Mozilla Firefox — свободный браузер на движке Gecko
Релизный цикл, информация об уязвимостях
График релизов
Релизные элементы
| KB | Версия | Билд | Дата доступности |
|---|---|---|---|
| 138.0.4 | 138.0.4 | ||
| 138.0.3 | 138.0.3 | ||
| 138.0.1 | 138.0.1 | ||
| 138.0 | 138.0 |
Показывать по
Количество 17 337
CVE-2015-0804
The HTMLSourceElement::BindToTree function in Mozilla Firefox before 3 ...
CVE-2015-0804
The HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does not properly constrain a data type after omitting namespace validation during certain tree-binding operations, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document containing a SOURCE element.
CVE-2015-0803
The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before ...
CVE-2015-0803
The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does not properly constrain the original data type of a casted value during the setting of a SOURCE element's attributes, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document.
CVE-2015-0802
Mozilla Firefox before 37.0 relies on docshell type information instea ...
CVE-2015-0802
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods.
CVE-2015-0801
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunder ...
CVE-2015-0801
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818.
CVE-2015-0800
The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fe ...
CVE-2015-0800
The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a related issue to CVE-2012-2808.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
| CVE-2015-0804 The HTMLSourceElement::BindToTree function in Mozilla Firefox before 3 ... | CVSS2: 7.5 | 4% Низкий | больше 11 лет назад |
 | CVE-2015-0804 The HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does not properly constrain a data type after omitting namespace validation during certain tree-binding operations, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document containing a SOURCE element. | CVSS2: 7.5 | 4% Низкий | больше 11 лет назад |
| CVE-2015-0803 The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before ... | CVSS2: 7.5 | 4% Низкий | больше 11 лет назад |
| CVE-2015-0803 The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does not properly constrain the original data type of a casted value during the setting of a SOURCE element's attributes, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document. | CVSS2: 7.5 | 4% Низкий | больше 11 лет назад |
| CVE-2015-0802 Mozilla Firefox before 37.0 relies on docshell type information instea ... | CVSS2: 5 | 67% Средний | больше 11 лет назад |
| CVE-2015-0802 Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods. | CVSS2: 5 | 67% Средний | больше 11 лет назад |
| CVE-2015-0801 Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunder ... | CVSS2: 7.5 | 3% Низкий | больше 11 лет назад |
| CVE-2015-0801 Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818. | CVSS2: 7.5 | 3% Низкий | больше 11 лет назад |
| CVE-2015-0800 The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fe ... | CVSS2: 5 | 2% Низкий | больше 11 лет назад |
| CVE-2015-0800 The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a related issue to CVE-2012-2808. | CVSS2: 5 | 2% Низкий | больше 11 лет назад |
Уязвимостей на страницу