KLA10723 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to spoof user interface, cause denial of service, bypass security restrictions, gain privileges, execute arbitrary code or obtain sensitive information. Below is a complete list ...

mozilla -- multiple vulnerabilities

The Mozilla Project reports: MFSA 2015-134 Miscellaneous memory safety hazards rv:43.0 / rv:38.5 MFSA 2015-135 Crash with JavaScript variable assignment with unboxed objects MFSA 2015-136 Same-origin policy violation using perfomance.getEntries and history navigation MFSA 2015-137 Firefox allows...

CVE-2015-7205

Integer underflow in the RTPReceiverVideo::ParseRtpPacket function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 might allow remote attackers to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a crafted WebRTC RTP...

openSUSE Security Update : MozillaFirefox / mozilla-nspr / mozilla-nss / etc (openSUSE-2015-718)

Mozilla Firefox was updated to version 42.0, fixing bugs and security issues. Mozilla xulrunner was updated to xulrunner 38.4.0. SeaMonkey was updated to 2.39. New features in Mozilla Firefox : - Private Browsing with Tracking Protection blocks certain Web elements that could be used to record yo...

openSUSE: Security Advisory for MozillaFirefox (openSUSE-SU-2015:1942-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for MozillaFirefox, mozilla-nspr, mozilla-nss, xulrunner, seamonkey (important)

Mozilla Firefox was updated to version 42.0, fixing bugs and security issues. Mozilla xulrunner was updated to xulrunner 38.4.0. Seamonkey was updated to 2.39. New features in Mozilla Firefox: Private Browsing with Tracking Protection blocks certain Web elements that could be used to record your...

Western Digital My Cloud Command Injection

Exploit Title: Western Digital My Cloud Command Injection Vendor Homepage: http://www.wdc.com Firmware tested: 04.01.03-421 and 04.01.04-422 for the Personal Cloud devices Firmware link: http://download.wdc.com/nas/sq-040104-422-20150423.deb.zip Exploit Author: James Sibley absane ; twitter =...

Western Digital My Cloud 04.01.03-421/04.01.04-422 - Command Injection

Exploit Title: Western Digital My Cloud Command Injection Vendor Homepage: http://www.wdc.com Firmware tested: 04.01.03-421 and 04.01.04-422 for the Personal Cloud devices Firmware link: http://download.wdc.com/nas/sq-040104-422-20150423.deb.zip Exploit Author: James Sibley absane ; twitter =...

Mozilla Addresses 14-Year-Old Bug in Firefox 41

Developers at Mozilla pushed out Firefox 41 this week and brought some much needed relief to Adblock Plus users by finally fixing a 14-year old bug in the browser. The update addresses a longstanding issue with how the browser handles memory usage by the add-on. Previously the browser created too...

Firefox 41 integrates Free Built-in Instant Messaging and Video Chat to Your Browser

Mozilla launches Voice and Video Connect with the release of Official Firefox 41.0 Release. After significant improvements done in the Firefox Nightly experimental build of version Firefox 41.0, the stable release has a lot to offer. How would it be experiencing a seamless communication – video a...

Sonar.js - Framework for identifying and launching exploits against internal network hosts

A framework for identifying and launching exploits against internal network hosts. Works via WebRTC IP enumeration, WebSocket host scanning, and external resource fingerprinting. How does it work? Upon loading the sonar.js payload in a modern web browser the following will happen: sonar.js will u...

Ubuntu: Security Advisory (USN-2610-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Exploit Kit Delivers Pharming Attacks Against SOHO Routers

Attacks targeting small office and home router DNS settings, long a target for network intruders seeking to redirect web traffic to malicious sites, have for the first time been included in an exploit kit—one that specializes in cross-site request forgery attacks. An exploit kit has been spotted ...

Debian DSA-3267-1 : chromium-browser - security update

Several vulnerabilities were discovered in the chromium web browser. - CVE-2015-1251 SkyLined discovered a use-after-free issue in speech recognition. - CVE-2015-1252 An out-of-bounds write issue was discovered that could be used to escape from the sandbox. - CVE-2015-1253 A cross-origin bypass...

chromium-browser: Use-after-free in WebRTC.

Multiple use-after-free vulnerabilities in content/renderer/media/usermediaclientimpl.cc in the WebRTC implementation in Google Chrome before 43.0.2357.65 allow remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that executes upon...

Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2610-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2610-1 advisory. Several security issues were discovered in the DOM implementation in Blink. If a user were tricked in to opening a specially crafted website, an attacker...

USN-2610-1: Oxide vulnerabilities

Several security issues were discovered in the DOM implementation in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to bypass Same Origin Policy restrictions. CVE-2015-1253, CVE-2015-1254 A use-after-free was discovered in the...

Google Chrome WebRTC Memory Misreference Vulnerability

Google Chrome is a web browser developed by the American company Google Google. A memory misreference vulnerability exists in the WebRTC 'content/renderer/media/usermediaclientimpl.cc' file in versions of Google Chrome prior to 43.0.2357.65. A remote attacker can exploit this vulnerability to cau...

chromium: multiple issues

CVE-2015-1251 arbitrary code execution Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem allows remote attackers to execute arbitrary code via a crafted document. - CVE-2015-1252 sandbox protection bypass It has been discovered that...

Debian: Security Advisory (DSA-3267-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...