google.com/p/chromium/issues/detail?id=381696
- https://code.google.com/p/chromium/issues/detail?id=384365
- https://code.google.com/p/chromium/issues/detail?id=384365
- https://code.google.com/p/chromium/issues/detail?id=384891
- https://code.google.com/p/chromium/issues/detail?id=384891
- https://code.google.com/p/chromium/issues/detail?id=386728
- https://code.google.com/p/chromium/issues/detail?id=386728
- https://code.google.com/p/chromium/issues/detail?id=386729
- https://code.google.com/p/chromium/issues/detail?id=386729
- https://code.google.com/p/chromium/issues/detail?id=386730
- https://code.google.com/p/chromium/issues/detail?id=386730
- https://code.google.com/p/chromium/issues/detail?id=387010
- https://code.google.com/p/chromium/issues/detail?id=387010
- https://code.google.com/p/chromium/issues/detail?id=387011
- https://code.google.com/p/chromium/issues/detail?id=387011
- https://code.google.com/p/chromium/issues/detail?id=387013
- https://code.google.com/p/chromium/issues/detail?id=387013
- https://code.google.com/p/chromium/issues/detail?id=387014
- https://code.google.com/p/chromium/issues/detail?id=387014
- https://code.google.com/p/chromium/issues/detail?id=387313
- https://code.google.com/p/chromium/issues/detail?id=387313
- https://code.google.com/p/chromium/issues/detail?id=387506
- https://code.google.com/p/chromium/issues/detail?id=387506
- https://code.google.com/p/chromium/issues/detail?id=387774
- https://code.google.com/p/chromium/issues/detail?id=387774
- https://code.google.com/p/chromium/issues/detail?id=387775
- https://code.google.com/p/chromium/issues/detail?id=387775
- https://code.google.com/p/chromium/issues/detail?id=387776
- https://code.google.com/p/chromium/issues/detail?id=387776
- https://code.google.com/p/chromium/issues/detail?id=387777
- https://code.google.com/p/chromium/issues/detail?id=387777
- https://code.google.com/p/chromium/issues/detail?id=387778
- https://code.google.com/p/chromium/issues/detail?id=387778
- https://code.google.com/p/chromium/issues/detail?id=387779
- https://code.google.com/p/chromium/issues/detail?id=387779
- https://code.google.com/p/chromium/issues/detail?id=387780
- https://code.google.com/p/chromium/issues/detail?id=387780
- https://code.google.com/p/chromium/issues/detail?id=387781
- https://code.google.com/p/chromium/issues/detail?id=387781
- https://code.google.com/p/chromium/issues/detail?id=387782
- https://code.google.com/p/chromium/issues/detail?id=387782
- https://code.google.com/p/chromium/issues/detail?id=387783
- https://code.google.com/p/chromium/issues/detail?id=387783
- https://code.google.com/p/chromium/issues/detail?id=387784
- https://code.google.com/p/chromium/issues/detail?id=387784
- https://code.google.com/p/chromium/issues/detail?id=387785
- https://code.google.com/p/chromium/issues/detail?id=387785
- https://code.google.com/p/chromium/issues/detail?id=387786
- https://code.google.com/p/chromium/issues/detail?id=387786
- https://code.google.com/p/chromium/issues/detail?id=387788
- https://code.google.com/p/chromium/issues/detail?id=387788
- https://code.google.com/p/chromium/issues/detail?id=387789
- https://code.google.com/p/chromium/issues/detail?id=387789
- https://code.google.com/p/chromium/issues/detail?id=387790
- https://code.google.com/p/chromium/issues/detail?id=387790
- https://code.google.com/p/chromium/issues/detail?id=387791
- https://code.google.com/p/chromium/issues/detail?id=387791
- https://code.google.com/p/chromium/issues/detail?id=387792
- https://code.google.com/p/chromium/issues/detail?id=387792
- https://code.google.com/p/chromium/issues/detail?id=387793
- https://code.google.com/p/chromium/issues/detail?id=387793
- https://code.google.com/p/chromium/issues/detail?id=387796
- https://code.google.com/p/chromium/issues/detail?id=387796
