CVE-2011-0051

Mozilla recursive eval call causes confirm dialog to evaluate to true (MFSA 2011-02)

Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, does not properly handle certain recursive eval calls, which makes it easier for remote attackers to force a user to respond positively to a dialog question, as demonstrated by a question about granting privileges.

CVSS 2.0 · 6.8 Medium EPSS 1.8% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Enterprise Linux and 1 more

CVE-2011-0053

Mozilla miscellaneous memory safety hazards (MFSA 2011-01)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 10.0 Critical EPSS 5.8% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Thunderbird and 2 more

CVE-2011-0054

Mozilla Buffer overflow in JavaScript upvarMap (MFSA 2011-04)

Buffer overflow in the JavaScript engine in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, might allow remote attackers to execute arbitrary code via vectors involving non-local JavaScript variables, aka an "upvarMap" issue.

CVSS 2.0 · 10.0 Critical EPSS 4.6% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Enterprise Linux

CVE-2011-0055

Mozilla use-after-free error in JSON.stringify (MFSA2011-03)

Use-after-free vulnerability in the JSON.stringify method in js3250.dll in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, might allow remote attackers to execute arbitrary code via unspecified vectors related to the js_HasOwnProperty function and garbage collection.

CVSS 2.0 · 10.0 Critical EPSS 7.2% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Enterprise Linux

CVE-2011-0056

Mozilla Buffer overflow in JavaScript atom map (MFSA 2011-05)

Buffer overflow in the JavaScript engine in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, might allow remote attackers to execute arbitrary code via vectors involving exception timing and a large number of string values, aka an "atom map" issue.

CVSS 2.0 · 10.0 Critical EPSS 4.6% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Enterprise Linux

CVE-2011-0057

Mozilla use-after-free error using Web Workers (MFSA 2011-06)

Use-after-free vulnerability in the Web Workers implementation in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, allows remote attackers to execute arbitrary code via vectors related to a JavaScript Worker and garbage collection.

CVSS 2.0 · 10.0 Critical EPSS 4.7% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Enterprise Linux

CVE-2011-0058

Mozilla memory corruption during text run construction (MFSA 2011-07)

Buffer overflow in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a long string that triggers construction of a long text run.

CVSS 2.0 · 10.0 Critical EPSS 5.5% KEV · Not listed

Vendors

Microsoft Mozilla Redhat

Products

Windows Firefox Seamonkey and 1 more

CVE-2011-0059

Mozilla CSRF risk with plugins and 307 redirects (MFSA 2011-10)

Cross-site request forgery (CSRF) vulnerability in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, allows remote attackers to hijack the authentication of arbitrary users for requests that were initiated by a plugin and received a 307 redirect to a page on a different web site.

CVSS 2.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Enterprise Linux

CVE-2011-0061

Mozilla crash caused by corrupted JPEG image (MFSA 2011-09)

Buffer overflow in Mozilla Firefox 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG image.

CVSS 2.0 · 9.3 Critical EPSS 4.7% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Thunderbird and 1 more

CVE-2011-0062

Mozilla miscellaneous memory safety hazards (MFSA 2011-01)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.6.x before 3.6.14 and Thunderbird 3.1.x before 3.1.8 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 10.0 Critical EPSS 3.8% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Thunderbird Enterprise Linux

CVE-2011-0064

pango: missing memory reallocation failure checking in hb_buffer_ensure

The hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via crafted OpenType font data that triggers use of an incorrect index.

CVSS 2.0 · 6.8 Medium EPSS 3.3% KEV · Not listed

Vendors

Gnome Mozilla Redhat

Products

Pango Firefox Enterprise Linux

CVE-2011-0065

Mozilla mChannel use after free (MFSA 2011-13)

Use-after-free vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, allows remote attackers to execute arbitrary code via vectors related to OBJECT's mChannel.

CVSS 2.0 · 10.0 Critical EPSS 74.4% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Enterprise Linux

CVE-2011-0066

Mozilla mObserverList use after free (MFSA 2011-13)

Use-after-free vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, allows remote attackers to execute arbitrary code via vectors related to OBJECT's mObserverList.

CVSS 2.0 · 10.0 Critical EPSS 4.9% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Enterprise Linux

CVE-2011-0067

Mozilla untrusted events can trigger autocomplete popup (MFSA 2011-14)

Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, does not properly implement autocompletion for forms, which allows remote attackers to read form history entries via a Java applet that spoofs interaction with the autocomplete controls.

CVSS 2.0 · 5.0 Medium EPSS 2.3% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Enterprise Linux

CVE-2011-0069

Mozilla javascript crash (MFSA 2011-12)

Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.19, 3.6.x before 3.6.17, and 4.x before 4.0.1; Thunderbird before 3.1.10; and SeaMonkey before 2.0.14 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-0070.

CVSS 2.0 · 10.0 Critical EPSS 7.1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Thunderbird and 1 more

CVE-2011-0070

Mozilla double free flaw (MFSA 2011-12)

Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.19, 3.6.x before 3.6.17, and 4.x before 4.0.1; Thunderbird before 3.1.10; and SeaMonkey before 2.0.14 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-0069.

CVSS 2.0 · 10.0 Critical EPSS 7.1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Thunderbird and 1 more

CVE-2011-0071

Mozilla directory traversal via resource protocol (MFSA 2011-16)

Directory traversal vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14 on Windows allows remote attackers to determine the existence of arbitrary files, and possibly load resources, via vectors involving a resource: URL.

CVSS 2.0 · 5.0 Medium EPSS 2.9% KEV · Not listed

Vendors

Microsoft Mozilla Redhat

Products

Windows Firefox Seamonkey and 2 more

CVE-2011-0072

Mozilla use after free flaw (MFSA 2011-12)

Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-0074, CVE-2011-0075, CVE-2011-0077, and CVE-2011-0078.

CVSS 2.0 · 10.0 Critical EPSS 5.4% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Thunderbird and 1 more

CVE-2011-0073

Mozilla dangling pointer flaw (MFSA 2011-13)

Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, does not properly use nsTreeRange data structures, which allows remote attackers to execute arbitrary code via unspecified vectors that lead to a "dangling pointer."

CVSS 2.0 · 10.0 Critical EPSS 70.9% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Enterprise Linux

CVE-2011-0074

Mozilla crash from several marquee elements (MFSA 2011-12)

Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-0072, CVE-2011-0075, CVE-2011-0077, and CVE-2011-0078.

CVSS 2.0 · 10.0 Critical EPSS 5.4% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Thunderbird and 1 more