rpm package
opensuse/firefox-esr&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweed
Vulnerabilities (2,106)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2015-7181 | — | < 128.5.1-1.1 | 128.5.1-1.1 | Nov 5, 2015 | The sec_asn1d_parse_leaf function in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, improperly restricts access to an unspecified data structure, which allows re | ||
| CVE-2015-4518 | — | < 128.5.1-1.1 | 128.5.1-1.1 | Nov 5, 2015 | The Reader View implementation in Mozilla Firefox before 42.0 has an improper whitelist, which makes it easier for remote attackers to bypass the Content Security Policy (CSP) protection mechanism and conduct cross-site scripting (XSS) attacks via vectors involving SVG animations | ||
| CVE-2015-4515 | — | < 128.5.1-1.1 | 128.5.1-1.1 | Nov 5, 2015 | Mozilla Firefox before 42.0, when NTLM v1 is enabled for HTTP authentication, allows remote attackers to obtain sensitive hostname information by constructing a crafted web site that sends an NTLM request and reads the Workstation field of an NTLM type 3 message. | ||
| CVE-2015-4513 | — | < 128.5.1-1.1 | 128.5.1-1.1 | Nov 5, 2015 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. | ||
| CVE-2015-7184 | — | < 128.5.1-1.1 | 128.5.1-1.1 | Oct 18, 2015 | The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass t | ||
| CVE-2015-7180 | — | < 128.5.1-1.1 | 128.5.1-1.1 | Sep 24, 2015 | The ReadbackResultWriterD3D11::Run function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 misinterprets the return value of a function call, which might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly hav | ||
| CVE-2015-7178 | — | < 128.5.1-1.1 | 128.5.1-1.1 | Sep 24, 2015 | The ProgramBinary::linkAttributes function in libGLES in ANGLE, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows, mishandles shader access, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption an | ||
| CVE-2015-7174 | — | < 128.5.1-1.1 | 128.5.1-1.1 | Sep 24, 2015 | The nsAttrAndChildArray::GrowBy function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to a | ||
| CVE-2015-4520 | — | < 128.5.1-1.1 | 128.5.1-1.1 | Sep 24, 2015 | Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass CORS preflight protection mechanisms by leveraging (1) duplicate cache-key generation or (2) retrieval of a value from an incorrect HTTP Access-Control-* response header. | ||
| CVE-2015-4519 | — | < 128.5.1-1.1 | 128.5.1-1.1 | Sep 24, 2015 | Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow user-assisted remote attackers to bypass intended access restrictions and discover a redirect's target URL via crafted JavaScript code that executes after a drag-and-drop action of an image into a TEXTBOX element. | ||
| CVE-2015-4517 | — | < 128.5.1-1.1 | 128.5.1-1.1 | Sep 24, 2015 | NetworkUtils.cpp in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors. | ||
| CVE-2015-4516 | — | < 128.5.1-1.1 | 128.5.1-1.1 | Sep 24, 2015 | Mozilla Firefox before 41.0 allows remote attackers to bypass certain ECMAScript 5 (aka ES5) API protection mechanisms and modify immutable properties, and consequently execute arbitrary JavaScript code with chrome privileges, via a crafted web page that does not use ES5 APIs. | ||
| CVE-2015-4512 | — | < 128.5.1-1.1 | 128.5.1-1.1 | Sep 24, 2015 | gfx/2d/DataSurfaceHelpers.cpp in Mozilla Firefox before 41.0 on Linux improperly attempts to use the Cairo library with 32-bit color-depth surface creation followed by 16-bit color-depth surface display, which allows remote attackers to obtain sensitive information from process m | ||
| CVE-2015-4511 | — | < 128.5.1-1.1 | 128.5.1-1.1 | Sep 24, 2015 | Heap-based buffer overflow in the nestegg_track_codec_data function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via a crafted header in a WebM video. | ||
| CVE-2015-4510 | — | < 128.5.1-1.1 | 128.5.1-1.1 | Sep 24, 2015 | Race condition in the WorkerPrivate::NotifyFeatures function in Mozilla Firefox before 41.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) by leveraging improper interaction between shared workers and the Inde | ||
| CVE-2015-4509 | — | < 128.5.1-1.1 | 128.5.1-1.1 | Sep 24, 2015 | Use-after-free vulnerability in the HTMLVideoElement interface in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via crafted JavaScript code that modifies the URI table of a media element, aka ZDI-CAN-3176. | ||
| CVE-2015-4508 | — | < 128.5.1-1.1 | 128.5.1-1.1 | Sep 24, 2015 | Mozilla Firefox before 41.0, when reader mode is enabled, allows remote attackers to spoof the relationship between address-bar URLs and web content via a crafted web site. | ||
| CVE-2015-4507 | — | < 128.5.1-1.1 | 128.5.1-1.1 | Sep 24, 2015 | The SavedStacks class in the JavaScript implementation in Mozilla Firefox before 41.0, when the Debugger API is enabled, allows remote attackers to cause a denial of service (getSlotRef assertion failure and application exit) or possibly execute arbitrary code via a crafted web s | ||
| CVE-2015-4506 | — | < 128.5.1-1.1 | 128.5.1-1.1 | Sep 24, 2015 | Buffer overflow in the vp9_init_context_buffers function in libvpx, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3, allows remote attackers to execute arbitrary code via a crafted VP9 file. | ||
| CVE-2015-4505 | — | < 128.5.1-1.1 | 128.5.1-1.1 | Sep 24, 2015 | updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allows local users to write to arbitrary files by conducting a junction attack and waiting for an update operation by the Mozilla Maintenance Service. |
- CVE-2015-7181Nov 5, 2015affected < 128.5.1-1.1fixed 128.5.1-1.1
The sec_asn1d_parse_leaf function in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, improperly restricts access to an unspecified data structure, which allows re
- CVE-2015-4518Nov 5, 2015affected < 128.5.1-1.1fixed 128.5.1-1.1
The Reader View implementation in Mozilla Firefox before 42.0 has an improper whitelist, which makes it easier for remote attackers to bypass the Content Security Policy (CSP) protection mechanism and conduct cross-site scripting (XSS) attacks via vectors involving SVG animations
- CVE-2015-4515Nov 5, 2015affected < 128.5.1-1.1fixed 128.5.1-1.1
Mozilla Firefox before 42.0, when NTLM v1 is enabled for HTTP authentication, allows remote attackers to obtain sensitive hostname information by constructing a crafted web site that sends an NTLM request and reads the Workstation field of an NTLM type 3 message.