- https://code.google.com/p/chromium/issues/detail?id=387797
- https://code.google.com/p/chromium/issues/detail?id=387797
- https://code.google.com/p/chromium/issues/detail?id=387798
- https://code.google.com/p/chromium/issues/detail?id=387798
- https://code.google.com/p/chromium/issues/detail?id=387800
- https://code.google.com/p/chromium/issues/detail?id=387800
- https://code.google.com/p/chromium/issues/detail?id=387801
- https://code.google.com/p/chromium/issues/detail?id=387801
- https://code.google.com/p/chromium/issues/detail?id=387802
- https://code.google.com/p/chromium/issues/detail?id=387802
- https://code.google.com/p/chromium/issues/detail?id=387803
- https://code.google.com/p/chromium/issues/detail?id=387803
- https://code.google.com/p/chromium/issues/detail?id=387805
- https://code.google.com/p/chromium/issues/detail?id=387805
- https://code.google.com/p/chromium/issues/detail?id=387806
- https://code.google.com/p/chromium/issues/detail?id=387806
- https://code.google.com/p/chromium/issues/detail?id=387807
- https://code.google.com/p/chromium/issues/detail?id=387807
- https://code.google.com/p/chromium/issues/detail?id=387808
- https://code.google.com/p/chromium/issues/detail?id=387808
- https://code.google.com/p/chromium/issues/detail?id=387809
- https://code.google.com/p/chromium/issues/detail?id=387809
- https://code.google.com/p/chromium/issues/detail?id=387811
- https://code.google.com/p/chromium/issues/detail?id=387811
- https://code.google.com/p/chromium/issues/detail?id=387812
- https://code.google.com/p/chromium/issues/detail?id=387812
- https://code.google.com/p/chromium/issues/detail?id=387813
- https://code.google.com/p/chromium/issues/detail?id=387813
- https://code.google.com/p/chromium/issues/detail?id=387814
- https://code.google.com/p/chromium/issues/detail?id=387814
- https://code.google.com/p/chromium/issues/detail?id=387815
- https://code.google.com/p/chromium/issues/detail?id=387815
- https://code.google.com/p/chromium/issues/detail?id=387816
- https://code.google.com/p/chromium/issues/detail?id=387816
- https://code.google.com/p/chromium/issues/detail?id=387817
- https://code.google.com/p/chromium/issues/detail?id=387817
- https://code.google.com/p/chromium/issues/detail?id=387818
- https://code.google.com/p/chromium/issues/detail?id=387818
- https://code.google.com/p/chromium/issues/detail?id=387819
- https://code.google.com/p/chromium/issues/detail?id=387819
- https://code.google.com/p/chromium/issues/detail?id=387820
- https://code.google.com/p/chromium/issues/detail?id=387820
- https://code.google.com/p/chromium/issues/detail?id=387821
- https://code.google.com/p/chromium/issues/detail?id=387821
- https://code.google.com/p/chromium/issues/detail?id=387822
- https://code.google.com/p/chromium/issues/detail?id=387822
- https://code.google.com/p/chromium/issues/detail?id=387824
- https://code.google.com/p/chromium/issues/detail?id=387824
- https://code.google.com/p/chromium/issues/detail?id=387825
- https://code.google.com/p/chromium/issues/detail?id=387825
- https://code.google.com/p/chromium/issues/detail?id=387826
- https://code.google.com/p/chromium/issues/detail?id=387826
- https://code.google.com/p/chromium/issues/detail?id=387827
- https://code.google.com/p/chromium/issues/detail?id=387827
- https://code.google.com/p/chromium/issues/detail?id=387831
- https://code.google.com/p/chromium/issues/detail?id=387831
- https://code.google.com/p/chromium/issues/detail?id=387832
- https://code.google.com/p/chromium/issues/detail?id=387832
- https://code.google.com/p/chromium/issues/detail?id=387833
- https://code.google.com/p/chromium/issues/detail?id=387833
- https://code.google.com/p/chromium/issues/detail?id=387834
- https://code.google.com/p/chromium/issues/detail?id=387834
