CVE-2012-3957

Mozilla: Multiple Use-after-free issues (MFSA 2012-58)

Heap-based buffer overflow in the nsBlockFrame::MarkLineDirty function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0 · 10.0 Critical EPSS 7.8% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 12 more

CVE-2013-0769

Mozilla: Miscellaneous memory safety hazards (rv:10.0.12) (MFSA 2013-01)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 9.3 Critical EPSS 5.8% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 13 more

CVE-2012-3956

Mozilla: Multiple Use-after-free issues (MFSA 2012-58)

Use-after-free vulnerability in the MediaStreamGraphThreadRunnable::Run function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 10.0 Critical EPSS 5.4% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 12 more

CVE-2013-0768

Mozilla: Buffer Overflow in Canvas (MFSA 2013-03)

Stack-based buffer overflow in the Canvas implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via an HTML document that specifies invalid width and height values.

CVSS 2.0 · 9.3 Critical EPSS 7.6% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 10 more

CVE-2012-3867

puppet: insufficient validation of agent names in CN of SSL certificate requests

lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.

CVSS 2.0 · 4.3 Medium EPSS 2.5% KEV · Not listed

Vendors

Canonical Cloudforms Cloudengine Debian and 4 more

Products

Ubuntu Linux 1 Debian Linux and 6 more

CVE-2013-0767

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

The nsSVGPathElement::GetPathLengthScale function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.

CVSS 2.0 · 10.0 Critical EPSS 5.8% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 13 more

CVE-2013-0766

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

Use-after-free vulnerability in the ~nsHTMLEditRules implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.7% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 13 more

CVE-2013-0764

Mozilla: Crash due to handling of SSL on threads (MFSA 2013-07)

The nsSOCKSSocketInfo::ConnectToProxy function in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not ensure thread safety for SSL sessions, which allows remote attackers to execute arbitrary code via crafted data, as demonstrated by e-mail message data.

CVSS 2.0 · 9.3 Critical EPSS 3.1% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 1 more

Products

Ubuntu Linux Firefox Seamonkey and 6 more

CVE-2013-0763

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

Use-after-free vulnerability in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to Mesa drivers and a resized WebGL canvas.

CVSS 2.0 · 9.3 Critical EPSS 4.4% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 11 more

CVE-2013-0762

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

Use-after-free vulnerability in the imgRequest::OnStopFrame function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.7% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 13 more

CVE-2013-0761

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

Use-after-free vulnerability in the mozilla::TrackUnionStream::EndTrack implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.4% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 1 more

Products

Ubuntu Linux Firefox Seamonkey and 6 more

CVE-2013-0760

Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)

Buffer overflow in the CharDistributionAnalysis::HandleOneChar function in Mozilla Firefox before 18.0, Thunderbird before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted document.

CVSS 2.0 · 9.3 Critical EPSS 5.3% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 1 more

Products

Ubuntu Linux Firefox Seamonkey and 6 more

CVE-2013-0759

Mozilla: URL spoofing in addressbar during page loads (MFSA 2013-04)

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to spoof the address bar via vectors involving authentication information in the userinfo field of a URL, in conjunction with a 204 (aka No Content) HTTP status code.

CVSS 2.0 · 5.0 Medium EPSS 2.3% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 13 more

CVE-2013-0758

Mozilla: Chrome Object Wrapper (COW) bypass through plugin objects (MFSA 2013-15)

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging improper interaction between plugin objects and SVG elements.

CVSS 2.0 · 9.3 Critical EPSS 73.4% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 2 more

Products

Ubuntu Linux Firefox Seamonkey and 13 more

CVE-2012-3515

qemu: VT100 emulation vulnerability

Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space."

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Opensuse and 4 more

Products

Ubuntu Linux Debian Linux Opensuse and 12 more

CVE-2012-2039

flash-plugin: multiple code execution flaws (APSB12-14)

Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.7% KEV · Not listed

Vendors

Adobe Apple Google and 5 more

Products

Air Flash Player Macos and 11 more

CVE-2013-0757

Mozilla: Chrome Object Wrapper (COW) bypass through changing prototype (MFSA 2013-14)

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not prevent modifications to the prototype of an object, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by referencing Object.prototype.__proto__ in a crafted HTML document.

CVSS 2.0 · 9.3 Critical EPSS 60.9% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 1 more

Products

Ubuntu Linux Firefox Seamonkey and 6 more

CVE-2013-0756

Mozilla: garbage collection flaw in Javascript Proxy objects (MFSA 2013-19)

Use-after-free vulnerability in the obj_toSource function in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted web page referencing JavaScript Proxy objects that are not properly handled during garbage collection.

CVSS 2.0 · 9.3 Critical EPSS 4.2% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 1 more

Products

Ubuntu Linux Firefox Seamonkey and 6 more

CVE-2012-2038

flash-plugin: information disclosure flaw (APSB12-14)

Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 3.6% KEV · Not listed

Vendors

Adobe Apple Google and 5 more

Products

Air Flash Player Macos and 11 more

CVE-2012-2037

flash-plugin: multiple code execution flaws (APSB12-14)

Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2034.

CVSS 2.0 · 9.3 Critical EPSS 3.8% KEV · Not listed

Vendors

Adobe Apple Google and 5 more

Products

Air Flash Player Macos and 11 more