MGASA-2017-0059: iceape Mageia
CVSS: UnknownPublished
Published 20-02-2017Last modified 16-04-2026
Vulnerability summary
MGASA-2017-0059 is a vulnerability in iceape Mageia with no CVSS score yet.
CVSS score
Not scored
010
No CVSS score recordedEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 12 · Downstream 0Timeline
- 20-02-2017PublishedVulnerability first disclosed.
- 16-04-2026Last modifiedVulnerability information updated.
Description
Updated iceape packages fix security vulnerability Updated Iceape packages derived from Seamonkey include security fixes from Mozilla Firefox: Heap-based buffer overflow in the nsCaseTransformTextRunFactory::TransformString function in Seamonkey before 2.46 allows remote attackers to cause a denial of service (boolean out-of-bounds write) or possibly have unspecified other impact via Unicode characters that are mishandled during text conversion. (CVE-2016-5270) The PropertyProvider::GetSpacingInternal function in Seamonkey before 2.46 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via text runs in conjunction with a "display: contents" Cascading Style Sheets (CSS) property. (CVE-2016-5271) The nsImageGeometryMixin class in Seamonkey before 2.46 does not properly perform a cast of an unspecified variable during handling of INPUT elements, which allows remote attackers to execute arbitrary code via a crafted web site. (CVE-2016-5272) Use-after-free vulnerability in the mozilla::a11y::DocAccessible::ProcessInvalidationList function in Seamonkey before 2.46 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an aria-owns attribute. (CVE-2016-5276) Use-after-free vulnerability in the nsFrameManager::CaptureFrameState function in Seamonkey before 2.46 allows remote attackers to execute arbitrary code by leveraging improper interaction between restyling and the Web Animations model implementation. (CVE-2016-5274) Use-after-free vulnerability in the nsRefreshDriver::Tick function in Seamonkey before 2.46 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging improper interaction between timeline destruction and the Web Animations model implementation. (CVE-2016-5277) Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Seamonkey before 2.46 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image. (CVE-2016-5278) Use-after-free vulnerability in the mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap function in Seamonkey before 2.46 allows remote attackers to execute arbitrary code via bidirectional text. (CVE-2016-5280) Use-after-free vulnerability in the DOMSVGLength class in Seamonkey before 2.46 allows remote attackers to execute arbitrary code by leveraging improper interaction between JavaScript code and an SVG document. (CVE-2016-5281) Seamonkey before 2.46 relies on unintended expiration dates for Preloaded Public Key Pinning, which allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority. (CVE-2016-5284) Multiple unspecified vulnerabilities in the browser engine in Seamonkey before 2.46 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2016-5257)
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Mageia1 product
- iceape< 2.46-1.mga5
1 vendor · 1 product
References
3 linksRelated vulnerabilities
MGASA-2018-0018mageiaiceape+1Updated iceape packages fix security vulnerabilities
Updated iceape packages include security fixes from upstream Seamonkey
and Firefox:
Multiple flaws were found in the way Iceape 2.48 processes various types
of web content, where loading a web page containing malicious content
could cause Iceape to crash, execute arbitrary code, or disclose