- https://code.google.com/p/chromium/issues/detail?id=387835
- https://code.google.com/p/chromium/issues/detail?id=387835
- https://code.google.com/p/chromium/issues/detail?id=387836
- https://code.google.com/p/chromium/issues/detail?id=387836
- https://code.google.com/p/chromium/issues/detail?id=387837
- https://code.google.com/p/chromium/issues/detail?id=387837
- https://code.google.com/p/chromium/issues/detail?id=387838
- https://code.google.com/p/chromium/issues/detail?id=387838
- https://code.google.com/p/chromium/issues/detail?id=387839
- https://code.google.com/p/chromium/issues/detail?id=387839
- https://code.google.com/p/chromium/issues/detail?id=387840
- https://code.google.com/p/chromium/issues/detail?id=387840
- https://code.google.com/p/chromium/issues/detail?id=387841
- https://code.google.com/p/chromium/issues/detail?id=387841
- https://code.google.com/p/chromium/issues/detail?id=387842
- https://code.google.com/p/chromium/issues/detail?id=387842
- https://code.google.com/p/chromium/issues/detail?id=387843
- https://code.google.com/p/chromium/issues/detail?id=387843
- https://code.google.com/p/chromium/issues/detail?id=387844
- https://code.google.com/p/chromium/issues/detail?id=387844
- https://code.google.com/p/chromium/issues/detail?id=387845
- https://code.google.com/p/chromium/issues/detail?id=387845
- https://code.google.com/p/chromium/issues/detail?id=387846
- https://code.google.com/p/chromium/issues/detail?id=387846
- https://code.google.com/p/chromium/issues/detail?id=387847
- https://code.google.com/p/chromium/issues/detail?id=387847
- https://code.google.com/p/chromium/issues/detail?id=387848
- https://code.google.com/p/chromium/issues/detail?id=387848
- https://code.google.com/p/chromium/issues/detail?id=387850
- https://code.google.com/p/chromium/issues/detail?id=387850
- https://code.google.com/p/chromium/issues/detail?id=387852
- https://code.google.com/p/chromium/issues/detail?id=387852
- https://code.google.com/p/chromium/issues/detail?id=387853
- https://code.google.com/p/chromium/issues/detail?id=387853
- https://code.google.com/p/chromium/issues/detail?id=387854
- https://code.google.com/p/chromium/issues/detail?id=387854
- https://code.google.com/p/chromium/issues/detail?id=387855
- https://code.google.com/p/chromium/issues/detail?id=387855
- https://code.google.com/p/chromium/issues/detail?id=387856
- https://code.google.com/p/chromium/issues/detail?id=387856
- https://code.google.com/p/chromium/issues/detail?id=387857
- https://code.google.com/p/chromium/issues/detail?id=387857
- https://code.google.com/p/chromium/issues/detail?id=387860
- https://code.google.com/p/chromium/issues/detail?id=387860
- https://code.google.com/p/chromium/issues/detail?id=387861
- https://code.google.com/p/chromium/issues/detail?id=387861
- https://code.google.com/p/chromium/issues/detail?id=388133
- https://code.google.com/p/chromium/issues/detail?id=388133
- https://code.google.com/p/chromium/issues/detail?id=388134
- https://code.google.com/p/chromium/issues/detail?id=388134
- https://code.google.com/p/chromium/issues/detail?id=388135
- https://code.google.com/p/chromium/issues/detail?id=388135
- https://code.google.com/p/chromium/issues/detail?id=389573
- https://code.google.com/p/chromium/issues/detail?id=389573
- https://code.google.com/p/chromium/issues/detail?id=390069
- https://code.google.com/p/chromium/issues/detail?id=390069
- https://code.google.com/p/chromium/issues/detail?id=390308
- https://code.google.com/p/chromium/issues/detail?id=390308
- https://code.google.com/p/chromium/issues/detail?id=390567
- https://code.google.com/p/chromium/issues/detail?id=390567
- https://code.google.com/p/chromium/issues/detail?id=390601
- https://code.google.com/p/chromium/issues/detail?id=390601
- https://code.google.com/p/chromium/issues/detail?id=390941
