openSUSE Security Update : chromium (openSUSE-SU-2013:0236-1)

Update to 26.0.1383 - Security fixes bnc798326 - CVE-2012-5145: Use-after-free in SVG layout - CVE-2012-5146: Same origin policy bypass with malformed URL - CVE-2012-5147: Use-after-free in DOM handling - CVE-2012-5148: Missing filename sanitization in hyphenation support - CVE-2012-5149: Integer...

openSUSE Security Update : MozillaFirefox (MozillaFirefox-2807)

This update brings Mozilla Firefox to the 3.6.8 security release. It fixes following security bugs: MFSA 2010-34 / CVE-2010-1211 / CVE-2010-1212: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of thes...

openSUSE Security Update : seamonkey (openSUSE-SU-2010:0430-1)

This update brings Mozilla SeaMonkey to the 2.0.6 security release. It fixes following security bugs: MFSA 2010-34 / CVE-2010-1211: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed...

openSUSE Security Update : mozilla-xulrunner191 (mozilla-xulrunner191-2779)

This update brings Mozilla XULRunner to the 1.9.1.11 security release. It fixes following security bugs: MFSA 2010-34 / CVE-2010-1211: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs show...

CVE-2014-1537

Use-after-free vulnerability in the mozilla::dom::workers::WorkerPrivateParent function in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via unspecified vectors...

Automattic: genericons.com - DOM based XSS.

Hi, I found a DOM based XSS located here : http://genericons.com/bold" Best regards, Olivier Beg...

[SECURITY] Fedora 19 Update: seamonkey-2.26-1.fc19

SeaMonkey is an all-in-one Internet application suite. It includes a browser, mail/news client, IRC client, JavaScript debugger, and a tool to inspect the DOM for web pages. It is derived from the application formerly known as Mozilla Application Suite...

Stable Channel Update

The Chrome Team is excited to announce the promotion of Chrome 35 to the Stable channel for Windows, Mac, and Linux. Chrome 35.0.1916.114 contains a number of fixes and improvements, including: More developer control over touch input New JavaScript features Unprefixed Shadow DOM A number of new...

Google Chrome < 34.0.1847.137 Multiple Vulnerabilities (Mac OS X)

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 34.0.1847.137. It is, therefore, affected by the following vulnerabilities : - A use-after-free error exists in the included Flash version that could lead to arbitrary code execution. CVE-2014-0510 - An...

Google Chrome < 34.0.1847.137 Multiple Vulnerabilities

The version of Google Chrome installed on the remote host is a version prior to 34.0.1847.137. It is, therefore, affected by the following vulnerabilities : - A use-after-free error exists in the included Flash version that could lead to arbitrary code execution. CVE-2014-0510 - An unspecified...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 3 security fixes in this release: 358038 High CVE-2014-1740: Use-after-free in WebSockets. Credit to Collin Payne. 349898 High CVE-2014-1741: Integer overflow in DOM ranges. Credit to John Butler. 356690 High CVE-2014-1742: Use-after-free in editing. Credit to...

Coinbase: Bypassing 2FA for BTC transfers

Under advanced settings, users have the ability to protect their wallet by requiring two-factor confirmation when sending bitcoins. Personally, I have configured my account with the most secure option, which requires two factor confirmation when sending any amount of bitcoins. However, a flaw...

FreeBSD : chromium -- multiple vulnerabilities (7cf25a0c-d031-11e3-947b-00262d5ed8ee)

Google Chrome Releases reports belatedly : 9 security fixes in this release, including : - 354967 High CVE-2014-1730: Type confusion in V8. Credit to Anonymous. - 349903 High CVE-2014-1731: Type confusion in DOM. Credit to John Butler. - 359802 High CVE-2014-1736: Integer overflow in V8. Credit t...

Code injection

Mozilla Firefox before 29.0 on Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses DOM events to prevent the reemergence of the actual address bar after scrolling has taken it off of the screen...

Design/Logic Flaw

The XrayWrapper implementation in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that is visited in the debugger, leading to unwrapping operations and calls to DOM methods on the unwrapped...

CVE-2014-1527

Mozilla Firefox before 29.0 on Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses DOM events to prevent the reemergence of the actual address bar after scrolling has taken it off of the screen...

CVE-2014-1525

CVE-2014-1525 affects Mozilla Firefox before 29.0 and SeaMonkey before 2.26, due to improper garbage collection in mozilla::dom::TextTrack::AddCue, enabling remote attackers to trigger a use-after-free and heap memory corruption via a crafted HTML5 Video element. Consequences include possible rem...

CVE-2014-1526

Summary : CVE-2014-1526 affects Mozilla Firefox up to 29.0 (and SeaMonkey up to 2.26). The XrayWrapper implementation could be abused by a user via a crafted site visited in a debugger to bypass access restrictions, causing unwrapping operations and calls to DOM methods on unwrapped objects. This...

CVE-2014-1527

CVE-2014-1527 affects Mozilla Firefox for Android (Android builds, e.g., Firefox 28.x and earlier; NVD references Firefox before 29.0 on Android). The vulnerability allows remote attackers to spoof the address bar by crafting JavaScript that uses DOM events to prevent reappearance of the real add...

CVE-2014-1527

Mozilla Firefox before 29.0 on Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses DOM events to prevent the reemergence of the actual address bar after scrolling has taken it off of the screen...