Vulnerabilities > Mozilla > Firefox

DATE CVE VULNERABILITY TITLE RISK
2016-03-13 CVE-2016-1974 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not verify that memory allocation succeeds, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via crafted Unicode data in an HTML, XML, or SVG document.
network
low complexity
mozilla oracle suse opensuse CWE-119
8.8
2016-03-13 CVE-2016-1973 Race condition in the GetStaticInstance function in the WebRTC implementation in Mozilla Firefox before 45.0 might allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via unspecified vectors.
network
low complexity
oracle mozilla
8.8
2016-03-13 CVE-2016-1972 Unspecified vulnerability in Mozilla Firefox
Race condition in libvpx in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors.
network
low complexity
mozilla
8.8
2016-03-13 CVE-2016-1971 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Mozilla Firefox
The I420VideoFrame::CreateFrame function in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows omits an unspecified status check, which might allow remote attackers to cause a denial of service (memory corruption) or possibly have other impact via unknown vectors.
network
low complexity
mozilla CWE-119
8.8
2016-03-13 CVE-2016-1970 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Mozilla Firefox
Integer underflow in the srtp_unprotect function in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
network
low complexity
mozilla CWE-119
8.8
2016-03-13 CVE-2016-1969 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.6.1, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted Graphite smart font.
network
low complexity
sil mozilla CWE-119
8.8
2016-03-13 CVE-2016-1968 Numeric Errors vulnerability in Mozilla Firefox
Integer underflow in Brotli, as used in Mozilla Firefox before 45.0, allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted data with brotli compression.
network
low complexity
mozilla CWE-189
8.8
2016-03-13 CVE-2016-1967 Information Exposure vulnerability in Mozilla Firefox
Mozilla Firefox before 45.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls after restoring a browser session.
network
low complexity
mozilla CWE-200
6.5
2016-03-13 CVE-2016-1966 The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference and memory corruption) via a crafted NPAPI plugin.
network
low complexity
oracle mozilla opensuse
8.8
2016-03-13 CVE-2016-1965 7PK - Security Features vulnerability in multiple products
Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers to spoof the address bar via vectors involving the history.back method and the location.protocol property.
network
low complexity
mozilla opensuse oracle CWE-254
4.3