Vulnerabilities > Mozilla > Firefox > 32.0.2
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2015-04-01 | CVE-2015-0802 | Permissions, Privileges, and Access Controls vulnerability in multiple products Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods. | 5.0 |
| 2015-04-01 | CVE-2015-0801 | Permissions, Privileges, and Access Controls vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818. | 7.5 |
| 2015-04-01 | CVE-2015-0800 | Information Exposure vulnerability in Mozilla Firefox The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a related issue to CVE-2012-2808. | 5.0 |
| 2015-03-24 | CVE-2015-0818 | Permissions, Privileges, and Access Controls vulnerability in Mozilla Firefox, Firefox ESR and Seamonkey Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving SVG hash navigation. | 7.5 |
| 2015-03-24 | CVE-2015-0817 | Code vulnerability in Mozilla Firefox, Firefox ESR and Seamonkey The asm.js implementation in Mozilla Firefox before 36.0.3, Firefox ESR 31.x before 31.5.2, and SeaMonkey before 2.33.1 does not properly determine the cases in which bounds checking may be safely skipped during JIT compilation and heap access, which allows remote attackers to read or write to unintended memory locations, and consequently execute arbitrary code, via crafted JavaScript. | 6.8 |
| 2015-02-25 | CVE-2015-0836 | Memory Corruption vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. | 7.5 |
| 2015-02-25 | CVE-2015-0835 | Memory Corruption vulnerability in Mozilla Firefox/Thunderbird Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. | 7.5 |
| 2015-02-25 | CVE-2015-0834 | Information Exposure vulnerability in multiple products The WebRTC subsystem in Mozilla Firefox before 36.0 recognizes turns: and stuns: URIs but accesses the TURN or STUN server without using TLS, which makes it easier for man-in-the-middle attackers to discover credentials by spoofing a server and completing a brute-force attack within a short time window. | 4.3 |
| 2015-02-25 | CVE-2015-0833 | DLL Loading Arbitrary Code Execution vulnerability in Mozilla Firefox Firefox ESR and Thunderbird Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 on Windows, when the Maintenance Service is not used, allow local users to gain privileges via a Trojan horse DLL in (1) the current working directory or (2) a temporary directory, as demonstrated by bcrypt.dll. | 6.9 |
| 2015-02-25 | CVE-2015-0832 | 7PK - Security Features vulnerability in multiple products Mozilla Firefox before 36.0 does not properly recognize the equivalence of domain names with and without a trailing . | 5.0 |