CVE-2013-0762

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

Use-after-free vulnerability in the imgRequest::OnStopFrame function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.7% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 13 more

CVE-2013-0763

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

Use-after-free vulnerability in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to Mesa drivers and a resized WebGL canvas.

CVSS 2.0 · 9.3 Critical EPSS 4.4% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 11 more

CVE-2013-0766

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

Use-after-free vulnerability in the ~nsHTMLEditRules implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.7% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 13 more

CVE-2013-0767

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

The nsSVGPathElement::GetPathLengthScale function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.

CVSS 2.0 · 10.0 Critical EPSS 5.8% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 13 more

CVE-2013-0768

Mozilla: Buffer Overflow in Canvas (MFSA 2013-03)

Stack-based buffer overflow in the Canvas implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via an HTML document that specifies invalid width and height values.

CVSS 2.0 · 9.3 Critical EPSS 7.6% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 10 more

CVE-2013-0769

Mozilla: Miscellaneous memory safety hazards (rv:10.0.12) (MFSA 2013-01)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 9.3 Critical EPSS 5.8% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 13 more

CVE-2013-0772

Mozilla: Out-of-bounds read in image rendering (MFSA 2013-22)

The RasterImage::DrawFrameTo function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and application crash) via a crafted GIF image.

CVSS 2.0 · 5.8 Medium EPSS 2.0% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 1 more

Products

Ubuntu Linux Firefox Seamonkey and 7 more

CVE-2013-0775

Mozilla: Use-after-free in nsImageLoadingContent (MFSA 2013-26)

Use-after-free vulnerability in the nsImageLoadingContent::OnStopContainer function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code via crafted web script.

CVSS 2.0 · 9.3 Critical EPSS 3.5% KEV · Not listed

Vendors

Canonical Debian Mozilla and 2 more

Products

Ubuntu Linux Debian Linux Firefox and 11 more

CVE-2013-0776

Mozilla: Phishing on HTTPS connection through malicious proxy (MFSA 2013-27)

Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow man-in-the-middle attackers to spoof the address bar by operating a proxy server that provides a 407 HTTP status code accompanied by web script, as demonstrated by a phishing attack on an HTTPS site.

CVSS 2.0 · 4.0 Medium EPSS 1.3% KEV · Not listed

Vendors

Canonical Debian Mozilla and 2 more

Products

Ubuntu Linux Debian Linux Firefox and 11 more

CVE-2013-0780

Mozilla: Use-after-free, out of bounds read, and buffer overflow issues found using Address Sanitizer (MFSA 2013-28)

Use-after-free vulnerability in the nsOverflowContinuationTracker::Finish function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted document that uses Cascading Style Sheets (CSS) -moz-column-* properties.

CVSS 2.0 · 9.3 Critical EPSS 4.4% KEV · Not listed

Vendors

Canonical Debian Mozilla and 2 more

Products

Ubuntu Linux Debian Linux Firefox and 11 more

CVE-2013-0782

Mozilla: Use-after-free, out of bounds read, and buffer overflow issues found using Address Sanitizer (MFSA 2013-28)

Heap-based buffer overflow in the nsSaveAsCharset::DoCharsetConversion function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 5.4% KEV · Not listed

Vendors

Canonical Debian Mozilla and 2 more

Products

Ubuntu Linux Debian Linux Firefox and 11 more

CVE-2013-0783

Mozilla: Miscellaneous memory safety hazards (rv:17.0.3) (MFSA 2013-21)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.7% KEV · Not listed

Vendors

Canonical Debian Mozilla and 2 more

Products

Ubuntu Linux Debian Linux Firefox and 11 more

CVE-2013-0791

Mozilla: Out-of-bounds array read in CERT_DecodeCertPackage (MFSA 2013-40)

The CERT_DecodeCertPackage function in Mozilla Network Security Services (NSS), as used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) via a crafted certificate.

CVSS 2.0 · 5.0 Medium EPSS 5.2% KEV · Not listed

Vendors

Canonical Mozilla Oracle and 1 more

Products

Ubuntu Linux Firefox Network Security Services and 10 more

CVE-2013-1416

krb5: NULL pointer dereference (DoS, KDC crash) by processing certain TGS requests

The prep_reprocess_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.5 does not properly perform service-principal realm referral, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS-REQ request.

CVSS 2.0 · 4.0 Medium EPSS 2.9% KEV · Not listed

Vendors

Fedoraproject Mit Opensuse and 1 more

Products

Fedora Kerberos 5 Opensuse and 6 more

CVE-2013-1506

mysql: unspecified DoS related to Server Locking (CPU April 2013)

Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier, 5.5.29 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Locking.

CVSS 2.0 · 2.8 Low EPSS 1.9% KEV · Not listed

Vendors

Mariadb Oracle Redhat

Products

Mariadb Mysql Enterprise Linux and 5 more

CVE-2013-1521

mysql: unspecified vulnerability related to Server Locking (CPU April 2013)

Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Server Locking.

CVSS 2.0 · 6.5 Medium EPSS 2.3% KEV · Not listed

Vendors

Mariadb Oracle Redhat

Products

Mariadb Mysql Enterprise Linux and 5 more

CVE-2013-1531

mysql: unspecified vulnerability related to Server Privileges (CPU April 2013)

Unspecified vulnerability in Oracle MySQL 5.1.66 and earlier and 5.5.28 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Server Privileges.

CVSS 2.0 · 6.5 Medium EPSS 2.3% KEV · Not listed

Vendors

Mariadb Oracle Redhat

Products

Mariadb Mysql Enterprise Linux and 5 more

CVE-2013-1532

mysql: unspecified DoS related to Information Schema (CPU April 2013)

Unspecified vulnerability in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to Information Schema.

CVSS 2.0 · 4.0 Medium EPSS 2.3% KEV · Not listed

Vendors

Mariadb Oracle Redhat

Products

Mariadb Mysql Enterprise Linux and 5 more

CVE-2013-1544

mysql: unspecified DoS related to Data Manipulation Language (CPU April 2013)

Unspecified vulnerability in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language.

CVSS 2.0 · 4.0 Medium EPSS 2.3% KEV · Not listed

Vendors

Mariadb Oracle Redhat

Products

Mariadb Mysql Enterprise Linux and 5 more

CVE-2013-1548

mysql: unspecified DoS related to Server Types (CPU April 2013)

Unspecified vulnerability in Oracle MySQL 5.1.63 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Types.

CVSS 2.0 · 3.5 Low EPSS 1.8% KEV · Not listed

Vendors

Mariadb Oracle Redhat

Products

Mariadb Mysql Enterprise Linux and 4 more