Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 96

Export CSV
CVE-2014-1514

Mozilla: Out-of-bounds write through TypedArrayObject after neutering (MFSA 2014-32)

vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the length of the destination array before a copy operation, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by triggering incorrect use of the TypedArrayObject class.

CVSS 3.1 · 9.8 Critical EPSS 6.0% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 14 more
CVE-2014-1496

Mozilla: Files extracted during updates are not always read only (MFSA 2014-16)

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 might allow local users to gain privileges by modifying the extracted Mar contents during an update.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla Suse
Products
Firefox Seamonkey Thunderbird and 3 more
CVE-2014-1486

Mozilla: Use-after-free with imgRequestProxy and image proccessing (MFSA 2014-08)

Use-after-free vulnerability in the imgRequestProxy function in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving unspecified Content-Type values for image data.

CVSS 3.1 · 9.8 Critical EPSS 7.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 14 more
CVE-2013-5613

Mozilla: Use-after-free in synthetic mouse movement (MFSA 2013-114)

Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving synthetic mouse movement, related to the RestyleManager::GetHoverGeneration function.

CVSS 3.1 · 9.8 Critical EPSS 9.4% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 3 more
Products
Ubuntu Linux Fedora Firefox and 14 more
CVE-2014-1510

Mozilla: Privilege escalation using WebIDL-implemented APIs (MFSA 2014-29)

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript code with chrome privileges by using an IDL fragment to trigger a window.open call.

CVSS 3.1 · 9.8 Critical EPSS 82.2% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 14 more
CVE-2013-5616

Mozilla: Use-after-free in event listeners (MFSA 2013-108)

Use-after-free vulnerability in the nsEventListenerManager::HandleEventSubType function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to mListeners event listeners.

CVSS 3.1 · 9.8 Critical EPSS 6.7% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 3 more
Products
Ubuntu Linux Fedora Firefox and 14 more
CVE-2014-1505

Mozilla: SVG filters information disclosure through feDisplacementMap (MFSA 2014-28)

The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information, and possibly bypass the Same Origin Policy and read text from a different domain, via a timing attack involving feDisplacementMap elements, a related issue to CVE-2013-1693.

CVSS 3.1 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Canonical Debian Mozilla and 4 more
Products
Ubuntu Linux Debian Linux Firefox and 14 more
CVE-2014-1477

Mozilla: Miscellaneous memory safety hazards (rv:24.3) (MFSA 2014-01)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 3.1 · 9.8 Critical EPSS 5.5% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2014-1508

Mozilla: Information disclosure through polygon rendering in MathML (MFSA 2014-26)

The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process memory, cause a denial of service (out-of-bounds read and application crash), or possibly bypass the Same Origin Policy via vectors involving MathML polygon rendering.

CVSS 3.1 · 9.1 Critical EPSS 4.2% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 14 more
CVE-2014-1511

Mozilla: Privilege escalation using WebIDL-implemented APIs (MFSA 2014-29)

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified vectors.

CVSS 3.1 · 9.8 Critical EPSS 83.5% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 14 more
CVE-2014-1482

Mozilla: Incorrect use of discarded images by RasterImage (MFSA 2014-04)

RasterImage.cpp in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent access to discarded data, which allows remote attackers to execute arbitrary code or cause a denial of service (incorrect write operations) via crafted image data, as demonstrated by Goo Create.

CVSS 3.1 · 8.8 High EPSS 6.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2014-1479

Mozilla: Clone protected content with XBL scopes (MFSA 2014-02)

The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent certain cloning operations, which allows remote attackers to bypass intended restrictions on XUL content via vectors involving XBL content scopes.

CVSS 3.1 · 7.5 High EPSS 4.6% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2017-1000366

glibc: heap/stack gap jumping via unbounded stack allocations

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.

CVSS 3.0 · 7.8 High EPSS 2.7% KEV · Not listed
Vendors
Debian Gnu Mcafee and 5 more
Products
Debian Linux Glibc Web Gateway and 23 more
CVE-2015-3405

ntp: ntp-keygen may generate non-random symmetric keys on big-endian systems

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.

CVSS 3.0 · 7.5 High EPSS 5.3% KEV · Not listed
Vendors
Debian Fedoraproject Ntp and 4 more
Products
Debian Linux Fedora Ntp and 11 more
CVE-2014-0553

flash-plugin: multiple code execution or security bypass flaws (APSB14-21)

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allows attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0 · 10.0 Critical EPSS 9.6% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Adobe Air Adobe Air Sdk Flash Player and 7 more
CVE-2014-4258

mysql: unspecified vulnerability related to SRINFOSC (CPU July 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier and 5.6.17 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SRINFOSC.

CVSS 2.0 · 6.5 Medium EPSS 3.5% KEV · Not listed
Vendors
Debian Mariadb Opensuse Project and 4 more
Products
Debian Linux Mariadb Suse Linux Enterprise Desktop and 12 more
CVE-2014-8121

glibc: Unexpected closing of nss_files databases after lookups causes denial of service

DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.

CVSS 2.0 · 5.0 Medium EPSS 5.6% KEV · Not listed
Vendors
Canonical Gnu Redhat and 1 more
Products
Ubuntu Linux Glibc Enterprise Linux and 2 more