Mozilla Firefox ESR Security Advisories (MFSA2016-85, MFSA2016-86) - Windows

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

CVE-2016-5274

Mozilla Firefox (and Thunderbird <45.4) is affected by CVE-2016-5274 due to a use-after-free in nsFrameManager::CaptureFrameState, allowing remote attackers to execute arbitrary code by exploiting interactions between restyling and the Web Animations model. Affected products/versions: Firefox ...

CVE-2016-5281

IBM Storwize V7000 Unified is affected by CVE-2016-5281 (Mozilla Firefox use-after-free in DOMSVGLength) as part of a set of Firefox vulnerabilities bundled in IBM advisories. The IBM Security Bulletin lists affected code releases 1.5.1.0 to 1.5.2.4 and states a fix is available in version 1.5.2....

Debian Security Advisory DSA 3674-1 (firefox-esr - security update)

Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows and other implementation errors may lead to the execution of arbitrary code or information disclosure. OpenVAS Vulnerability Test $Id: deb3674.nasl 6608 2017-07-07 12:05:05...

Mozilla: Memory safety bugs fixed in Firefox ESR 45.4 (MFSA 2016-85, MFSA 2016-86)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4 and Thunderbird 45.4 allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via unknown vectors...

Debian: Security Advisory (DSA-3674-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2016-5284

Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning, which allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org...

CVE-2016-5272

The nsImageGeometryMixin class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements, which allows remote attackers to execute arbitrary code via a crafted web site...

Mozilla Releases Security Updates

Mozilla has released security updates to address multiple vulnerabilities in Firefox and Firefox ESR. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. Available updates include: Firefox 49 Firefox ESR 45.4 Users and administrators ar...

KLA10876 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code, bypass security restrictions or obtain sensitive information. Below is a complete list of vulnerabilities 1. An improper value...

Mozilla Firefox ESR < 45.3 Multiple Vulnerabilities

Binary data 9485.prm...

Mozilla Firefox ESR Security Advisories (MFSA2016-62, MFSA2016-84) - Windows

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

Mozilla Firefox ESR Security Advisories (MFSA2016-62, MFSA2016-84) - Mac OS X

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

Mozilla Firefox and Firefox ESR Memory Corruption Vulnerability (CNVD-2016-06148)

Mozilla Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox. An unspecified memory corruption vulnerability exists in Mozilla Firefox and Firefox, which allows remote attackers to build malicious web pages that can be tricked into parsing and can be used t...

CVE-2016-2839

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 on Linux make cairo cairosurfacegetextents calls that do not properly interact with libav header allocation in FFmpeg 0.10, which allows remote attackers to cause a denial of service application crash via a crafted video...

Code injection

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 on Linux make cairo cairosurfacegetextents calls that do not properly interact with libav header allocation in FFmpeg 0.10, which allows remote attackers to cause a denial of service application crash via a crafted video...

CVE-2016-5264

Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via an SVG element that is mishandled duri...

CVE-2016-5265

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS UXSS attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same loca...

CVE-2016-5262

Mozilla Firefox prior to 48.0 and Firefox ESR 45.x prior to 45.3 are affected by an XSS flaw where event-handler attributes of a MARQUEE element inside a sandboxed iframe without sandbox="allow-scripts" are processed, enabling remote XSS via a crafted page. Affected product details and patch info...

CVE-2016-2839

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 on Linux make cairo cairosurfacegetextents calls that do not properly interact with libav header allocation in FFmpeg 0.10, which allows remote attackers to cause a denial of service application crash via a crafted video...