CVE-2012-0444

Firefox: Ogg Vorbis Decoding Memory Corruption (MFSA 2012-07)

Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize nsChildView data structures, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Ogg Vorbis file.

CVSS 2.0 · 10.0 Critical EPSS 7.8% KEV · Not listed

Vendors

Canonical Debian Mozilla and 3 more

Products

Ubuntu Linux Debian Linux Firefox and 7 more

CVE-2012-0449

Mozilla: Crash when rendering SVG+XSLT (MFSA 2012-08)

Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a malformed XSLT stylesheet that is embedded in a document.

CVSS 2.0 · 9.3 Critical EPSS 5.7% KEV · Not listed

Vendors

Debian Mozilla Opensuse and 2 more

Products

Debian Linux Firefox Seamonkey and 6 more

CVE-2012-0879

kernel: block: CLONE_IO io_context refcounting issues

The I/O implementation for block devices in the Linux kernel before 2.6.33 does not properly handle the CLONE_IO feature, which allows local users to cause a denial of service (I/O instability) by starting multiple processes that share an I/O context.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 2 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 4 more

CVE-2012-1970

Mozilla: Miscellaneous memory safety hazards (rv:15.0/ rv:10.0.7) (MFSA 2012-57)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed

Vendors

Canonical Debian Mozilla and 3 more

Products

Ubuntu Linux Debian Linux Firefox and 13 more

CVE-2012-1972

Mozilla: Multiple Use-after-free issues (MFSA 2012-58)

Use-after-free vulnerability in the nsHTMLEditor::CollapseAdjacentTextNodes function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed

Vendors

Canonical Debian Mozilla and 3 more

Products

Ubuntu Linux Debian Linux Firefox and 13 more

CVE-2012-1973

Mozilla: Multiple Use-after-free issues (MFSA 2012-58)

Use-after-free vulnerability in the nsObjectLoadingContent::LoadObject function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed

Vendors

Canonical Debian Mozilla and 3 more

Products

Ubuntu Linux Debian Linux Firefox and 13 more

CVE-2012-1974

Mozilla: Multiple Use-after-free issues (MFSA 2012-58)

Use-after-free vulnerability in the gfxTextRun::CanBreakLineBefore function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed

Vendors

Canonical Debian Mozilla and 3 more

Products

Ubuntu Linux Debian Linux Firefox and 13 more

CVE-2012-1975

Mozilla: Multiple Use-after-free issues (MFSA 2012-58)

Use-after-free vulnerability in the PresShell::CompleteMove function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed

Vendors

Canonical Debian Mozilla and 3 more

Products

Ubuntu Linux Debian Linux Firefox and 13 more

CVE-2012-3515

qemu: VT100 emulation vulnerability

Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space."

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Opensuse and 4 more

Products

Ubuntu Linux Debian Linux Opensuse and 12 more

CVE-2012-3867

puppet: insufficient validation of agent names in CN of SSL certificate requests

lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.

CVSS 2.0 · 4.3 Medium EPSS 2.5% KEV · Not listed

Vendors

Canonical Cloudforms Cloudengine Debian and 4 more

Products

Ubuntu Linux 1 Debian Linux and 6 more

CVE-2012-3959

Mozilla: Multiple Use-after-free issues (MFSA 2012-58)

Use-after-free vulnerability in the nsRangeUpdater::SelAdjDeleteNode function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 10.0 Critical EPSS 4.7% KEV · Not listed

Vendors

Canonical Debian Mozilla and 3 more

Products

Ubuntu Linux Debian Linux Firefox and 13 more

CVE-2012-3972

Mozilla: Out-of-bounds read in format-number in XSLT (MFSA 2012-65)

The format-number functionality in the XSLT implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based buffer over-read.

CVSS 2.0 · 5.0 Medium EPSS 4.0% KEV · Not listed

Vendors

Canonical Debian Mozilla and 3 more

Products

Ubuntu Linux Debian Linux Firefox and 13 more

CVE-2012-3982

Mozilla: Miscellaneous memory safety hazards (rv:10.0.8) (MFSA 2012-74)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.7% KEV · Not listed

Vendors

Canonical Debian Mozilla and 2 more

Products

Ubuntu Linux Debian Linux Firefox and 11 more

CVE-2012-3986

Mozilla: Some DOMWindowUtils methods bypass security checks (MFSA 2012-77)

Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict calls to DOMWindowUtils (aka nsDOMWindowUtils) methods, which allows remote attackers to bypass intended access restrictions via crafted JavaScript code.

CVSS 2.0 · 4.3 Medium EPSS 2.5% KEV · Not listed

Vendors

Canonical Debian Mozilla and 2 more

Products

Ubuntu Linux Debian Linux Firefox and 11 more

CVE-2012-3990

Mozilla: Use-after-free in the IME State Manager (MFSA 2012-87)

Use-after-free vulnerability in the IME State Manager implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors, related to the nsIContent::GetNameSpaceID function.

CVSS 2.0 · 9.3 Critical EPSS 5.2% KEV · Not listed

Vendors

Canonical Debian Mozilla and 2 more

Products

Ubuntu Linux Debian Linux Firefox and 11 more

CVE-2012-4179

Mozilla: Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer (MFSA 2012-85)

Use-after-free vulnerability in the nsHTMLCSSUtils::CreateCSSPropertyTxn function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.7% KEV · Not listed

Vendors

Canonical Debian Mozilla and 2 more

Products

Ubuntu Linux Debian Linux Firefox and 11 more

CVE-2012-4180

Mozilla: Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer (MFSA 2012-85)

Heap-based buffer overflow in the nsHTMLEditor::IsPrevCharInNodeWhitespace function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 9.3% KEV · Not listed

Vendors

Canonical Debian Mozilla and 2 more

Products

Ubuntu Linux Debian Linux Firefox and 11 more

CVE-2012-4182

Mozilla: Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer (MFSA 2012-85)

Use-after-free vulnerability in the nsTextEditRules::WillInsert function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.7% KEV · Not listed

Vendors

Canonical Debian Mozilla and 2 more

Products

Ubuntu Linux Debian Linux Firefox and 11 more

CVE-2012-4188

Mozilla: Heap memory corruption issues found using Address Sanitizer (MFSA 2012-86)

Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 14.7% KEV · Not listed

Vendors

Canonical Debian Mozilla and 2 more

Products

Ubuntu Linux Debian Linux Firefox and 11 more

CVE-2012-4186

Mozilla: Heap memory corruption issues found using Address Sanitizer (MFSA 2012-86)

Heap-based buffer overflow in the nsWaveReader::DecodeAudioData function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 14.7% KEV · Not listed

Vendors

Canonical Debian Mozilla and 2 more

Products

Ubuntu Linux Debian Linux Firefox and 11 more