ByteOS Network

Vulnerability Details :

CVE-2012-1128

Assigner-redhat

Assigner Org ID-53f830b8-0a3f-465b-8143-3b8a9948e749

Published At-25 Apr, 2012 | 10:00

Updated At-06 Aug, 2024 | 18:45

FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and memory corruption) or possibly execute arbitrary code via a crafted TrueType font.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:redhat

Assigner Org ID:53f830b8-0a3f-465b-8143-3b8a9948e749

Published At:25 Apr, 2012 | 10:00

Updated At:06 Aug, 2024 | 18:45

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://secunia.com/advisories/48508	third-party-advisory x_refsource_SECUNIA
http://secunia.com/advisories/48822	third-party-advisory x_refsource_SECUNIA
http://www.mandriva.com/security/advisories?name=MDVSA-2012:057	vendor-advisory x_refsource_MANDRIVA
http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html	vendor-advisory x_refsource_APPLE
http://support.apple.com/kb/HT5503	x_refsource_CONFIRM
http://www.securityfocus.com/bid/52318	vdb-entry x_refsource_BID
http://www.ubuntu.com/usn/USN-1403-1	vendor-advisory x_refsource_UBUNTU
https://bugzilla.mozilla.org/show_bug.cgi?id=733512	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2012/03/06/16	mailing-list x_refsource_MLIST
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html	vendor-advisory x_refsource_SUSE
http://secunia.com/advisories/48973	third-party-advisory x_refsource_SECUNIA
http://www.mozilla.org/security/announce/2012/mfsa2012-21.html	x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=800584	x_refsource_CONFIRM
http://www.securitytracker.com/id?1026765	vdb-entry x_refsource_SECTRACK
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00004.html	vendor-advisory x_refsource_SUSE
http://security.gentoo.org/glsa/glsa-201204-04.xml	vendor-advisory x_refsource_GENTOO

Hyperlink: http://secunia.com/advisories/48508

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://secunia.com/advisories/48822

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://www.mandriva.com/security/advisories?name=MDVSA-2012:057

Resource:

vendor-advisory

x_refsource_MANDRIVA

Hyperlink: http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html

Resource:

vendor-advisory

x_refsource_APPLE

Hyperlink: http://support.apple.com/kb/HT5503

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.securityfocus.com/bid/52318

Resource:

vdb-entry

x_refsource_BID

Hyperlink: http://www.ubuntu.com/usn/USN-1403-1

Resource:

vendor-advisory

x_refsource_UBUNTU

Hyperlink: https://bugzilla.mozilla.org/show_bug.cgi?id=733512

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.openwall.com/lists/oss-security/2012/03/06/16

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: http://secunia.com/advisories/48973

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://www.mozilla.org/security/announce/2012/mfsa2012-21.html

Resource:

x_refsource_CONFIRM

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=800584

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.securitytracker.com/id?1026765

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00004.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: http://security.gentoo.org/glsa/glsa-201204-04.xml

Resource:

vendor-advisory

x_refsource_GENTOO

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://secunia.com/advisories/48508	third-party-advisory x_refsource_SECUNIA x_transferred
http://secunia.com/advisories/48822	third-party-advisory x_refsource_SECUNIA x_transferred
http://www.mandriva.com/security/advisories?name=MDVSA-2012:057	vendor-advisory x_refsource_MANDRIVA x_transferred
http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html	vendor-advisory x_refsource_APPLE x_transferred
http://support.apple.com/kb/HT5503	x_refsource_CONFIRM x_transferred
http://www.securityfocus.com/bid/52318	vdb-entry x_refsource_BID x_transferred
http://www.ubuntu.com/usn/USN-1403-1	vendor-advisory x_refsource_UBUNTU x_transferred
https://bugzilla.mozilla.org/show_bug.cgi?id=733512	x_refsource_CONFIRM x_transferred
http://www.openwall.com/lists/oss-security/2012/03/06/16	mailing-list x_refsource_MLIST x_transferred
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html	vendor-advisory x_refsource_SUSE x_transferred
http://secunia.com/advisories/48973	third-party-advisory x_refsource_SECUNIA x_transferred
http://www.mozilla.org/security/announce/2012/mfsa2012-21.html	x_refsource_CONFIRM x_transferred
https://bugzilla.redhat.com/show_bug.cgi?id=800584	x_refsource_CONFIRM x_transferred
http://www.securitytracker.com/id?1026765	vdb-entry x_refsource_SECTRACK x_transferred
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00004.html	vendor-advisory x_refsource_SUSE x_transferred
http://security.gentoo.org/glsa/glsa-201204-04.xml	vendor-advisory x_refsource_GENTOO x_transferred

