CVE-2015-7217

Mozilla: Linux file chooser crashes on malformed JPEG2000 and TGA images due to flaws in underlying libraries (MFSA 2015-143)

The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly enables the TGA decoder, which allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted Truevision TGA image.

CVSS 2.0 · 4.3 Medium EPSS 2.8% KEV · Not listed

Vendors

Fedoraproject Gnome Mozilla and 1 more

Products

Fedora Gnome Firefox and 2 more

CVE-2015-7216

Mozilla: Linux file chooser crashes on malformed JPEG2000 and TGA images due to flaws in underlying libraries (MFSA 2015-143)

The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly enables the JasPer decoder, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JPEG 2000 image.

CVSS 2.0 · 6.8 Medium EPSS 2.1% KEV · Not listed

Vendors

Fedoraproject Gnome Mozilla and 1 more

Products

Fedora Gnome Firefox and 2 more

CVE-2015-7215

Mozilla: Cross-origin information leak through web workers error events (MFSA 2015-140)

The importScripts function in the Web Workers API implementation in Mozilla Firefox before 43.0 allows remote attackers to bypass the Same Origin Policy by triggering use of the no-cors mode in the fetch API to attempt resource access that throws an exception, leading to information disclosure after a rethrow.

CVSS 2.0 · 5.0 Medium EPSS 2.5% KEV · Not listed

Vendors

Fedoraproject Mozilla Opensuse

Products

Fedora Firefox Leap and 1 more

CVE-2015-7214

Mozilla: Cross-site reading attack through data: and view-source: URIs (MFSA 2015-149)

Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and view-source: URIs.

CVSS 2.0 · 5.0 Medium EPSS 6.1% KEV · Not listed

Vendors

Fedoraproject Mozilla Opensuse and 1 more

Products

Fedora Firefox Leap and 2 more

CVE-2015-7213

Mozilla: Integer overflow in MP4 playback in 64-bit versions (MFSA 2015-146)

Integer overflow in the MPEG4Extractor::readMetaData function in MPEG4Extractor.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 on 64-bit platforms allows remote attackers to execute arbitrary code via a crafted MP4 video file that triggers a buffer overflow.

CVSS 2.0 · 6.8 Medium EPSS 4.1% KEV · Not listed

Vendors

Fedoraproject Mozilla Opensuse and 1 more

Products

Fedora Firefox Leap and 2 more

CVE-2015-7212

Mozilla: Integer overflow allocating extremely large textures (MFSA 2015-139)

Integer overflow in the mozilla::layers::BufferTextureClient::AllocateForSurface function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering a graphics operation that requires a large texture allocation.

CVSS 2.0 · 7.5 High EPSS 4.0% KEV · Not listed

Vendors

Fedoraproject Mozilla Opensuse and 1 more

Products

Fedora Firefox Leap and 2 more

CVE-2015-7211

Mozilla: Hash in data: URI is incorrectly parsed (MFSA 2015-141)

Mozilla Firefox before 43.0 mishandles the # (number sign) character in a data: URI, which allows remote attackers to spoof web sites via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 2.5% KEV · Not listed

Vendors

Fedoraproject Mozilla Opensuse

Products

Fedora Firefox Leap and 1 more

CVE-2015-7210

Mozilla: Use-after-free in WebRTC when datachannel is used after being destroyed (MFSA 2015-138)

Use-after-free vulnerability in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering attempted use of a data channel that has been closed by a WebRTC function.

CVSS 2.0 · 7.5 High EPSS 4.3% KEV · Not listed

Vendors

Fedoraproject Mozilla Opensuse and 1 more

Products

Fedora Firefox Leap and 2 more

CVE-2015-7208

Mozilla: Firefox allows for control characters to be set in cookies (MFSA 2015-137)

Mozilla Firefox before 43.0 stores cookies containing vertical tab characters, which allows remote attackers to obtain sensitive information by reading HTTP Cookie headers.

