opensuse/MozillaFirefox&distro=openSUSE Tumbleweed

Vulnerabilities (2,633)

• CVE-2012-5830HigNov 21, 2012
  affected < 50.1.0-1.1fixed 50.1.0-1.1

  Use-after-free vulnerability in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 on Mac OS X allows remote attackers to execute arbitrary code via an HTML document.

• CVE-2012-5829Nov 21, 2012
  affected < 50.1.0-1.1fixed 50.1.0-1.1

  Heap-based buffer overflow in the nsWindow::OnExposeEvent function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code via unspec

• CVE-2012-4218Nov 21, 2012
  affected < 50.1.0-1.1fixed 50.1.0-1.1

  Use-after-free vulnerability in the BuildTextRunsScanner::BreakSink::SetBreaks function in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via u

• CVE-2012-4217Nov 21, 2012
  affected < 50.1.0-1.1fixed 50.1.0-1.1

  Use-after-free vulnerability in the nsViewManager::ProcessPendingUpdates function in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspeci

• CVE-2012-4216Nov 21, 2012
  affected < 50.1.0-1.1fixed 50.1.0-1.1

  Use-after-free vulnerability in the gfxFont::GetFontEntry function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a

• CVE-2012-4215Nov 21, 2012
  affected < 50.1.0-1.1fixed 50.1.0-1.1

  Use-after-free vulnerability in the nsPlaintextEditor::FireClipboardEvent function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary

• CVE-2012-4214Nov 21, 2012
  affected < 50.1.0-1.1fixed 50.1.0-1.1

  Use-after-free vulnerability in the nsTextEditorState::PrepareEditor function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code

• CVE-2012-4213Nov 21, 2012
  affected < 50.1.0-1.1fixed 50.1.0-1.1

  Use-after-free vulnerability in the nsEditor::FindNextLeafNode function in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vecto

• CVE-2012-4212Nov 21, 2012
  affected < 50.1.0-1.1fixed 50.1.0-1.1

  Use-after-free vulnerability in the XPCWrappedNative::Mark function in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

• CVE-2012-4210Nov 21, 2012
  affected < 50.1.0-1.1fixed 50.1.0-1.1

  The Style Inspector in Mozilla Firefox before 17.0 and Firefox ESR 10.x before 10.0.11 does not properly restrict the context of HTML markup and Cascading Style Sheets (CSS) token sequences, which allows user-assisted remote attackers to execute arbitrary JavaScript code with chr

• CVE-2012-4209Nov 21, 2012
  affected < 50.1.0-1.1fixed 50.1.0-1.1

  Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 do not prevent use of a "top" frame name-attribute value to access the location property, which makes it easier for remote attacke

• CVE-2012-4208Nov 21, 2012
  affected < 50.1.0-1.1fixed 50.1.0-1.1

  The XrayWrapper implementation in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 does not consider the compartment during property filtering, which allows remote attackers to bypass intended chrome-only restrictions on reading DOM object propertie

• CVE-2012-4207Nov 21, 2012
  affected < 50.1.0-1.1fixed 50.1.0-1.1

  The HZ-GB-2312 character-set implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 does not properly handle a ~ (tilde) character in proximity to a chunk delimiter, w

• CVE-2012-4205Nov 21, 2012
  affected < 50.1.0-1.1fixed 50.1.0-1.1

  Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 assign the system principal, rather than the sandbox principal, to XMLHttpRequest objects created in sandboxes, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks or ob

• CVE-2012-4204Nov 21, 2012
  affected < 50.1.0-1.1fixed 50.1.0-1.1

  The str_unescape function in the JavaScript engine in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.

• CVE-2012-4203Nov 21, 2012
  affected < 50.1.0-1.1fixed 50.1.0-1.1

  The New Tab page in Mozilla Firefox before 17.0 uses a privileged context for execution of JavaScript code by bookmarklets, which allows user-assisted remote attackers to run arbitrary programs by leveraging a javascript: URL in a bookmark.

• CVE-2012-4202Nov 21, 2012
  affected < 50.1.0-1.1fixed 50.1.0-1.1

  Heap-based buffer overflow in the image::RasterImage::DrawFrameTo function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code vi

• CVE-2012-4201Nov 21, 2012
  affected < 50.1.0-1.1fixed 50.1.0-1.1

  The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect context during the handling of JavaScript code that sets the location.href p

• CVE-2012-4196Oct 29, 2012
  affected < 50.1.0-1.1fixed 50.1.0-1.1

  Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 allow remote attackers to bypass the Same Origin Policy and read the Location object via a prototype property-injection atta

• CVE-2012-4195Oct 29, 2012
  affected < 50.1.0-1.1fixed 50.1.0-1.1

  The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 does not properly determine the calling document and principal in its return value, whi