sensitive information. (CVE-2016-10196,CVE-2017-5398,CVE-2017-5399,
CVE-2017-5400,CVE-2017-5401,CVE-2017-5402,CVE-2017-5403,CVE-2017-5404,
CVE-2017-5405,CVE-2017-5406,CVE-2017-5407,CVE-2017-5409,CVE-2017-5410,
CVE-2017-5411,CVE-2017-5408,CVE-2017-5412,CVE-2017-5413,CVE-2017-5414,
CVE-2017-5415,CVE-2017-5416,CVE-2017-5417,CVE-2017-5425,CVE-2017-5426,
CVE-2017-5427,CVE-2017-5418,CVE-2017-5419,CVE-2017-5420,CVE-2017-5421,
CVE-2017-5422,CVE-2017-5429,CVE-2017-5430,CVE-2017-5432,CVE-2017-5433,
CVE-2017-5434,CVE-2017-5435,CVE-2017-5436,CVE-2017-5438,CVE-2017-5439,
CVE-2017-5440,CVE-2017-5441,CVE-2017-5442,CVE-2017-5443,CVE-2017-5444,
CVE-2017-5445,CVE-2017-5446,CVE-2017-5447,CVE-2017-5448,CVE-2017-5449,
CVE-2017-5451,CVE-2017-5454,CVE-2017-5455,CVE-2017-5456,CVE-2017-5459,
CVE-2017-5460,CVE-2017-5461,CVE-2017-5462,CVE-2017-5464,CVE-2017-5465,
CVE-2017-5466,CVE-2017-5467,CVE-2017-5469,CVE-2017-5470,CVE-2017-5472,
CVE-2017-7749,CVE-2017-7750,CVE-2017-7751,CVE-2017-7752,CVE-2017-7753,
CVE-2017-7754,CVE-2017-7755,CVE-2017-7756,CVE-2017-7757,CVE-2017-7758,
CVE-2017-7760,CVE-2017-7761,CVE-2017-7763,CVE-2017-7764,CVE-2017-7765,
CVE-2017-7766,CVE-2017-7767,CVE-2017-7768,CVE-2017-7778,CVE-2017-7779,
CVE-2017-7782,CVE-2017-7784,CVE-2017-7785,CVE-2017-7786,CVE-2017-7787,
CVE-2017-7791,CVE-2017-7792,CVE-2017-7793,CVE-2017-7798,CVE-2017-7800,
CVE-2017-7801,CVE-2017-7802,CVE-2017-7803,CVE-2017-7804,CVE-2017-7805,
CVE-2017-7807,CVE-2017-7809,CVE-2017-7810,CVE-2017-7814,CVE-2017-7818,
CVE-2017-7819,CVE-2017-7823,CVE-2017-7824,CVE-2017-7825,CVE-2017-7826,
CVE-2017-7828,CVE-2017-7830,CVE-2017-7843,CVE-2017-7845)MGASA-2017-0323mageiaiceape+1Updated iceape packages fix security vulnerabilities
Updated Iceape packages include security fixes from upstream Seamonkey:
Multiple flaws were found in the way Iceape 2.46 processes various types
of web content, where loading a web page containing malicious content
could cause Iceape to crash, execute arbitrary code, or disclose
sensitive information. (CVE-2016-5287, CVE-2016-5288, CVE-2016-5289,
CVE-2016-5290, CVE-2016-5292, CVE-2016-5297, CVE-2016-9064,
CVE-2016-9066, CVE-2016-9067, CVE-2016-9068, CVE-2016-9075,
CVE-2016-9077, CVE-2016-5291, CVE-2016-9063, CVE-2016-9070,
CVE-2016-9071, CVE-2016-9073, CVE-2016-9076, CVE-2016-9078,
CVE-2016-9080, CVE-2016-9893, CVE-2016-9894, CVE-2016-9895,
CVE-2016-9896, CVE-2016-9897, CVE-2016-9898, CVE-2016-9899,
CVE-2016-9900, CVE-2016-9901, CVE-2016-9902, CVE-2016-9903,
CVE-2016-9904, CVE-2017-5373, CVE-2017-5374, CVE-2017-5375,
CVE-2017-5376, CVE-2017-5377, CVE-2017-5378, CVE-2017-5379,
CVE-2017-5380, CVE-2017-5381, CVE-2017-5382, CVE-2017-5383,
CVE-2017-5384, CVE-2017-5385, CVE-2017-5386, CVE-2017-5387,
CVE-2017-5388, CVE-2017-5389, CVE-2017-5390, CVE-2017-5391,
CVE-2017-5393, CVE-2017-5396)MGASA-2016-0124mageiaiceapeUpdated iceape packages fix security vulnerability
Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote
attackers to bypass the Same Origin Policy via data: and view-source:
URIs. (CVE-2015-7214)
The WebExtension APIs in Mozilla Firefox before 43.0 allow remote
attackers to gain privileges, and possibly obtain sensitive information or
conduct cross-site scripting (XSS) attacks, via a crafted web site.
(CVE-2015-7223)
Integer underflow in the Metadata::setData function in MetaData.cpp in
libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before
38.5 allows remote attackers to execute arbitrary code or cause a denial
of service (incorrect memory allocation and application crash) via an MP4
video file with crafted covr metadata that triggers a buffer overflow.
