opensuse/firefox-esr&distro=openSUSE Tumbleweed

Vulnerabilities (2,418)

• CVE-2012-3973Aug 29, 2012
  affected < 128.5.1-1.1fixed 128.5.1-1.1

  The debugger in the developer-tools subsystem in Mozilla Firefox before 15.0, when remote debugging is disabled, does not properly restrict access to the remote-debugging service, which allows remote attackers to execute arbitrary code by leveraging the presence of the HTTPMonito

• CVE-2012-3972Aug 29, 2012
  affected < 128.5.1-1.1fixed 128.5.1-1.1

  The format-number functionality in the XSLT implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to obtain sensitive information via unspecifie

• CVE-2012-3971Aug 29, 2012
  affected < 128.5.1-1.1fixed 128.5.1-1.1

  Summer Institute of Linguistics (SIL) Graphite 2, as used in Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the (1) Silf::re

• CVE-2012-3969Aug 29, 2012
  affected < 128.5.1-1.1fixed 128.5.1-1.1

  Integer overflow in the nsSVGFEMorphologyElement::Filter function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via a crafted

• CVE-2012-3967Aug 29, 2012
  affected < 128.5.1-1.1fixed 128.5.1-1.1

  The WebGL implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 on Linux, when a large number of sampler uniforms are used, does not properly interact with Mesa drivers

• CVE-2012-3966Aug 29, 2012
  affected < 128.5.1-1.1fixed 128.5.1-1.1

  Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a negative height value in a B

• CVE-2012-3965Aug 29, 2012
  affected < 128.5.1-1.1fixed 128.5.1-1.1

  Mozilla Firefox before 15.0 does not properly restrict navigation to the about:newtab page, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers creation of a new tab and then a new window.

• CVE-2012-3960Aug 29, 2012
  affected < 128.5.1-1.1fixed 128.5.1-1.1

  Use-after-free vulnerability in the mozSpellChecker::SetCurrentDictionary function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary c

• CVE-2012-1976Aug 29, 2012
  affected < 128.5.1-1.1fixed 128.5.1-1.1

  Use-after-free vulnerability in the nsHTMLSelectElement::SubmitNamesValues function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary

• CVE-2012-1972Aug 29, 2012
  affected < 128.5.1-1.1fixed 128.5.1-1.1

  Use-after-free vulnerability in the nsHTMLEditor::CollapseAdjacentTextNodes function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary

• CVE-2012-1970Aug 29, 2012
  affected < 128.5.1-1.1fixed 128.5.1-1.1

  Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allow remote attackers to cause a denial of service (memory corruption

• CVE-2012-1956Aug 29, 2012
  affected < 128.5.1-1.1fixed 128.5.1-1.1

  Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12 do not prevent use of the Object.defineProperty method to shadow the location object (aka window.location), which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via

• CVE-2012-1967Jul 18, 2012
  affected < 128.5.1-1.1fixed 128.5.1-1.1

  Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly implement the JavaScript sandbox utility, which allows remote attackers to execute arbitrary JavaScript co

• CVE-2012-1966Jul 18, 2012
  affected < 128.5.1-1.1fixed 128.5.1-1.1

  Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not have the same context-menu restrictions for data: URLs as for javascript: URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.

• CVE-2012-1965Jul 18, 2012
  affected < 128.5.1-1.1fixed 128.5.1-1.1

  Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not properly establish the security context of a feed: URL, which allows remote attackers to bypass unspecified cross-site scripting (XSS) protection mechanisms via a feed:javascript: URL.

• CVE-2012-1963Jul 18, 2012
  affected < 128.5.1-1.1fixed 128.5.1-1.1

  The Content Security Policy (CSP) functionality in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly restrict the strings placed into the blocked-uri para

• CVE-2012-1962Jul 18, 2012
  affected < 128.5.1-1.1fixed 128.5.1-1.1

  Use-after-free vulnerability in the JSDependentString::undepend function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of s

• CVE-2012-1961Jul 18, 2012
  affected < 128.5.1-1.1fixed 128.5.1-1.1

  Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly handle duplicate values in X-Frame-Options headers, which makes it easier for remote attackers to conduct

• CVE-2012-1960Jul 18, 2012
  affected < 128.5.1-1.1fixed 128.5.1-1.1

  The qcms_transform_data_rgb_out_lut_sse2 function in the QCMS implementation in Mozilla Firefox 4.x through 13.0, Thunderbird 5.0 through 13.0, and SeaMonkey before 2.11 might allow remote attackers to obtain sensitive information from process memory via a crafted color profile t

• CVE-2012-1959Jul 18, 2012
  affected < 128.5.1-1.1fixed 128.5.1-1.1

  Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not consider the presence of same-compartment security wrappers (SCSW) during the cross-compartment wrapping of objects