CVE-2015-2716

CVE-2015-2716 is an Expat XML parser vulnerability described as an integer overflow that leads to a buffer overflow when processing large compressed XML data. Public advisories (ALAS-2020-1364, CESA-2020:1011) link this to expat, indicating a security update is required (update expat) to mitigate...

CVE-2015-0801

CVE-2015-0801 describes a cross-domain bypass of Same Origin Policy in Mozilla Firefox (and derivatives) via anchor navigation to execute JavaScript with chrome privileges. The issue affects Firefox/Firefox ESR and Thunderbird (per initial entry and IBM/Debian advisories referencing these CVEs). ...

CVE-2015-2708

CVE-2015-2708 affects Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7, with memory-safety issues in the browser engine that could allow remote attackers to cause memory corruption, crash the application, or potentially execute arbitrary code via unknown vect...

CVE-2015-0816

CVE-2015-0816 describes a privilege-escalation bypass in Mozilla Firefox and Thunderbird where resource: URLs could bypass Same Origin Policy to run arbitrary code with chrome privileges when combined with a separate SOP violation. Affected: Firefox up to 37.0 (ESR up to 31.x before 31.6) and Thu...

CVE-2015-2713

CVE-2015-2713 is a use-after-free in Mozilla Firefox (SetBreaks) affecting Firefox before 38.0, Firefox ESR before 31.7, and Thunderbird before 31.7. An attacker could craft a document with specific CSS tokens for vertical text to cause heap memory corruption, enabling remote code execution or a ...

CVE-2015-0807

CVE-2015-0807 affects Mozilla Firefox (before 37.0, and Firefox ESR 31.x before 31.6) and Thunderbird (before 31.6). The issue is in navigator.sendBeacon: after a preflight request, HTTP 30x redirects are processed, allowing bypass of CORS access-control checks and enabling cross-site request for...

CVE-2015-0813

CVE-2015-0813 is a use-after-free in Mozilla Firefox (AppendElements) triggered when processing MP3 files via the Fluendo MP3 plugin for GStreamer on Linux. This can allow remote code execution or a heap-based denial of service. Affected: Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thu...

CVE-2015-2710

CVE-2015-2710 is a memory-safety vulnerability in Mozilla Firefox and Thunderbird where the SVGTextFrame handles crafted SVG/CSS data, causing a heap-based buffer overflow. A remote attacker could potentially execute arbitrary code by enticing a user to open specially crafted content. The issue a...

CVE-2015-0815

CVE-2015-0815 affects Mozilla Firefox (pre-37.0), Firefox ESR (31.x before 31.6), and Thunderbird (before 31.6). The underlying issue is memory safety bugs in the Firefox/browser engine, with exploitation scenarios described as remote code execution or denial of service via unknown vectors. Affec...