(CVE-2015-7222)
Integer overflow in the MPEG4Extractor::readMetaData function in
MPEG4Extractor.cpp in libstagefright in Mozilla Firefox before 43.0 and
Firefox ESR 38.x before 38.5 on 64-bit platforms allows remote attackers
to execute arbitrary code via a crafted MP4 video file that triggers a
buffer overflow. (CVE-2015-7213)
Integer underflow in the RTPReceiverVideo::ParseRtpPacket function in
Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 might allow
remote attackers to obtain sensitive information, cause a denial of
service, or possibly have unspecified other impact by triggering a
crafted WebRTC RTP packet. (CVE-2015-7205)
Buffer overflow in the DirectWriteFontInfo::LoadFontFamilyData function in
gfx/thebes/gfxDWriteFontList.cpp in Mozilla Firefox before 43.0 might
allow remote attackers to cause a denial of service or possibly have
unspecified other impact via a crafted font-family name. (CVE-2015-7203)
Buffer overflow in the XDRBuffer::grow function in js/src/vm/Xdr.cpp in
Mozilla Firefox before 43.0 might allow remote attackers to cause a denial
of service or possibly have unspecified other impact via crafted
JavaScript code. (CVE-2015-7220)
Buffer overflow in the nsDeque::GrowCapacity function in
xpcom/glue/nsDeque.cpp in Mozilla Firefox before 43.0 might allow remote
attackers to cause a denial of service or possibly have unspecified other
impact by triggering a deque size change. (CVE-2015-7221)
The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME
platforms incorrectly enables the JasPer decoder, which allows remote
attackers to cause a denial of service or possibly have unspecified other
impact via a crafted JPEG 2000 image. (CVE-2015-7216)
The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME
platforms incorrectly enables the TGA decoder, which allows remote
attackers to cause a denial of service (heap-based buffer overflow) via a
crafted Truevision TGA image. (CVE-2015-7217)
The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote
attackers to cause a denial of service (integer underflow, assertion
failure, and application exit) via a single-byte header frame that
triggers incorrect memory allocation. (CVE-2015-7218)
The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote
attackers to cause a denial of service (integer underflow, assertion
failure, and application exit) via a malformed PushPromise frame that
triggers decompressed-buffer length miscalculation and incorrect memory
allocation. (CVE-2015-7219)
Mozilla Firefox before 43.0 mishandles the # (number sign) character in a
data: URI, which allows remote attackers to spoof web sites via
unspecified vectors. (CVE-2015-7211)
The importScripts function in the Web Workers API implementation in
Mozilla Firefox before 43.0 allows remote attackers to bypass the Same
Origin Policy by triggering use of the no-cors mode in the fetch API to
attempt resource access that throws an exception, leading to information
disclosure after a rethrow. (CVE-2015-7215)
Integer overflow in the
mozilla::layers::BufferTextureClient::AllocateForSurface function in
Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote
attackers to execute arbitrary code by triggering a graphics operation
that requires a large texture allocation. (CVE-2015-7212)
Use-after-free vulnerability in Mozilla Firefox before 43.0 and Firefox
ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by
triggering attempted use of a data channel that has been closed by a
WebRTC function. (CVE-2015-7210)
Mozilla Firefox before 43.0 stores cookies containing vertical tab
characters, which allows remote attackers to obtain sensitive information
by reading HTTP Cookie headers. (CVE-2015-7208)
Mozilla Firefox before 43.0 does not properly restrict the availability of
IFRAME Resource Timing API times, which allows remote attackers to bypass
the Same Origin Policy and obtain sensitive information via crafted
JavaScript code that leverages history.back and performance.getEntries
calls, a related issue to CVE-2015-1300. (CVE-2015-7207)
Mozilla Firefox before 43.0 does not properly store the properties of
unboxed objects, which allows remote attackers to execute arbitrary code
via crafted JavaScript variable assignments. (CVE-2015-7204)
Multiple unspecified vulnerabilities in the browser engine in Mozilla
Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote
attackers to cause a denial of service (memory corruption and application
crash) or possibly execute arbitrary code via unknown vectors.