CVSS 2.0 · 5.0 Medium EPSS 2.4% KEV · Not listed

Vendors

Fedoraproject Mozilla Opensuse

Products

Fedora Firefox Leap and 1 more

CVE-2015-7207

Mozilla: Same-origin policy violation using perfomance.getEntries and history navigation (MFSA 2015-136)

Mozilla Firefox before 43.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls, a related issue to CVE-2015-1300.

CVSS 2.0 · 5.0 Medium EPSS 2.8% KEV · Not listed

Vendors

Fedoraproject Mozilla Opensuse

Products

Fedora Firefox Leap and 1 more

CVE-2015-7205

Mozilla: Underflow through code inspection (MFSA 2015-145)

Integer underflow in the RTPReceiverVideo::ParseRtpPacket function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 might allow remote attackers to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a crafted WebRTC RTP packet.

CVSS 2.0 · 10.0 Critical EPSS 3.2% KEV · Not listed

Vendors

Fedoraproject Mozilla Opensuse and 1 more

Products

Fedora Firefox Leap and 2 more

CVE-2015-7204

Mozilla: Crash with JavaScript variable assignment with unboxed objects (MFSA 2015-135)

Mozilla Firefox before 43.0 does not properly store the properties of unboxed objects, which allows remote attackers to execute arbitrary code via crafted JavaScript variable assignments.

CVSS 2.0 · 6.8 Medium EPSS 3.5% KEV · Not listed

Vendors

Fedoraproject Mozilla Opensuse

Products

Fedora Firefox Leap and 1 more

CVE-2015-7203

Mozilla: Buffer overflows found through code inspection (MFSA 2015-144)

Buffer overflow in the DirectWriteFontInfo::LoadFontFamilyData function in gfx/thebes/gfxDWriteFontList.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted font-family name.

CVSS 2.0 · 10.0 Critical EPSS 4.3% KEV · Not listed

Vendors

Fedoraproject Mozilla Opensuse

Products

Fedora Firefox Leap and 1 more

CVE-2015-7202

Mozilla: Miscellaneous memory safety hazards (rv:43.0) (MFSA 2015-134)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 10.0 Critical EPSS 5.9% KEV · Not listed

Vendors

Fedoraproject Mozilla Opensuse

Products

Fedora Firefox Leap and 1 more

CVE-2015-7201

Mozilla: Miscellaneous memory safety hazards (rv:38.5) (MFSA 2015-134)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 10.0 Critical EPSS 6.0% KEV · Not listed

Vendors

Fedoraproject Mozilla Opensuse and 1 more

Products

Fedora Firefox Leap and 2 more

CVE-2015-7200

Mozilla: Vulnerabilities found through code inspection (MFSA 2015-131)

The CryptoKey interface implementation in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lacks status checking, which allows attackers to have an unspecified impact via vectors related to a cryptographic key.

CVSS 2.0 · 7.5 High EPSS 2.1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Enterprise Linux

CVE-2015-7199

Mozilla: Vulnerabilities found through code inspection (MFSA 2015-131)

The (1) AddWeightedPathSegLists and (2) SVGPathSegListSMILType::Interpolate functions in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lack status checking, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted SVG document.

CVSS 2.0 · 7.5 High EPSS 3.1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Enterprise Linux

CVE-2015-7198

Mozilla: Vulnerabilities found through code inspection (MFSA 2015-131)

Buffer overflow in the rx::TextureStorage11 class in ANGLE, as used in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted texture data.

CVSS 2.0 · 7.5 High EPSS 3.2% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Enterprise Linux

CVE-2015-7197

Mozilla: Mixed content WebSocket policy bypass through workers (MFSA 2015-132)

Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly control the ability of a web worker to create a WebSocket object, which allows remote attackers to bypass intended mixed-content restrictions via crafted JavaScript code.

CVSS 2.0 · 5.0 Medium EPSS 2.5% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Enterprise Linux

CVE-2016-5257

Mozilla: Memory safety bugs fixed in Firefox ESR 45.4 (MFSA 2016-85, MFSA 2016-86)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4 and Thunderbird < 45.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 3.0 · 9.8 Critical EPSS 4.2% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Enterprise Linux