Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,218

Export CSV
CVE-2012-4186

Mozilla: Heap memory corruption issues found using Address Sanitizer (MFSA 2012-86)

Heap-based buffer overflow in the nsWaveReader::DecodeAudioData function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 14.7% KEV · Not listed
Vendors
Canonical Debian Mozilla and 2 more
Products
Ubuntu Linux Debian Linux Firefox and 11 more
CVE-2010-0410

kernel: OOM/crash in drivers/connector

drivers/connector/connector.c in the Linux kernel before 2.6.32.8 allows local users to cause a denial of service (memory consumption and system crash) by sending the kernel many NETLINK_CONNECTOR messages.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 2 more
CVE-2012-4185

Mozilla: Heap memory corruption issues found using Address Sanitizer (MFSA 2012-86)

Buffer overflow in the nsCharTraits::length function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 8.6% KEV · Not listed
Vendors
Canonical Mozilla Redhat and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 10 more
CVE-2012-4184

Mozilla: Chrome Object Wrapper (COW) does not disallow acces to privileged functions or properties (MFSA 2012-83)

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 does not prevent access to properties of a prototype for a standard class, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Canonical Mozilla Redhat and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 10 more
CVE-2012-4183

Mozilla: Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer (MFSA 2012-85)

Use-after-free vulnerability in the DOMSVGTests::GetRequiredFeatures function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.8% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Seamonkey and 11 more
CVE-2012-4188

Mozilla: Heap memory corruption issues found using Address Sanitizer (MFSA 2012-86)

Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 14.7% KEV · Not listed
Vendors
Canonical Debian Mozilla and 2 more
Products
Ubuntu Linux Debian Linux Firefox and 11 more
CVE-2010-0395

openoffice.org Execution of Python code when browsing macros

OpenOffice.org 2.x and 3.0 before 3.2.1 allows user-assisted remote attackers to bypass Python macro security restrictions and execute arbitrary Python code via a crafted OpenDocument Text (ODT) file that triggers code execution when the macro directory structure is previewed.

CVSS 2.0 · 9.3 Critical EPSS 10.5% KEV · Not listed
Vendors
Apache Canonical Debian and 4 more
Products
Openoffice Ubuntu Linux Debian Linux and 4 more
CVE-2010-0307

kernel: DoS on x86_64

The load_elf_binary function in fs/binfmt_elf.c in the Linux kernel before 2.6.32.8 on the x86_64 platform does not ensure that the ELF interpreter is available before a call to the SET_PERSONALITY macro, which allows local users to cause a denial of service (system crash) via a 32-bit application that attempts to execute a 64-bit application and then triggers a segmentation fault, as demonstrated by amd64_killer, related to the flush_old_exec function.

CVSS 2.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 2 more
CVE-2012-4182

Mozilla: Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer (MFSA 2012-85)

Use-after-free vulnerability in the nsTextEditRules::WillInsert function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.7% KEV · Not listed
Vendors
Canonical Debian Mozilla and 2 more
Products
Ubuntu Linux Debian Linux Firefox and 11 more
CVE-2012-4181

Mozilla: Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer (MFSA 2012-85)

Use-after-free vulnerability in the nsSMILAnimationController::DoSample function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.8% KEV · Not listed
Vendors
Canonical Mozilla Redhat
Products
Ubuntu Linux Firefox Seamonkey and 7 more
CVE-2010-0205

libpng: excessive memory consumption due to highly compressed huge ancillary chunk

The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before 1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation, which allows remote attackers to cause a denial of service (memory and CPU consumption, and application hang) via a crafted PNG file, as demonstrated by use of the deflate compression method on data composed of many occurrences of the same character, related to a "decompression bomb" attack.

CVSS 2.0 · 4.3 Medium EPSS 4.5% KEV · Not listed
Vendors
Apple Canonical Debian and 5 more
Products
Mac Os X Ubuntu Linux Debian Linux and 5 more
CVE-2012-4180

Mozilla: Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer (MFSA 2012-85)

Heap-based buffer overflow in the nsHTMLEditor::IsPrevCharInNodeWhitespace function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 9.3% KEV · Not listed
Vendors
Canonical Debian Mozilla and 2 more
Products
Ubuntu Linux Debian Linux Firefox and 11 more
CVE-2012-4179

Mozilla: Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer (MFSA 2012-85)

Use-after-free vulnerability in the nsHTMLCSSUtils::CreateCSSPropertyTxn function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.7% KEV · Not listed
Vendors
Canonical Debian Mozilla and 2 more
Products
Ubuntu Linux Debian Linux Firefox and 11 more
CVE-2010-0159

Mozilla crashes with evidence of memory corruption (MFSA 2010-01)

The browser engine in Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, Thunderbird before 3.0.2, and SeaMonkey before 2.0.3 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the nsBlockFrame::StealFrame function in layout/generic/nsBlockFrame.cpp, and unspecified other vectors.

CVSS 2.0 · 10.0 Critical EPSS 4.7% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 3 more
CVE-2012-3995

Mozilla: Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer (MFSA 2012-85)

The IsCSSWordSpacingSpace function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 5.0% KEV · Not listed
Vendors
Canonical Mozilla Redhat and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 10 more
CVE-2012-3994

Mozilla: top object and location property accessible by plugins (MFSA 2012-82)

Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allow remote attackers to conduct cross-site scripting (XSS) attacks via a binary plugin that uses Object.defineProperty to shadow the top object, and leverages the relationship between top.location and the location property.

CVSS 2.0 · 4.3 Medium EPSS 2.4% KEV · Not listed
Vendors
Canonical Mozilla Redhat and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 10 more
CVE-2012-3992

Mozilla: Spoofing and script injection through location.hash (MFSA 2012-84)

Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly manage history data, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive POST content via vectors involving a location.hash write operation and history navigation that triggers the loading of a URL into the history object.

CVSS 2.0 · 4.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Canonical Mozilla Redhat and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 10 more
CVE-2012-3991

Mozilla: GetProperty function can bypass security checks (MFSA 2012-81)

Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict JSAPI access to the GetProperty function, which allows remote attackers to bypass the Same Origin Policy and possibly have unspecified other impact via a crafted web site.

CVSS 2.0 · 9.3 Critical EPSS 3.1% KEV · Not listed
Vendors
Canonical Mozilla Redhat and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 10 more
CVE-2010-0136

openoffice.org: unenforced VBA macro security settings may lead to arbitrary macro execution

OpenOffice.org (OOo) 2.0.4, 2.4.1, and 3.1.1 does not properly enforce Visual Basic for Applications (VBA) macro security settings, which allows remote attackers to run arbitrary macros via a crafted document.

CVSS 2.0 · 9.3 Critical EPSS 8.1% KEV · Not listed
Vendors
Apache Canonical Debian
Products
Openoffice Ubuntu Linux Debian Linux
CVE-2012-3990

Mozilla: Use-after-free in the IME State Manager (MFSA 2012-87)

Use-after-free vulnerability in the IME State Manager implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors, related to the nsIContent::GetNameSpaceID function.

CVSS 2.0 · 9.3 Critical EPSS 5.2% KEV · Not listed
Vendors
Canonical Debian Mozilla and 2 more
Products
Ubuntu Linux Debian Linux Firefox and 11 more