(CVE-2015-7201)
Multiple unspecified vulnerabilities in the browser engine in Mozilla
Firefox before 43.0 allow remote attackers to cause a denial of service
(memory corruption and application crash) or possibly execute arbitrary
code via unknown vectors. (CVE-2015-7202)MGASA-2015-0447mageiaiceapeUpdated iceape packages fix security vulnerabilities
Updated iceape packages fix security issues:
Multiple unspecified vulnerabilities in the browser engine in Mozilla
Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers
to cause a denial of service (memory corruption and application crash) or
possibly execute arbitrary code via unknown vectors. (CVE-2015-4513)
Multiple unspecified vulnerabilities in the browser engine in Mozilla
Firefox before 42.0 allow remote attackers to cause a denial of service
(memory corruption and application crash) or possibly execute arbitrary
code via unknown vectors. (CVE-2015-4514)
Mozilla Firefox before 42.0, when NTLM v1 is enabled for HTTP
authentication, allows remote attackers to obtain sensitive hostname
information by constructing a crafted web site that sends an NTLM request
and reads the Workstation field of an NTLM type 3 message. (CVE-2015-4515)
The Reader View implementation in Mozilla Firefox before 42.0 has an
improper whitelist, which makes it easier for remote attackers to bypass
the Content Security Policy (CSP) protection mechanism and conduct
cross-site scripting (XSS) attacks via vectors involving SVG animations and
the about:reader URL. (CVE-2015-4518)
The Add-on SDK in Mozilla Firefox before 42.0 misinterprets a "script:
false" panel setting, which makes it easier for remote attackers to conduct
cross-site scripting (XSS) attacks via inline JavaScript code that is
executed within a third-party extension. (CVE-2015-7187)
Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote
attackers to bypass the Same Origin Policy for an IP address origin, and
conduct cross-site scripting (XSS) attacks, by appending whitespace
characters to an IP address string. (CVE-2015-7188)
Race condition in the JPEGEncoder function in Mozilla Firefox before 42.0
and Firefox ESR 38.x before 38.4 allows remote attackers to execute
arbitrary code or cause a denial of service (heap-based buffer overflow)
via vectors involving a CANVAS element and crafted JavaScript code.
(CVE-2015-7189)
Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly
follow the CORS cross-origin request algorithm for the POST method in
situations involving an unspecified Content-Type header manipulation, which
allows remote attackers to bypass the Same Origin Policy by leveraging the
lack of a preflight-request step. (CVE-2015-7193)
Buffer underflow in libjar in Mozilla Firefox before 42.0 and Firefox ESR
38.x before 38.4 allows remote attackers to cause a denial of service
(application crash) or possibly execute arbitrary code via a crafted ZIP
archive. (CVE-2015-7194)
The URL parsing implementation in Mozilla Firefox before 42.0 improperly
recognizes escaped characters in hostnames within Location headers, which
allows remote attackers to obtain sensitive information via vectors
involving a redirect. (CVE-2015-7195)
Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, when a Java
plugin is enabled, allow remote attackers to cause a denial of service
(incorrect garbage collection and application crash) or possibly execute
arbitrary code via a crafted Java applet that deallocates an in-use
JavaScript wrapper. (CVE-2015-7196)
Buffer overflow in the rx::TextureStorage11 class in ANGLE, as used in
Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, allows remote
attackers to cause a denial of service (memory corruption) or possibly have
unspecified other impact via crafted texture data. (CVE-2015-7198)
The (1) AddWeightedPathSegLists and (2) SVGPathSegListSMILType::Interpolate
functions in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4
lack status checking, which allows remote attackers to cause a denial of
service (memory corruption) or possibly have unspecified other impact via a
crafted SVG document. (CVE-2015-7199)
The CryptoKey interface implementation in Mozilla Firefox before 42.0 and
Firefox ESR 38.x before 38.4 lacks status checking, which allows attackers
to have an unspecified impact via vectors related to a cryptographic key.
(CVE-2015-7200)
Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly
control the ability of a web worker to create a WebSocket object, which
allows remote attackers to bypass intended mixed-content restrictions via
crafted JavaScript code. (CVE-2015-7197)MGASA-2015-0414mageiaiceape+1Updated iceape/sqlite3 packages fix security vulnerabilities
Updated iceape packages fix security issues. The sqlite3 package has been
updated as well since the new iceape version requires the
SQLITE_ENABLE_DBSTAT_VTAB feature to be enabled in sqlite. This sqlite3
update also enables ICU support, fixing bug #16814 .
