Vulnerabilities > Mozilla > Firefox > 37.0.1
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2015-09-24 | CVE-2015-4504 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Mozilla Firefox The lut_inverse_interp16 function in the QCMS library in Mozilla Firefox before 41.0 allows remote attackers to obtain sensitive information or cause a denial of service (buffer over-read and application crash) via crafted attributes in the ICC 4 profile of an image. | 6.4 |
| 2015-09-24 | CVE-2015-4503 | Information Exposure vulnerability in Mozilla Firefox The TCP Socket API implementation in Mozilla Firefox before 41.0 mishandles array boundaries that were established with a navigator.mozTCPSocket.open method call and send method calls, which allows remote TCP servers to obtain sensitive information from process memory by reading packet data, as demonstrated by availability of this API in a Firefox OS application. | 5.0 |
| 2015-09-24 | CVE-2015-4502 | 7PK - Security Features vulnerability in Mozilla Firefox js/src/proxy/Proxy.cpp in Mozilla Firefox before 41.0 mishandles certain receiver arguments, which allows remote attackers to bypass intended window access restrictions via a crafted web site. | 4.3 |
| 2015-09-24 | CVE-2015-4501 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Mozilla Firefox Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 41.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. | 7.5 |
| 2015-09-24 | CVE-2015-4476 | 7PK - Security Features vulnerability in Mozilla Firefox Mozilla Firefox before 41.0 on Android allows user-assisted remote attackers to spoof address-bar attributes by leveraging lack of navigation after a paste of a URL with a nonstandard scheme, as demonstrated by spoofing an SSL attribute. | 4.3 |
| 2015-08-16 | CVE-2015-4496 | Numeric Errors vulnerability in multiple products Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file, a related issue to CVE-2015-1538. | 9.3 |
| 2015-08-16 | CVE-2015-4490 | Cross-site Scripting vulnerability in multiple products The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not implement the Content Security Policy Level 2 exceptions for the blob, data, and filesystem URL schemes during wildcard source-expression matching, which might make it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging unexpected policy-enforcement behavior. | 4.3 |
| 2015-08-16 | CVE-2015-4483 | Permissions, Privileges, and Access Controls vulnerability in multiple products Mozilla Firefox before 40.0 allows man-in-the-middle attackers to bypass a mixed-content protection mechanism via a feed: URL in a POST request. | 4.3 |
| 2015-08-16 | CVE-2015-4477 | Use-after-free vulnerability in the MediaStream playback feature in Mozilla Firefox before 40.0 allows remote attackers to execute arbitrary code via unspecified use of the Web Audio API. | 10.0 |
| 2015-08-16 | CVE-2015-4474 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 40.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. | 10.0 |