SUSE SLED12 / SLES12 Security Update : MozillaFirefox, mozilla-nspr (SUSE-SU-2015:1680-1)

Mozilla Firefox was updated to version 38.3.0 ESR bsc947003, fixing bugs and security issues. - MFSA 2015-96/CVE-2015-4500/CVE-2015-4501 Miscellaneous memory safety hazards rv:41.0 / rv:38.3 - MFSA 2015-101/CVE-2015-4506 Buffer overflow in libvpx while parsing vp9 format video - MFSA...

Ubuntu 14.04 LTS : Thunderbird vulnerabilities (USN-2754-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2754-1 advisory. Andrew Osmond, Olli Pettay, Andrew Sutherland, Christian Holler, David Major, Andrew McCreight, and Cameron McCormack discovered multiple memory safety...

openSUSE: Security Advisory for MozillaThunderbird (openSUSE-SU-2015:1679-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for seamonkey (important)

seamonkey was updated to fix 25 security issues. These security issues were fixed: - CVE-2015-4520: Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allowed remote attackers to bypass CORS preflight protection mechanisms by leveraging 1 duplicate cache-key generation or 2 retrieval of...

Mozilla: Errors in the handling of CORS preflight request headers (MFSA 2015-111)

Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass CORS preflight protection mechanisms by leveraging 1 duplicate cache-key generation or 2 retrieval of a value from an incorrect HTTP Access-Control- response header...

Security update for MozillaFirefox (important)

MozillaFirefox was updated to Firefox 41.0 bnc947003 Security issues fixed: MFSA 2015-96/CVE-2015-4500/CVE-2015-4501 Miscellaneous memory safety hazards MFSA 2015-97/CVE-2015-4503 bmo994337 Memory leak in mozTCPSocket to servers MFSA 2015-98/CVE-2015-4504 bmo1132467 Out of bounds read in QCMS...

Mozilla Firefox and Firefox ESR CORS Preflight Protection Mechanism Bypass Vulnerability

Mozilla Firefox is an open source web browser. A security vulnerability exists in Mozilla Firefox that allows an attacker to bypass the CORS pre-check protection mechanism by generating a duplicate cache-key and retrieving the value in a failed HTTP Access-Control- response header...

CVE-2015-4520

Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass CORS preflight protection mechanisms by leveraging 1 duplicate cache-key generation or 2 retrieval of a value from an incorrect HTTP Access-Control- response header...

Authentication flaw

Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass CORS preflight protection mechanisms by leveraging 1 duplicate cache-key generation or 2 retrieval of a value from an incorrect HTTP Access-Control- response header...

CVE-2015-4520

CVE-2015-4520 affects Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3. The vulnerability enables remote bypass of CORS preflight protections by (1) duplicating cache-key generation or (2) reading values from an incorrect HTTP Access-Control-* response header, potentially allowing cro...

Mozilla: Errors in the handling of CORS preflight request headers (MFSA 2015-111)

Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass CORS preflight protection mechanisms by leveraging 1 duplicate cache-key generation or 2 retrieval of a value from an incorrect HTTP Access-Control- response header...

mozilla -- multiple vulnerabilities

The Mozilla Project reports: MFSA 2015-96 Miscellaneous memory safety hazards rv:41.0 / rv:38.3 MFSA 2015-97 Memory leak in mozTCPSocket to servers MFSA 2015-98 Out of bounds read in QCMS library with ICC V4 profile attributes MFSA 2015-99 Site attribute spoofing on Android by pasting URL with...

KLA11454 Multiple vulnerabilities in SeaMonkey

Multiple vulnerabilities were found in SeaMonkey. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, bypass security restrictions and spoof user interface. Below is a complete list of vulnerabilities: 1. Multiple memory corruption vulnerabilities...

UBUNTU-CVE-2015-4520

Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass CORS preflight protection mechanisms by leveraging 1 duplicate cache-key generation or 2 retrieval of a value from an incorrect HTTP Access-Control- response header...

CVE-2015-4520

Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass CORS preflight protection mechanisms by leveraging 1 duplicate cache-key generation or 2 retrieval of a value from an incorrect HTTP Access-Control- response header...

Errors in the handling of CORS preflight request headers — Mozilla

Mozilla developer Ehsan Akhgari reported two issues with Cross-origin resource sharing CORS "preflight" requests...

thunderbird: multiple issues

CVE-2015-0801 same-origin bypass: Mozilla developer Olli Pettay reported that while investigating Mozilla Foundation Security Advisory 2015-28, he and Mozilla developer Boris Zbarsky found an alternate way to trigger a similar vulnerability. The previously reported flaw used an issue with SVG...

Mozilla: CORS requests should not follow 30x redirections after preflight (MFSA 2015-37)

A flaw was found in the Beacon interface implementation in Firefox. A web page containing malicious content could allow a remote attacker to conduct a Cross-Site Request Forgery CSRF attack...

Mozilla: CORS requests should not follow 30x redirections after preflight (MFSA 2015-37)

A flaw was found in the Beacon interface implementation in Firefox. A web page containing malicious content could allow a remote attacker to conduct a Cross-Site Request Forgery CSRF attack...

UBUNTU-CVE-2015-0807

The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and...