- https://code.google.com/p/chromium/issues/detail?id=390941
- https://code.google.com/p/chromium/issues/detail?id=390944
- https://code.google.com/p/chromium/issues/detail?id=390944
- https://code.google.com/p/chromium/issues/detail?id=390945
- https://code.google.com/p/chromium/issues/detail?id=390945
- https://code.google.com/p/chromium/issues/detail?id=390973
- https://code.google.com/p/chromium/issues/detail?id=390973
- https://code.google.com/p/chromium/issues/detail?id=390999
- https://code.google.com/p/chromium/issues/detail?id=390999
- https://code.google.com/p/chromium/issues/detail?id=391000
- https://code.google.com/p/chromium/issues/detail?id=391000
- https://code.google.com/p/chromium/issues/detail?id=391004
- https://code.google.com/p/chromium/issues/detail?id=391004
- https://code.google.com/p/chromium/issues/detail?id=391301
- https://code.google.com/p/chromium/issues/detail?id=391301
- https://code.google.com/p/chromium/issues/detail?id=391470
- https://code.google.com/p/chromium/issues/detail?id=391470
- https://code.google.com/p/chromium/issues/detail?id=391472
- https://code.google.com/p/chromium/issues/detail?id=391472
- https://code.google.com/p/chromium/issues/detail?id=391905
- https://code.google.com/p/chromium/issues/detail?id=391905
- https://code.google.com/p/chromium/issues/detail?id=391910
- https://code.google.com/p/chromium/issues/detail?id=391910
- https://code.google.com/p/chromium/issues/detail?id=392718
- https://code.google.com/p/chromium/issues/detail?id=392718
- https://code.google.com/p/chromium/issues/detail?id=392721
- https://code.google.com/p/chromium/issues/detail?id=392721
- https://code.google.com/p/chromium/issues/detail?id=392723
- https://code.google.com/p/chromium/issues/detail?id=392723
- https://code.google.com/p/chromium/issues/detail?id=393452
- https://code.google.com/p/chromium/issues/detail?id=393452
- https://code.google.com/p/chromium/issues/detail?id=393603
- https://code.google.com/p/chromium/issues/detail?id=393603
- https://code.google.com/p/chromium/issues/detail?id=393831
- https://code.google.com/p/chromium/issues/detail?id=393831
- https://code.google.com/p/chromium/issues/detail?id=393833
- https://code.google.com/p/chromium/issues/detail?id=393833
- https://code.google.com/p/chromium/issues/detail?id=395351
- https://code.google.com/p/chromium/issues/detail?id=395351
- https://code.google.com/p/chromium/issues/detail?id=395461
- https://code.google.com/p/chromium/issues/detail?id=395461
- https://code.google.com/p/chromium/issues/detail?id=395650
- https://code.google.com/p/chromium/issues/detail?id=395650
- https://code.google.com/p/chromium/issues/detail?id=397834
- https://code.google.com/p/chromium/issues/detail?id=397834
- https://code.google.com/p/chromium/issues/detail?id=397835
- https://code.google.com/p/chromium/issues/detail?id=397835
- https://code.google.com/p/chromium/issues/detail?id=399783
- https://code.google.com/p/chromium/issues/detail?id=399783
- https://code.google.com/p/chromium/issues/detail?id=400025
- https://code.google.com/p/chromium/issues/detail?id=400025
- https://code.google.com/p/chromium/issues/detail?id=401363
- https://code.google.com/p/chromium/issues/detail?id=401363
- https://code.google.com/p/chromium/issues/detail?id=404513
- https://code.google.com/p/chromium/issues/detail?id=404513
- https://code.google.com/p/chromium/issues/detail?id=405335
- https://code.google.com/p/chromium/issues/detail?id=405335
- https://code.google.com/p/chromium/issues/detail?id=405416
- https://code.google.com/p/chromium/issues/detail?id=405416
- https://code.google.com/p/chromium/issues/detail?id=406548
- https://code.google.com/p/chromium/issues/detail?id=406548
- https://code.google.com/p/chromium/issues/detail?id=406879