Use-after-free vulnerability in the MediaStream playback feature in
Mozilla Firefox before 40.0 allows remote attackers to execute arbitrary
code via unspecified use of the Web Audio API. (CVE-2015-4477)
Mozilla Firefox before 40.0 allows man-in-the-middle attackers to bypass a
mixed-content protection mechanism via a feed: URL in a POST request.
(CVE-2015-4483)
The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in
Mozilla Firefox before 40.0 does not implement the Content Security Policy
Level 2 exceptions for the blob, data, and filesystem URL schemes during
wildcard source-expression matching, which might make it easier for remote
attackers to conduct cross-site scripting (XSS) attacks by leveraging
unexpected policy-enforcement behavior. (CVE-2015-4490)
Multiple unspecified vulnerabilities in the browser engine in Mozilla
Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote
attackers to cause a denial of service (memory corruption and application
crash) or possibly execute arbitrary code via unknown vectors.
(CVE-2015-4500)
Multiple unspecified vulnerabilities in the browser engine in Mozilla
Firefox before 41.0 allow remote attackers to cause a denial of service
(memory corruption and application crash) or possibly execute arbitrary
code via unknown vectors. (CVE-2015-4501)
The lut_inverse_interp16 function in the QCMS library in Mozilla Firefox
before 41.0 allows remote attackers to obtain sensitive information or
cause a denial of service (buffer over-read and application crash) via
crafted attributes in the ICC 4 profile of an image. (CVE-2015-4504)
The SavedStacks class in the JavaScript implementation in Mozilla Firefox
before 41.0, when the Debugger API is enabled, allows remote attackers to
cause a denial of service (getSlotRef assertion failure and application
exit) or possibly execute arbitrary code via a crafted web site.
(CVE-2015-4507)
Mozilla Firefox before 41.0, when reader mode is enabled, allows remote
attackers to spoof the relationship between address-bar URLs and web
content via a crafted web site. (CVE-2015-4508)
Race condition in the WorkerPrivate::NotifyFeatures function in Mozilla
Firefox before 41.0 allows remote attackers to execute arbitrary code or
cause a denial of service (use-after-free and application crash) by
leveraging improper interaction between shared workers and the IndexedDB
implementation. (CVE-2015-4510)
Heap-based buffer overflow in the nestegg_track_codec_data function in
Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote
attackers to execute arbitrary code via a crafted header in a WebM video.
(CVE-2015-4511)
Use-after-free vulnerability in the HTMLVideoElement interface in Mozilla
Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote
attackers to execute arbitrary code via crafted JavaScript code that
modifies the URI table of a media element, aka ZDI-CAN-3176.
(CVE-2015-4509)
gfx/2d/DataSurfaceHelpers.cpp in Mozilla Firefox before 41.0 on Linux
improperly attempts to use the Cairo library with 32-bit color-depth
surface creation followed by 16-bit color-depth surface display, which
allows remote attackers to obtain sensitive information from process
memory or cause a denial of service (out-of-bounds read) by using a CANVAS
element to trigger 2D rendering. (CVE-2015-4512)
js/src/proxy/Proxy.cpp in Mozilla Firefox before 41.0 mishandles certain
receiver arguments, which allows remote attackers to bypass intended
window access restrictions via a crafted web site. (CVE-2015-4502)
Mozilla Firefox before 41.0 allows remote attackers to bypass certain
ECMAScript 5 (aka ES5) API protection mechanisms and modify immutable
properties, and consequently execute arbitrary JavaScript code with chrome
privileges, via a crafted web page that does not use ES5 APIs.
(CVE-2015-4516)
Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow
user-assisted remote attackers to bypass intended access restrictions and
discover a redirect's target URL via crafted JavaScript code that executes
after a drag-and-drop action of an image into a TEXTBOX element.
