Vulnerabilities > Suse > Suse Linux Enterprise Software Development KIT

DATE CVE VULNERABILITY TITLE RISK
2014-03-19 CVE-2014-1512 USE After Free vulnerability in multiple products
Use-after-free vulnerability in the TypeObject class in the JavaScript engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary code by triggering extensive memory consumption while garbage collection is occurring, as demonstrated by improper handling of BumpChunk objects.
network
low complexity
mozilla debian canonical redhat suse opensuse CWE-416
critical
10.0
2014-03-19 CVE-2014-1511 Improper Privilege Management vulnerability in multiple products
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified vectors.
7.5
2014-03-19 CVE-2014-1510 Improper Privilege Management vulnerability in Mozilla products
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript code with chrome privileges by using an IDL fragment to trigger a window.open call.
7.5
2014-03-19 CVE-2014-1509 Classic Buffer Overflow vulnerability in Mozilla products
Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, as used in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25, allows remote attackers to execute arbitrary code via a crafted extension that renders fonts in a PDF document.
6.8
2014-03-19 CVE-2014-1508 Out-Of-Bounds Read vulnerability in Mozilla products
The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process memory, cause a denial of service (out-of-bounds read and application crash), or possibly bypass the Same Origin Policy via vectors involving MathML polygon rendering.
6.4
2014-03-19 CVE-2014-1497 Out-Of-Bounds Read vulnerability in multiple products
The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process heap memory, cause a denial of service (out-of-bounds read and application crash), or possibly have unspecified other impact via a crafted WAV file.
6.8
2014-03-19 CVE-2014-1496 Improper Privilege Management vulnerability in multiple products
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 might allow local users to gain privileges by modifying the extracted Mar contents during an update.
1.9
2014-03-19 CVE-2014-1493 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
network
low complexity
mozilla canonical debian redhat suse opensuse CWE-119
critical
10.0
2014-02-06 CVE-2014-1487 Origin Validation Error vulnerability in multiple products
The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass the Same Origin Policy and obtain sensitive authentication information via vectors involving error messages.
7.5
2014-02-06 CVE-2014-1486 Use After Free vulnerability in multiple products
Use-after-free vulnerability in the imgRequestProxy function in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving unspecified Content-Type values for image data.
network
low complexity
mozilla fedoraproject opensuse suse debian canonical redhat CWE-416
critical
9.8