- https://code.google.com/p/chromium/issues/detail?id=406879
- https://code.google.com/p/chromium/issues/detail?id=407235
- https://code.google.com/p/chromium/issues/detail?id=407235
- https://code.google.com/p/chromium/issues/detail?id=407477
- https://code.google.com/p/chromium/issues/detail?id=407477
- https://code.google.com/p/chromium/issues/detail?id=408551
- https://code.google.com/p/chromium/issues/detail?id=408551
- https://code.google.com/p/chromium/issues/detail?id=409023
- https://code.google.com/p/chromium/issues/detail?id=409023
- https://code.google.com/p/chromium/issues/detail?id=409506
- https://code.google.com/p/chromium/issues/detail?id=409506
- https://code.google.com/p/chromium/issues/detail?id=411154
- https://code.google.com/p/chromium/issues/detail?id=411154
- https://code.google.com/p/chromium/issues/detail?id=411163
- https://code.google.com/p/chromium/issues/detail?id=411163
- https://code.google.com/p/chromium/issues/detail?id=411177
- https://code.google.com/p/chromium/issues/detail?id=411177
- https://code.google.com/p/chromium/issues/detail?id=411210
- https://code.google.com/p/chromium/issues/detail?id=411210
- https://code.google.com/p/chromium/issues/detail?id=411318
- https://code.google.com/p/chromium/issues/detail?id=411318
- https://code.google.com/p/chromium/issues/detail?id=416526
- https://code.google.com/p/chromium/issues/detail?id=416526
- https://code.google.com/p/chromium/issues/detail?id=416528
- https://code.google.com/p/chromium/issues/detail?id=416528
- https://code.google.com/p/chromium/issues/detail?id=417731
- https://code.google.com/p/chromium/issues/detail?id=417731
- https://code.google.com/p/chromium/issues/detail?id=420899
- https://code.google.com/p/chromium/issues/detail?id=420899
Modified: 2024-11-21
CVE-2014-3803
The SpeechInput feature in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to enable microphone access and obtain speech-recognition text without indication via an INPUT element with a -x-webkit-speech attribute.
- http://blog.guya.net/2014/04/07/to-listen-without-consent-abusing-the-html5-speech/
- http://blog.guya.net/2014/04/07/to-listen-without-consent-abusing-the-html5-speech/
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html
- http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html
- 60372
- 60372
- 67582
- 67582
- https://code.google.com/p/chromium/issues/detail?id=360448
- https://code.google.com/p/chromium/issues/detail?id=360448
- https://src.chromium.org/viewvc/blink?revision=171373&view=revision
- https://src.chromium.org/viewvc/blink?revision=171373&view=revision
Modified: 2024-11-21
CVE-2014-7899
Google Chrome before 38.0.2125.101 allows remote attackers to spoof the address bar by placing a blob: substring at the beginning of the URL, followed by the original URI scheme and a long username string.
- http://googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.html
- http://googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.html
- RHSA-2014:1894
- RHSA-2014:1894
- 60194
- 60194
- 71160
- 71160
- 1031241
- 1031241
- https://code.google.com/p/chromium/issues/detail?id=389734
- https://code.google.com/p/chromium/issues/detail?id=389734
- google-chrome-cve20147899-spoofing(98787)
- google-chrome-cve20147899-spoofing(98787)
- https://src.chromium.org/viewvc/chrome?revision=279232&view=revision
- https://src.chromium.org/viewvc/chrome?revision=279232&view=revision
Modified: 2024-11-21
CVE-2014-7967
Multiple unspecified vulnerabilities in Google V8 before 3.28.71.15, as used in Google Chrome before 38.0.2125.101, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Closed bugs
Мелкие ошибки в Chromium версия 21.0.1180.89 ALT Linux (154005)
Не верный перевод в chromium
После обновления libnss перестали открываться сайты Google в Chromium