(CVE-2015-4519)
Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote
attackers to bypass CORS preflight protection mechanisms by leveraging (1)
duplicate cache-key generation or (2) retrieval of a value from an
incorrect HTTP Access-Control-* response header. (CVE-2015-4520)
NetworkUtils.cpp in Mozilla Firefox before 41.0 and Firefox ESR 38.x
before 38.3 might allow remote attackers to cause a denial of service
(memory corruption and application crash) or possibly have unspecified
other impact via unknown vectors. (CVE-2015-4517)
The ConvertDialogOptions function in Mozilla Firefox before 41.0 and
Firefox ESR 38.x before 38.3 might allow remote attackers to cause a
denial of service (memory corruption and application crash) or possibly
have unspecified other impact via unknown vectors. (CVE-2015-4521)
The nsUnicodeToUTF8::GetMaxLength function in Mozilla Firefox before 41.0
and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a
denial of service (memory corruption and application crash) or possibly
have unspecified other impact via unknown vectors, related to an
"overflow." (CVE-2015-4522)
The nsAttrAndChildArray::GrowBy function in Mozilla Firefox before 41.0
and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a
denial of service (memory corruption and application crash) or possibly
have unspecified other impact via unknown vectors, related to an
"overflow." (CVE-2015-7174)
The XULContentSinkImpl::AddText function in Mozilla Firefox before 41.0
and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a
denial of service (memory corruption and application crash) or possibly
have unspecified other impact via unknown vectors, related to an
"overflow." (CVE-2015-7175)
The AnimationThread function in Mozilla Firefox before 41.0 and Firefox
ESR 38.x before 38.3 uses an incorrect argument to the sscanf function,
which might allow remote attackers to cause a denial of service
(stack-based buffer overflow and application crash) or possibly have
unspecified other impact via unknown vectors. (CVE-2015-7176)
The InitTextures function in Mozilla Firefox before 41.0 and Firefox ESR
38.x before 38.3 might allow remote attackers to cause a denial of service
(memory corruption and application crash) or possibly have unspecified
other impact via unknown vectors. (CVE-2015-7177)MGASA-2015-0342mageiaiceape+1Updated iceape packages fix security vulnerabilities
Updated iceape packages fix security issues:
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox
before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow
remote attackers to cause a denial of service (memory corruption and application
crash) or possibly execute arbitrary code via unknown vectors. (CVE-2015-0814,
CVE-2015-0815)
Use-after-free vulnerability in the AppendElements function in Mozilla Firefox
before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 on Linux,
when the Fluendo MP3 plugin for GStreamer is used, allows remote attackers to
execute arbitrary code or cause a denial of service (heap memory corruption) via
a crafted MP3 file. (CVE-2015-0813)
Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight
theme add-on installations, which allows man-in-the-middle attackers to bypass
an intended user-confirmation requirement by deploying a crafted web site and
conducting a DNS spoofing attack against a mozilla.org subdomain.
(CVE-2015-0812)
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird
before 31.6 do not properly restrict resource: URLs, which makes it easier for
remote attackers to execute arbitrary JavaScript code with chrome privileges by
leveraging the ability to bypass the Same Origin Policy, as demonstrated by the
resource: URL associated with PDF.js. (CVE-2015-0816)
The QCMS implementation in Mozilla Firefox before 37.0 allows remote attackers
to obtain sensitive information from process heap memory or cause a denial of
service (out-of-bounds read) via an image that is improperly handled during
transformation. (CVE-2015-0811)
The webrtc::VPMContentAnalysis::Release function in the WebRTC implementation in
Mozilla Firefox before 37.0 uses incompatible approaches to the deallocation of
memory for simple-type arrays, which might allow remote attackers to cause a
denial of service (memory corruption) via unspecified vectors. (CVE-2015-0808)
The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox
ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status
codes for redirects after a preflight request has occurred, which allows remote
attackers to bypass intended CORS access-control checks and conduct cross-site
request forgery (CSRF) attacks via a crafted web site, a similar issue to
CVE-2014-8638. (CVE-2015-0807)
The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before
37.0 makes an incorrect memset call during interaction with the
mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows
remote attackers to execute arbitrary code or cause a denial of service (memory
corruption and application crash) via vectors that trigger rendering of 2D
graphics content. (CVE-2015-0805)
The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before
37.0 attempts to use memset for a memory region of negative length during
interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface
function, which allows remote attackers to execute arbitrary code or cause a
denial of service (memory corruption) via vectors that trigger rendering of 2D
graphics content. (CVE-2015-0806)
The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does
not properly constrain the original data type of a casted value during the
setting of a SOURCE element's attributes, which allows remote attackers to
execute arbitrary code or cause a denial of service (use-after-free) via a
crafted HTML document. (CVE-2015-0803)
The HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does
not properly constrain a data type after omitting namespace validation during
certain tree-binding operations, which allows remote attackers to execute
arbitrary code or cause a denial of service (use-after-free) via a crafted HTML
document containing a SOURCE element. (CVE-2015-0804)
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird
before 31.6 allow remote attackers to bypass the Same Origin Policy and execute
arbitrary JavaScript code with chrome privileges via vectors involving anchor
navigation, a similar issue to CVE-2015-0818. (CVE-2015-0801)
Mozilla Firefox before 37.0 relies on docshell type information instead of page
principal information for Window.webidl access control, which might allow remote
attackers to execute arbitrary JavaScript code with chrome privileges via
certain content navigation that leverages the reachability of a privileged
window with an unintended persistence of access to restricted internal methods.
