KLA10795 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to bypass security restrictions, inject arbitrary code, elevate privileges, cause denial of service or obtain sensitive information. Below is a complete list of vulnerabilities 1...

Vulnerability of Firefox and Firefox ESR browsers, which allows a hacker to forge the address bar

The vulnerability in the browser/base/content/browser.js function of Firefox and Firefox ESR is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to forge the URL address line remotely...

The vulnerabilities of Firefox ESR and Firefox, the rendering software Graphite 2, allow attackers to induce service failures or exert other effects.

The vulnerability of the graphite2::TtfUtil::CmapSubtable12Lookup function TtfUtil.cpp for Firefox ESR and Firefox browsers can be exploited due to buffer overflows. Exploiting this vulnerability may allow an attacker to cause service interruptions or other effects by using a specially crafted...

The vulnerabilities of the software platforms Flash Player, Flash Player ESR, and Adobe Integrated Runtime allow attackers to execute arbitrary code.

The vulnerability of the software platforms Flash Player, Flash Player ESR, and Adobe Integrated Runtime is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerabilities of the software platforms Flash Player, Flash Player ESR, and Adobe Integrated Runtime allow attackers to execute arbitrary code.

The vulnerability of the setInterval method in programming platforms such as Flash Player, Flash Player ESR, and Adobe Integrated Runtime is related to the use of memory after it is released. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

The vulnerabilities of Firefox ESR and Firefox, the rendering software Graphite 2, allow attackers to induce service failures or exert other effects.

The vulnerability of the graphite2::Slot::getAttr function Slot.cpp in Firefox ESR and Firefox browsers, as well as in the Graphite 2 rendering software, arises due to buffer overflows. Exploiting this vulnerability can allow an attacker to cause service interruptions or other effects through a...

The vulnerability of the Thunderbird email client, as well as the Firefox and Firefox ESR browsers, allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the nsNPObjWrapper::GetNewOrUsed function located in dom/plugins/base/nsJSNPRuntime.cpp in the Thunderbird email client, as well as in Firefox and Firefox ESR browsers, is related to pointer dereferencing errors. Exploiting this vulnerability could allow an attacker to execut...

The vulnerabilities of the software platforms Flash Player, Flash Player ESR, and Adobe Integrated Runtime allow attackers to trigger service failures or execute arbitrary code.

The vulnerabilities of the software platforms Flash Player, Flash Player ESR, and Adobe Integrated Runtime are caused by buffer overflows. Exploiting these vulnerabilities allows a malicious actor to execute arbitrary code or cause a service failure memory corruption remotely...

The vulnerabilities of the software platforms Flash Player, Flash Player ESR, and Adobe Integrated Runtime allow attackers to execute arbitrary code.

The vulnerabilities of the software platforms Flash Player, Flash Player ESR, and Adobe Integrated Runtime are caused by an overflow in the dynamic memory buffer. Exploiting these vulnerabilities allows a remote attacker to execute arbitrary code...

The vulnerabilities of the software platforms Flash Player, Flash Player ESR, and Adobe Integrated Runtime allow attackers to trigger service failures or execute arbitrary code.

The vulnerabilities of the software platforms Flash Player, Flash Player ESR, and Adobe Integrated Runtime are caused by buffer overflows. Exploiting these vulnerabilities allows a malicious actor to execute arbitrary code or cause a service failure memory corruption remotely...

The vulnerability of the Thunderbird email client, as well as the Firefox and Firefox ESR browsers, allows attackers to cause service failures or increase their privileges.

The vulnerability of the nsCSPContext::SendReports function in the Thunderbird email client, as well as in Firefox and Firefox ESR browsers, is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to cause service failures or gain increased...

The vulnerabilities of the software platforms Flash Player, Flash Player ESR, and Adobe Integrated Runtime allow attackers to trigger service failures or execute arbitrary code.

The vulnerabilities of the software platforms Flash Player, Flash Player ESR, and Adobe Integrated Runtime are caused by buffer overflows. Exploiting these vulnerabilities allows a malicious actor to execute arbitrary code or cause a service failure memory corruption remotely...

The vulnerabilities of the software platforms Flash Player, Flash Player ESR, and Adobe Integrated Runtime allow attackers to execute arbitrary code.

The vulnerability of the software platforms Flash Player, Flash Player ESR, and Adobe Integrated Runtime is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerabilities of the software platforms Flash Player, Flash Player ESR, and Adobe Integrated Runtime allow attackers to execute arbitrary code.

The vulnerability of the software platforms Flash Player, Flash Player ESR, and Adobe Integrated Runtime is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerabilities of the software platforms Flash Player, Flash Player ESR, and Adobe Integrated Runtime allow attackers to execute arbitrary code.

The vulnerabilities of the software platforms Flash Player, Flash Player ESR, and Adobe Integrated Runtime are caused by a numerical overflow. Exploiting these vulnerabilities allows an attacker operating remotely to execute arbitrary code...

Tor: Use-after-free during XML transformations (MFSA-2016-27)

Hello, I'm not sure how to understand the rules regarding "Bonus over Base Bounty/Mozilla Bounty for code execution exploits". Are vulnerabilities affecting Firefox ESR 38.7 covered by this section? If yes, you may be interested by MFSA 2016-27 aka CVE-2016-1964:...

Updated iceape packages fix security vulnerability

Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and view-source: URIs. CVE-2015-7214 The WebExtension APIs in Mozilla Firefox before 43.0 allow remote attackers to gain privileges, and possibly obtain sensitive...

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service buffer over-read or possibly have unspecified other impact via a crafted Graphite smart font,...

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font...

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

The Machine::Code::decoder::analysis::setref function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code or cause a denial of service stack memory corruption via a crafted Graphite smart font...