Mozilla: Use-after-free while manipulating HTML media content (MFSA 2015-106)

Use-after-free vulnerability in the HTMLVideoElement interface in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via crafted JavaScript code that modifies the URI table of a media element, aka ZDI-CAN-3176...

Mozilla Firefox and Firefox ESR gfx/2d/DataSurfaceHelpers.cpp Buffer Overflow Vulnerability

Mozilla Firefox is an open source web browser. A security vulnerability exists in Mozilla Firefox gfx/2d/DataSurfaceHelpers.cpp, which allows remote attackers to crash an application or execute arbitrary code by triggering a 2D display using the CANVAS element...

Mozilla Firefox and Firefox ESR HTMLVideoElement Interface Memory Error Vulnerability

Mozilla Firefox is an open source web browser. A memory error vulnerability exists in the Mozilla Firefox HTMLVideoElement interface, which allows remote attackers to modify the JavaScript code of the media element URI form to crash the application or execute arbitrary code...

Out-of-bounds

gfx/2d/DataSurfaceHelpers.cpp in Mozilla Firefox before 41.0 on Linux improperly attempts to use the Cairo library with 32-bit color-depth surface creation followed by 16-bit color-depth surface display, which allows remote attackers to obtain sensitive information from process memory or cause a...

Design/Logic Flaw

Use-after-free vulnerability in the HTMLVideoElement interface in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via crafted JavaScript code that modifies the URI table of a media element, aka ZDI-CAN-3176...

CVE-2015-4509

Use-after-free vulnerability in the HTMLVideoElement interface in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via crafted JavaScript code that modifies the URI table of a media element, aka ZDI-CAN-3176...

Mozilla: Use-after-free while manipulating HTML media content (MFSA 2015-106)

Use-after-free vulnerability in the HTMLVideoElement interface in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via crafted JavaScript code that modifies the URI table of a media element, aka ZDI-CAN-3176...

Mozilla: Dragging and dropping images exposes final URL after redirects (MFSA 2015-110)

Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow user-assisted remote attackers to bypass intended access restrictions and discover a redirect's target URL via crafted JavaScript code that executes after a drag-and-drop action of an image into a TEXTBOX element...

PT-2015-2174

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 41.0 Description The issue is related to the improper use of the Cairo library in the gfx/2d/DataSurfaceHelpers.cpp component, which can lead to an out-of-bounds read or a denial of service. This can be...

PT-2015-2177

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 41.0 Mozilla Firefox ESR versions 38.x prior to 38.3 Description The issue is related to a lack of protection for service data, allowing a remote attacker to bypass existing access restrictions and execute a...

CVE-2015-4509

Use-after-free vulnerability in the HTMLVideoElement interface in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via crafted JavaScript code that modifies the URI table of a media element, aka ZDI-CAN-3176...

UBUNTU-CVE-2015-4509

Use-after-free vulnerability in the HTMLVideoElement interface in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via crafted JavaScript code that modifies the URI table of a media element, aka ZDI-CAN-3176...

CVE-2015-5689

ghostexp.exe in Ghost Explorer Utility in Symantec Ghost Solutions Suite GSS before 3.0 HF2 12.0.0.8010 and Symantec Deployment Solution DS before 7.6 HF4 12.0.0.7045 performs improper sign-extend operations before array-element accesses, which allows remote attackers to execute arbitrary code,...

CVE-2015-5788

The WebKit Canvas implementation in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain sensitive image information via vectors involving a CANVAS element...

CVE-2015-5788: Exposure of Sensitive Information to an Unauthorized Actor

The WebKit Canvas implementation in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain sensitive image information via vectors involving a CANVAS element...

PT-2015-7396

Name of the Vulnerable Software and Affected Versions Synology Download Station versions prior to 3.5-2962 Description A cross-site scripting XSS issue exists in the "Create download task via file upload" feature, allowing remote attackers to inject arbitrary web script or HTML via the name eleme...

Microsoft Internet Explorer Element ID Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The vulnerability relates to how...

openSUSE Security Update : MozillaFirefox (openSUSE-2015-565)

MozillaFirefox was updated to version 40.0.3 to fix two security issues and several bugs. Changes in MozillaFirefox : - update to Firefox 40.0.3 bnc943550 - Disable the asynchronous plugin initialization bmo1198590 - Fix a segmentation fault in the GStreamer support bmo1145230 - Fix a regression...

UBUNTU-CVE-2015-6820

The ffsbrapply function in libavcodec/aacsbr.c in FFmpeg before 2.7.2 does not check for a matching AAC frame syntax element before proceeding with Spectral Band Replication calculations, which allows remote attackers to cause a denial of service out-of-bounds array access or possibly have...

Debian DSA-3345-1 : iceweasel - security update

Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2015-4497 Jean-Max Reymond and Ucha Gobejishvili discovered a use-after-free vulnerability which...