(CVE-2015-0802)
The HTTP Alternative Services feature in Mozilla Firefox before 37.0.1 allows
man-in-the-middle attackers to bypass an intended X.509 certificate-verification
step for an SSL server by specifying that server in the uri-host field of an
Alt-Svc HTTP/2 response header. (CVE-2015-0799)
Race condition in the AsyncPaintWaitEvent::AsyncPaintWaitEvent function in
Mozilla Firefox before 37.0.2 allows remote attackers to execute arbitrary code
or cause a denial of service (use-after-free) via a crafted plugin that does not
properly complete initialization. (CVE-2015-2706)
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox
before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allow
remote attackers to cause a denial of service (memory corruption and application
crash) or possibly execute arbitrary code via unknown vectors. (CVE-2015-2708)
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox
before 38.0 allow remote attackers to cause a denial of service (memory
corruption and application crash) or possibly execute arbitrary code via unknown
vectors. (CVE-2015-2709)
Heap-based buffer overflow in the SVGTextFrame class in Mozilla Firefox before
38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote
attackers to execute arbitrary code via crafted SVG graphics data in conjunction
with a crafted Cascading Style Sheets (CSS) token sequence. (CVE-2015-2710)
Mozilla Firefox before 38.0 does not recognize a referrer policy delivered by a
referrer META element in cases of context-menu navigation and middle-click
navigation, which allows remote attackers to obtain sensitive information by
reading web-server Referer logs that contain private data in a URL, as
demonstrated by a private path component. (CVE-2015-2711)
The asm.js implementation in Mozilla Firefox before 38.0 does not properly
determine heap lengths during identification of cases in which bounds checking
may be safely skipped, which allows remote attackers to trigger out-of-bounds
write operations and possibly execute arbitrary code, or trigger out-of-bounds
read operations and possibly obtain sensitive information from process memory,
via crafted JavaScript. (CVE-2015-2712)
Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox before
38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote
attackers to execute arbitrary code or cause a denial of service (heap memory
corruption) via a document containing crafted text in conjunction with a
Cascading Style Sheets (CSS) token sequence containing properties related to
vertical text. (CVE-2015-2713)
Race condition in the nsThreadManager::RegisterCurrentThread function in Mozilla
Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a
denial of service (use-after-free and heap memory corruption) by leveraging
improper Media Decoder Thread creation at the time of a shutdown.
(CVE-2015-2715)
Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR
31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute
arbitrary code by providing a large amount of compressed XML data.
(CVE-2015-2716)
Integer overflow in libstagefright in Mozilla Firefox before 38.0 allows remote
attackers to execute arbitrary code or cause a denial of service (heap-based
buffer overflow and out-of-bounds read) via an MP4 video file containing invalid
metadata. (CVE-2015-2717)
The WebChannel.jsm module in Mozilla Firefox before 38.0 allows remote attackers
to bypass the Same Origin Policy and obtain sensitive webchannel-response data
via a crafted web site containing an IFRAME element referencing a different web
site that is intended to read this data. (CVE-2015-2718)
Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0
allow remote attackers to execute arbitrary code via crafted sample metadata in
an MPEG-4 video file. (CVE-2015-4496)