rpm package
suse/MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 12
pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012
Vulnerabilities (251)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2015-2736 | — | < 31.8.0esr-37.3 | 31.8.0esr-37.3 | Jul 6, 2015 | The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive. | ||
| CVE-2015-2735 | — | < 31.8.0esr-37.3 | 31.8.0esr-37.3 | Jul 6, 2015 | nsZipArchive.cpp in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive. | ||
| CVE-2015-2734 | — | < 31.8.0esr-37.3 | 31.8.0esr-37.3 | Jul 6, 2015 | The CairoTextureClientD3D9::BorrowDrawTarget function in the Direct3D 9 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and a | ||
| CVE-2015-2733 | — | < 31.8.0esr-37.3 | 31.8.0esr-37.3 | Jul 6, 2015 | Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a dedic | ||
| CVE-2015-2730 | — | < 31.8.0esr-37.3 | 31.8.0esr-37.3 | Jul 6, 2015 | Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly perform Elliptical Curve Cryptography (ECC) multiplications, which makes it easier for remote at | ||
| CVE-2015-2728 | — | < 31.8.0esr-37.3 | 31.8.0esr-37.3 | Jul 6, 2015 | The IndexedDatabaseManager class in the IndexedDB implementation in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 misinterprets an unspecified IDBDatabase field as a pointer, which allows remote attackers to execute arbitrary code or cause a de | ||
| CVE-2015-2726 | — | < 31.8.0esr-37.3 | 31.8.0esr-37.3 | Jul 6, 2015 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. | ||
| CVE-2015-2725 | — | < 31.8.0esr-37.3 | 31.8.0esr-37.3 | Jul 6, 2015 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code vi | ||
| CVE-2015-2724 | — | < 31.8.0esr-37.3 | 31.8.0esr-37.3 | Jul 6, 2015 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly exec | ||
| CVE-2015-2722 | — | < 31.8.0esr-37.3 | 31.8.0esr-37.3 | Jul 6, 2015 | Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a share | ||
| CVE-2015-2721 | — | < 31.8.0esr-37.3 | 31.8.0esr-37.3 | Jul 6, 2015 | Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, Thunderbird before 38.1, and other products, does not properly determine state transitions for the TLS state machine, which allows man-i | ||
| CVE-2015-4000 | Low | 3.7 | < 31.8.0esr-37.3 | 31.8.0esr-37.3 | May 21, 2015 | The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by D | |
| CVE-2015-2716 | — | < 31.7.0esr-34.1 | 31.7.0esr-34.1 | May 14, 2015 | Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283. | ||
| CVE-2015-2713 | — | < 31.7.0esr-34.1 | 31.7.0esr-34.1 | May 14, 2015 | Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a document containing craft | ||
| CVE-2015-2710 | — | < 31.7.0esr-34.1 | 31.7.0esr-34.1 | May 14, 2015 | Heap-based buffer overflow in the SVGTextFrame class in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code via crafted SVG graphics data in conjunction with a crafted Cascading Style Sheets (CSS | ||
| CVE-2015-2709 | — | < 31.7.0esr-34.1 | 31.7.0esr-34.1 | May 14, 2015 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. | ||
| CVE-2015-2708 | — | < 31.7.0esr-34.1 | 31.7.0esr-34.1 | May 14, 2015 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code vi | ||
| CVE-2015-0797 | — | < 31.7.0esr-34.1 | 31.7.0esr-34.1 | May 14, 2015 | GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 v | ||
| CVE-2015-0816 | — | < 31.6.0esr-30.1 | 31.6.0esr-30.1 | Apr 1, 2015 | Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Orig | ||
| CVE-2015-0815 | — | < 31.6.0esr-30.1 | 31.6.0esr-30.1 | Apr 1, 2015 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code vi |
- CVE-2015-2736Jul 6, 2015affected < 31.8.0esr-37.3fixed 31.8.0esr-37.3
The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive.
- CVE-2015-2735Jul 6, 2015affected < 31.8.0esr-37.3fixed 31.8.0esr-37.3
nsZipArchive.cpp in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive.
- CVE-2015-2734Jul 6, 2015affected < 31.8.0esr-37.3fixed 31.8.0esr-37.3
The CairoTextureClientD3D9::BorrowDrawTarget function in the Direct3D 9 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and a
- CVE-2015-2733Jul 6, 2015affected < 31.8.0esr-37.3fixed 31.8.0esr-37.3
Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a dedic
- CVE-2015-2730Jul 6, 2015affected < 31.8.0esr-37.3fixed 31.8.0esr-37.3
Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly perform Elliptical Curve Cryptography (ECC) multiplications, which makes it easier for remote at
- CVE-2015-2728Jul 6, 2015affected < 31.8.0esr-37.3fixed 31.8.0esr-37.3
The IndexedDatabaseManager class in the IndexedDB implementation in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 misinterprets an unspecified IDBDatabase field as a pointer, which allows remote attackers to execute arbitrary code or cause a de
- CVE-2015-2726Jul 6, 2015affected < 31.8.0esr-37.3fixed 31.8.0esr-37.3
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- CVE-2015-2725Jul 6, 2015affected < 31.8.0esr-37.3fixed 31.8.0esr-37.3
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code vi
- CVE-2015-2724Jul 6, 2015affected < 31.8.0esr-37.3fixed 31.8.0esr-37.3
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly exec
- CVE-2015-2722Jul 6, 2015affected < 31.8.0esr-37.3fixed 31.8.0esr-37.3
Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a share
- CVE-2015-2721Jul 6, 2015affected < 31.8.0esr-37.3fixed 31.8.0esr-37.3
Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, Thunderbird before 38.1, and other products, does not properly determine state transitions for the TLS state machine, which allows man-i
- affected < 31.8.0esr-37.3fixed 31.8.0esr-37.3
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by D
- CVE-2015-2716May 14, 2015affected < 31.7.0esr-34.1fixed 31.7.0esr-34.1
Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.
- CVE-2015-2713May 14, 2015affected < 31.7.0esr-34.1fixed 31.7.0esr-34.1
Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a document containing craft
- CVE-2015-2710May 14, 2015affected < 31.7.0esr-34.1fixed 31.7.0esr-34.1
Heap-based buffer overflow in the SVGTextFrame class in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code via crafted SVG graphics data in conjunction with a crafted Cascading Style Sheets (CSS
- CVE-2015-2709May 14, 2015affected < 31.7.0esr-34.1fixed 31.7.0esr-34.1
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- CVE-2015-2708May 14, 2015affected < 31.7.0esr-34.1fixed 31.7.0esr-34.1
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code vi
- CVE-2015-0797May 14, 2015affected < 31.7.0esr-34.1fixed 31.7.0esr-34.1
GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 v
- CVE-2015-0816Apr 1, 2015affected < 31.6.0esr-30.1fixed 31.6.0esr-30.1
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Orig
- CVE-2015-0815Apr 1, 2015affected < 31.6.0esr-30.1fixed 31.6.0esr-30.1
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code vi
Page 12 of 13