Vulnerabilities > Mozilla > Medium

DATE CVE VULNERABILITY TITLE RISK
2016-03-13 CVE-2016-1976 Use-after-free vulnerability in the DesktopDisplayDevice class in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
network
low complexity
mozilla webrtc-project
5.5
2016-03-13 CVE-2016-1975 Race Condition vulnerability in multiple products
Multiple race conditions in dom/media/systemservices/CamerasChild.cpp in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
network
low complexity
webrtc-project mozilla CWE-362
6.3
2016-03-13 CVE-2016-1967 Information Exposure vulnerability in Mozilla Firefox
Mozilla Firefox before 45.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls after restoring a browser session.
network
low complexity
mozilla CWE-200
6.5
2016-03-13 CVE-2016-1965 7PK - Security Features vulnerability in multiple products
Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers to spoof the address bar via vectors involving the history.back method and the location.protocol property.
network
low complexity
mozilla opensuse oracle CWE-254
4.3
2016-03-13 CVE-2016-1958 7PK - Security Features vulnerability in multiple products
browser/base/content/browser.js in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to spoof the address bar via a javascript: URL.
network
low complexity
oracle opensuse mozilla CWE-254
4.3
2016-03-13 CVE-2016-1957 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
Memory leak in libstagefright in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to cause a denial of service (memory consumption) via an MPEG-4 file that triggers a delete operation on an array.
network
low complexity
novell opensuse mozilla oracle CWE-119
4.3
2016-03-13 CVE-2016-1956 Resource Management Errors vulnerability in multiple products
Mozilla Firefox before 45.0 on Linux, when an Intel video driver is used, allows remote attackers to cause a denial of service (memory consumption or stack memory corruption) by triggering use of a WebGL shader.
network
low complexity
mozilla novell opensuse CWE-399
6.5
2016-03-13 CVE-2016-1955 Information Exposure vulnerability in multiple products
Mozilla Firefox before 45.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy (CSP) violation report that contains path information associated with an IFRAME element.
network
low complexity
novell opensuse mozilla CWE-200
4.3
2016-02-13 CVE-2016-1523 The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font.
network
low complexity
fedoraproject mozilla sil debian
6.5
2016-01-31 CVE-2016-1948 Cryptographic Issues vulnerability in multiple products
Mozilla Firefox before 44.0 on Android does not ensure that HTTPS is used for a lightweight-theme installation, which allows man-in-the-middle attackers to replace a theme's images and colors by modifying the client-server data stream.
network
low complexity
google mozilla CWE-310
5.3