Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 32

Export CSV
CVE-2016-1952

Mozilla: Miscellaneous memory safety hazards (rv:38.7) (MFSA 2016-16)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 3.0 · 8.8 High EPSS 3.0% KEV · Not listed
Vendors
Mozilla Novell Opensuse and 2 more
Products
Firefox Thunderbird Suse Package Hub For Suse Linux Enterprise and 4 more
CVE-2016-1953

Mozilla: Miscellaneous memory safety hazards (rv:45.0) (MFSA 2016-16)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to js/src/jit/arm/Assembler-arm.cpp, and unknown other vectors.

CVSS 3.0 · 8.8 High EPSS 3.2% KEV · Not listed
Vendors
Mozilla Novell Opensuse
Products
Firefox Thunderbird Suse Package Hub For Suse Linux Enterprise and 2 more
CVE-2016-1954

Mozilla: Local file overwriting and potential privilege escalation through CSP reports (MFSA 2016-17)

The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not prevent use of a non-HTTP report-uri for a Content Security Policy (CSP) violation report, which allows remote attackers to cause a denial of service (data overwrite) or possibly gain privileges by specifying a URL of a local file.

CVSS 3.0 · 8.8 High EPSS 2.3% KEV · Not listed
Vendors
Mozilla Novell Opensuse and 2 more
Products
Firefox Thunderbird Suse Package Hub For Suse Linux Enterprise and 4 more
CVE-2016-1955

Mozilla: CSP reports fail to strip location information for embedded iframe pages (MFSA 2016-18)

Mozilla Firefox before 45.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy (CSP) violation report that contains path information associated with an IFRAME element.

CVSS 3.0 · 4.3 Medium EPSS 2.0% KEV · Not listed
Vendors
Mozilla Novell Opensuse
Products
Firefox Suse Package Hub For Suse Linux Enterprise Leap and 1 more
CVE-2016-1957

Mozilla: Memory leak in libstagefright when deleting an array during MP4 processing (MFSA 2016-20)

Memory leak in libstagefright in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to cause a denial of service (memory consumption) via an MPEG-4 file that triggers a delete operation on an array.

CVSS 3.0 · 4.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Mozilla Novell Opensuse and 2 more
Products
Firefox Thunderbird Suse Package Hub For Suse Linux Enterprise and 4 more
CVE-2016-2818

Mozilla: Miscellaneous memory safety hazards (rv:45.2) (MFSA 2016-49)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 3.0 · 8.8 High EPSS 3.9% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 19 more
CVE-2016-2834

nss: Multiple security flaws (MFSA 2016-61)

Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.

CVSS 3.0 · 8.8 High EPSS 3.4% KEV · Not listed
Vendors
Canonical Mozilla Novell and 2 more
Products
Ubuntu Linux Firefox Network Security Services and 6 more
CVE-2016-4955

ntp: autokey association reset

ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet or (2) a packet with an incorrect MAC value at a certain time.

CVSS 3.1 · 5.9 Medium EPSS 8.8% KEV · Not listed
Vendors
Novell Ntp Opensuse and 3 more
Products
Suse Manager Ntp Leap and 8 more
CVE-2016-4956

ntp: broadcast interleave (incomplete fix for CVE-2016-1548)

ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-1548.

CVSS 3.1 · 5.3 Medium EPSS 16.4% KEV · Not listed
Vendors
Novell Ntp Opensuse and 3 more
Products
Suse Manager Ntp Leap and 8 more
CVE-2019-9811

Mozilla: Sandbox escape via installation of malicious language pack

As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

CVSS 3.1 · 8.3 High EPSS 2.6% KEV · Not listed
Vendors
Debian Mozilla Novell and 2 more
Products
Debian Linux Firefox Firefox Esr and 4 more