Design/Logic Flaw

The JSSubScriptLoader in Mozilla Firefox 4.x through 6 and SeaMonkey before 2.4 does not properly handle XPCNativeWrappers during calls to the loadSubScript method in an add-on, which makes it easier for remote attackers to gain privileges via a crafted web site that leverages certain unwrapping...

CVE-2011-3004

The JSSubScriptLoader in Mozilla Firefox 4.x through 6 and SeaMonkey before 2.4 does not properly handle XPCNativeWrappers during calls to the loadSubScript method in an add-on, which makes it easier for remote attackers to gain privileges via a crafted web site that leverages certain unwrapping...

CVE-2011-2997

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via unknown vectors...

Memory corruption

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via unknown vectors...

CVE-2011-3003

Mozilla Firefox before 7.0 and SeaMonkey before 2.4 allow remote attackers to cause a denial of service application crash or possibly execute arbitrary code via an unspecified WebGL test case that triggers a memory-allocation error and a resulting out-of-bounds write operation...

Design/Logic Flaw

Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not properly handle HTTP responses that contain multiple Location, Content-Length, or Content-Disposition headers, which makes it easier for remote attackers to conduct HTTP response splitting...

CVE-2011-2995

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via unknow...

Mozilla Firefox和SeaMonkey远程缓冲区溢出漏洞

BUGTRAQ ID: 49813 CVE ID: CVE-2011-3002 Firefox是一款非常流行的开源WEB浏览器。SeaMonkey是开源的Web浏览器、邮件和新闻组客户端、IRC会话客户端和HTML编辑器。 Firefox和SeaMonkey在实现上安全漏洞，远程攻击者可在受影响应用程序中执行任意代码，或造成拒绝服务。 在WebGL中使用的ANGLE库中，GrowAtomTable返回的值没有验证错误，导致使用特制请求造成缓冲区溢出。 Mozilla Firefox 3.6.x Mozilla SeaMonkey 2.x 厂商补丁： Mozilla -------...

CVE-2011-3003

CVE-2011-3003 affects Mozilla Firefox < 7.0 and SeaMonkey

CVE-2011-3866

Mozilla Firefox before 7.0 and SeaMonkey before 2.4 do not properly restrict availability of motion data events, which makes it easier for remote attackers to read keystrokes by leveraging JavaScript code running in a background tab...

CVE-2011-3000

Affected software: Mozilla Firefox before 3.6.23 and 4.x through 6; also affects Thunderbird before 7.0 and SeaMonkey before 2.4. Root cause: HTTP response handling flaw that allows HTTP response splitting when responses contain multiple Location, Content-Length, or Content-Disposition headers. I...

CVE-2011-3005

Use-after-free vulnerability in Mozilla Firefox 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via crafted OGG headers in a .ogg file...

CVE-2011-2999

Mozilla Firefox before 3.6.23 and 4.x through 5, Thunderbird before 6.0, and SeaMonkey before 2.3 do not properly handle "location" as the name of a frame, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, a different vulnerability than CVE-2010-0170...

CVE-2011-3002

CVE-2011-3002 concerns Mozilla Firefox (pre-7.0) and SeaMonkey (pre-2.4) where ANGLE does not validate the return value of GrowAtomTable, enabling memory-allocation errors that can cause a crash or potentially allow arbitrary code execution. The vulnerability is triggered by vectors that lead to ...

CVE-2011-3001

Mozilla Firefox 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent manual add-on installation in response to the holding of the Enter key, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that triggers an...

CVE-2011-2995

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via unknow...

CVE-2011-3866

CVE-2011-3866 affects Mozilla Firefox prior to 7.0 and SeaMonkey prior to 2.4, where motion data events were not properly restricted. The underlying issue is an improper restriction of motion data events, enabling a remote attacker to read keystrokes via JavaScript running in a background tab. Ex...

CVE-2011-2997

CVE-2011-2997 affects Mozilla Firefox (browser engine) versions on Windows/Linux/macOS as Firefox 6, Thunderbird before 7.0, and SeaMonkey before 2.4. Root cause: memory corruption in the browser engine that can cause denial of service or potentially allow arbitrary code execution via unknown vec...

CVE-2011-3003

Mozilla Firefox before 7.0 and SeaMonkey before 2.4 allow remote attackers to cause a denial of service application crash or possibly execute arbitrary code via an unspecified WebGL test case that triggers a memory-allocation error and a resulting out-of-bounds write operation...

CVE-2011-3000

Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not properly handle HTTP responses that contain multiple Location, Content-Length, or Content-Disposition headers, which makes it easier for remote attackers to conduct HTTP response splitting...