Security update for MozillaFirefox, mozilla-nss (important)

This update to Mozilla Firefox 47 fixes the following issues boo983549: Security fixes: - CVE-2016-2815/CVE-2016-2818: Miscellaneous memory safety hazards boo983638 MFSA 2016-49 - CVE-2016-2819: Buffer overflow parsing HTML5 fragments boo983655 MFSA 2016-50 - CVE-2016-2821: Use-after-free deletin...

Mozilla: Entering fullscreen and persistent pointerlock without user permission (MFSA 2016-58)

Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 do not ensure that the user approves the fullscreen and pointerlock settings, which allows remote attackers to cause a denial of service UI outage, or conduct clickjacking or spoofing attacks, via a crafted web site...

UBUNTU-CVE-2016-2831

Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 do not ensure that the user approves the fullscreen and pointerlock settings, which allows remote attackers to cause a denial of service UI outage, or conduct clickjacking or spoofing attacks, via a crafted web site...

FreeBSD : mozilla -- multiple vulnerabilities (8065d37b-8e7c-4707-a608-1b0a2b8509c3)

Mozilla Foundation reports : MFSA 2016-49 Miscellaneous memory safety hazards rv:47.0 / rv:45.2 MFSA 2016-50 Buffer overflow parsing HTML5 fragments MFSA 2016-51 Use-after-free deleting tables from a contenteditable document MFSA 2016-52 Addressbar spoofing though the SELECT element MFSA 2016-54...

Entering fullscreen and persistent pointerlock without user permission — Mozilla

Security researcher sushi Anton Larsson reported that when paired fullscreen and pointerlock requests are done in combination with closing windows, a pointerlock can be created within a fullscreen window without user permission. This pointerlock cannot then be cancelled without terminating the...

Mozilla Firefox for Android < 42.0 Multiple Vulnerabilities

Binary data 9019.prm...

Mozilla Firefox Address Bar Forgery Vulnerability (CNVD-2015-07429)

Mozilla Firefox is an open source web browser. Mozilla Firefox does not ensure that the address bar is restored when exiting fullscreen-mode, allowing remote attackers to spoof the address bar with specially crafted JavaScript code...

CVE-2015-7185

Mozilla Firefox before 42.0 on Android does not ensure that the address bar is restored upon fullscreen-mode exit, which allows remote attackers to spoof the address bar via crafted JavaScript code...

KLA10689 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service, spoof user interface, bypass security restrictions, execute arbitrary code or obtain sensitive information. Below is a complete list of vulnerabilitie...

WordPress WPTF Image Gallery 1.03 File Download Vulnerability

WordPress WPTF Image Gallery plugin version 1.03 suffers from an arbitrary remote file download vulnerability. Title: Remote file download vulnerability in wptf-image-gallery v1.03 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-17 Download Site: https://wordpress.org/plugins/wptf-image-galler...

Google Chrome Denial of Service Vulnerability (CNVD-2015-02653)

Google Chrome is a web browser developed by the American company Google Google. Google Chrome versions prior to 42.0.2311.90 fail to ask the user before changing CONTENTSETTINGSTYPEFULLSCREEN and CONTENTSETTINGSTYPEMOUSELOCK, which could allow a remote attacker to construct an HTML document with ...

UBUNTU-CVE-2015-3336

Google Chrome before 42.0.2311.90 does not always ask the user before proceeding with CONTENTSETTINGSTYPEFULLSCREEN and CONTENTSETTINGSTYPEMOUSELOCK changes, which allows user-assisted remote attackers to cause a denial of service UI disruption by constructing a crafted HTML document containing...

WordPress Fullscreen Theme - File Upload Arbitrary Code Execution

A "themify-ajax.php" file upload arbitrary PHP code execution vulnerability was found in WordPress Fullscreen theme. Solution Update the theme...

openSUSE Security Update : opera (openSUSE-SU-2012:1702-1)

Update to 12.12 - Fixes and Stability Enhancements - New option 'Delete settings and data for all extensions' option off by default in the Delete Private Data dialog - Corrected an issue where using the 'Delete Private Data' dialog could delete extension and settings data - Redesigned the 'Delete...

openSUSE Security Update : chromium (openSUSE-SU-2012:1682-1)

Update to 25.0.1362 - Security fixes bnc794075 : - CVE-2012-5139: Use-after-free with visibility events - CVE-2012-5140: Use-after-free in URL loader - CVE-2012-5141: Limit Chromoting client plug-in instantiation. - CVE-2012-5142: Crash in history navigation. - CVE-2012-5143: Integer overflow in...

Advance Phishing Attacks using HTML5 Fullscreen API

Do your ever use YouTube Instant Search engine a really fast way to search YouTube ? That was developed by a 21 years old developer name - Feross Aboukhadijeh in 2012. Chad Hurley, CEO and co-founder of YouTube, was so impressed that he immediately offered him a job at YouTube. He a web developer...

Proof-of-Concept Exploits HTML5 Fullscreen API for Social Engineering

Independent security researcher, web designer, and Stanford Computer Science student Feross Aboukhadijeh has developed an attack concept that exploits the fullscreen application programming interface in HTML5 in order to carry out phishing attacks. The attack leverages the ‘fullscreen API’ featur...

Scientific Linux Security Update : firefox on SL5.x, SL6.x i386/x86_64 (20120314)

Mozilla Firefox is an open source web browser. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2012-0461,...

CentOS Update for firefox CESA-2012:0387 centos5

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CentOS 5 / 6 : thunderbird (CESA-2012:0388)

An updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...