- CVE-2015-4513Nov 5, 2015affected < 128.5.1-1.1fixed 128.5.1-1.1
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- CVE-2015-7184Oct 18, 2015affected < 128.5.1-1.1fixed 128.5.1-1.1
The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass t
- CVE-2015-7180Sep 24, 2015affected < 128.5.1-1.1fixed 128.5.1-1.1
The ReadbackResultWriterD3D11::Run function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 misinterprets the return value of a function call, which might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly hav
- CVE-2015-7178Sep 24, 2015affected < 128.5.1-1.1fixed 128.5.1-1.1
The ProgramBinary::linkAttributes function in libGLES in ANGLE, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows, mishandles shader access, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption an
- CVE-2015-7174Sep 24, 2015affected < 128.5.1-1.1fixed 128.5.1-1.1
The nsAttrAndChildArray::GrowBy function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to a
- CVE-2015-4520Sep 24, 2015affected < 128.5.1-1.1fixed 128.5.1-1.1
Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass CORS preflight protection mechanisms by leveraging (1) duplicate cache-key generation or (2) retrieval of a value from an incorrect HTTP Access-Control-* response header.
- CVE-2015-4519Sep 24, 2015affected < 128.5.1-1.1fixed 128.5.1-1.1
Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow user-assisted remote attackers to bypass intended access restrictions and discover a redirect's target URL via crafted JavaScript code that executes after a drag-and-drop action of an image into a TEXTBOX element.
- CVE-2015-4517Sep 24, 2015affected < 128.5.1-1.1fixed 128.5.1-1.1
NetworkUtils.cpp in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
- CVE-2015-4516Sep 24, 2015affected < 128.5.1-1.1fixed 128.5.1-1.1
Mozilla Firefox before 41.0 allows remote attackers to bypass certain ECMAScript 5 (aka ES5) API protection mechanisms and modify immutable properties, and consequently execute arbitrary JavaScript code with chrome privileges, via a crafted web page that does not use ES5 APIs.
- CVE-2015-4512Sep 24, 2015affected < 128.5.1-1.1fixed 128.5.1-1.1
gfx/2d/DataSurfaceHelpers.cpp in Mozilla Firefox before 41.0 on Linux improperly attempts to use the Cairo library with 32-bit color-depth surface creation followed by 16-bit color-depth surface display, which allows remote attackers to obtain sensitive information from process m
- CVE-2015-4511Sep 24, 2015affected < 128.5.1-1.1fixed 128.5.1-1.1
Heap-based buffer overflow in the nestegg_track_codec_data function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via a crafted header in a WebM video.
- CVE-2015-4510Sep 24, 2015affected < 128.5.1-1.1fixed 128.5.1-1.1
Race condition in the WorkerPrivate::NotifyFeatures function in Mozilla Firefox before 41.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) by leveraging improper interaction between shared workers and the Inde
- CVE-2015-4509Sep 24, 2015affected < 128.5.1-1.1fixed 128.5.1-1.1
Use-after-free vulnerability in the HTMLVideoElement interface in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via crafted JavaScript code that modifies the URI table of a media element, aka ZDI-CAN-3176.
- CVE-2015-4508Sep 24, 2015affected < 128.5.1-1.1fixed 128.5.1-1.1
Mozilla Firefox before 41.0, when reader mode is enabled, allows remote attackers to spoof the relationship between address-bar URLs and web content via a crafted web site.
- CVE-2015-4507Sep 24, 2015affected < 128.5.1-1.1fixed 128.5.1-1.1
The SavedStacks class in the JavaScript implementation in Mozilla Firefox before 41.0, when the Debugger API is enabled, allows remote attackers to cause a denial of service (getSlotRef assertion failure and application exit) or possibly execute arbitrary code via a crafted web s
- CVE-2015-4506Sep 24, 2015affected < 128.5.1-1.1fixed 128.5.1-1.1
Buffer overflow in the vp9_init_context_buffers function in libvpx, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3, allows remote attackers to execute arbitrary code via a crafted VP9 file.
- CVE-2015-4505Sep 24, 2015affected < 128.5.1-1.1fixed 128.5.1-1.1
updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allows local users to write to arbitrary files by conducting a junction attack and waiting for an update operation by the Mozilla Maintenance Service.
Page 78 of 106