Hyperlink: http://secunia.com/advisories/48508

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Hyperlink: http://secunia.com/advisories/48822

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Hyperlink: http://www.mandriva.com/security/advisories?name=MDVSA-2012:057

Resource:

vendor-advisory

x_refsource_MANDRIVA

x_transferred

Hyperlink: http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html

Resource:

vendor-advisory

x_refsource_APPLE

x_transferred

Hyperlink: http://support.apple.com/kb/HT5503

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.securityfocus.com/bid/52318

Resource:

vdb-entry

x_refsource_BID

x_transferred

Hyperlink: http://www.ubuntu.com/usn/USN-1403-1

Resource:

vendor-advisory

x_refsource_UBUNTU

x_transferred

Hyperlink: https://bugzilla.mozilla.org/show_bug.cgi?id=733512

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.openwall.com/lists/oss-security/2012/03/06/16

Resource:

mailing-list

x_refsource_MLIST

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html

Resource:

vendor-advisory

x_refsource_SUSE

x_transferred

Hyperlink: http://secunia.com/advisories/48973

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Hyperlink: http://www.mozilla.org/security/announce/2012/mfsa2012-21.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=800584

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.securitytracker.com/id?1026765

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00004.html

Resource:

vendor-advisory

x_refsource_SUSE

x_transferred

Hyperlink: http://security.gentoo.org/glsa/glsa-201204-04.xml

Resource:

vendor-advisory

x_refsource_GENTOO

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert@redhat.com

Published At:25 Apr, 2012 | 10:10

Updated At:11 Apr, 2025 | 00:51

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C

Type: Primary

Version: 2.0

Base score: 9.3

Base severity: HIGH

Vector:

AV:N/AC:M/Au:N/C:C/I:C/A:C

CPE Matches

freetype>>freetype>>Versions up to 2.4.8(inclusive)

cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*

freetype>>freetype>>1.3.1

cpe:2.3:a:freetype:freetype:1.3.1:*:*:*:*:*:*:*

freetype>>freetype>>2.0.0

cpe:2.3:a:freetype:freetype:2.0.0:*:*:*:*:*:*:*

freetype>>freetype>>2.0.1

cpe:2.3:a:freetype:freetype:2.0.1:*:*:*:*:*:*:*

freetype>>freetype>>2.0.2

cpe:2.3:a:freetype:freetype:2.0.2:*:*:*:*:*:*:*

freetype>>freetype>>2.0.3

cpe:2.3:a:freetype:freetype:2.0.3:*:*:*:*:*:*:*

freetype>>freetype>>2.0.4

cpe:2.3:a:freetype:freetype:2.0.4:*:*:*:*:*:*:*

freetype>>freetype>>2.0.5

cpe:2.3:a:freetype:freetype:2.0.5:*:*:*:*:*:*:*

freetype>>freetype>>2.0.6

cpe:2.3:a:freetype:freetype:2.0.6:*:*:*:*:*:*:*

freetype>>freetype>>2.0.7

cpe:2.3:a:freetype:freetype:2.0.7:*:*:*:*:*:*:*

freetype>>freetype>>2.0.8

cpe:2.3:a:freetype:freetype:2.0.8:*:*:*:*:*:*:*

freetype>>freetype>>2.0.9

cpe:2.3:a:freetype:freetype:2.0.9:*:*:*:*:*:*:*

freetype>>freetype>>2.1

cpe:2.3:a:freetype:freetype:2.1:*:*:*:*:*:*:*

freetype>>freetype>>2.1.3

cpe:2.3:a:freetype:freetype:2.1.3:*:*:*:*:*:*:*

freetype>>freetype>>2.1.4

cpe:2.3:a:freetype:freetype:2.1.4:*:*:*:*:*:*:*

freetype>>freetype>>2.1.5

cpe:2.3:a:freetype:freetype:2.1.5:*:*:*:*:*:*:*

freetype>>freetype>>2.1.6

cpe:2.3:a:freetype:freetype:2.1.6:*:*:*:*:*:*:*

freetype>>freetype>>2.1.7

cpe:2.3:a:freetype:freetype:2.1.7:*:*:*:*:*:*:*

freetype>>freetype>>2.1.8

cpe:2.3:a:freetype:freetype:2.1.8:*:*:*:*:*:*:*

freetype>>freetype>>2.1.8

cpe:2.3:a:freetype:freetype:2.1.8:rc1:*:*:*:*:*:*

freetype>>freetype>>2.1.9

cpe:2.3:a:freetype:freetype:2.1.9:*:*:*:*:*:*:*

freetype>>freetype>>2.1.10

cpe:2.3:a:freetype:freetype:2.1.10:*:*:*:*:*:*:*

freetype>>freetype>>2.2.0

cpe:2.3:a:freetype:freetype:2.2.0:*:*:*:*:*:*:*

freetype>>freetype>>2.2.1

cpe:2.3:a:freetype:freetype:2.2.1:*:*:*:*:*:*:*

freetype>>freetype>>2.3.0

cpe:2.3:a:freetype:freetype:2.3.0:*:*:*:*:*:*:*

freetype>>freetype>>2.3.1

cpe:2.3:a:freetype:freetype:2.3.1:*:*:*:*:*:*:*

freetype>>freetype>>2.3.2

cpe:2.3:a:freetype:freetype:2.3.2:*:*:*:*:*:*:*

freetype>>freetype>>2.3.3

cpe:2.3:a:freetype:freetype:2.3.3:*:*:*:*:*:*:*

freetype>>freetype>>2.3.4

cpe:2.3:a:freetype:freetype:2.3.4:*:*:*:*:*:*:*

freetype>>freetype>>2.3.5

cpe:2.3:a:freetype:freetype:2.3.5:*:*:*:*:*:*:*

freetype>>freetype>>2.3.6

cpe:2.3:a:freetype:freetype:2.3.6:*:*:*:*:*:*:*

freetype>>freetype>>2.3.7

cpe:2.3:a:freetype:freetype:2.3.7:*:*:*:*:*:*:*

freetype>>freetype>>2.3.8

cpe:2.3:a:freetype:freetype:2.3.8:*:*:*:*:*:*:*

freetype>>freetype>>2.3.9

cpe:2.3:a:freetype:freetype:2.3.9:*:*:*:*:*:*:*

freetype>>freetype>>2.3.10

cpe:2.3:a:freetype:freetype:2.3.10:*:*:*:*:*:*:*

freetype>>freetype>>2.3.11

cpe:2.3:a:freetype:freetype:2.3.11:*:*:*:*:*:*:*

freetype>>freetype>>2.3.12

cpe:2.3:a:freetype:freetype:2.3.12:*:*:*:*:*:*:*

freetype>>freetype>>2.4.0

cpe:2.3:a:freetype:freetype:2.4.0:*:*:*:*:*:*:*

freetype>>freetype>>2.4.1

cpe:2.3:a:freetype:freetype:2.4.1:*:*:*:*:*:*:*

freetype>>freetype>>2.4.2

cpe:2.3:a:freetype:freetype:2.4.2:*:*:*:*:*:*:*

freetype>>freetype>>2.4.3

cpe:2.3:a:freetype:freetype:2.4.3:*:*:*:*:*:*:*

freetype>>freetype>>2.4.4

cpe:2.3:a:freetype:freetype:2.4.4:*:*:*:*:*:*:*

freetype>>freetype>>2.4.5

cpe:2.3:a:freetype:freetype:2.4.5:*:*:*:*:*:*:*

freetype>>freetype>>2.4.6

cpe:2.3:a:freetype:freetype:2.4.6:*:*:*:*:*:*:*

freetype>>freetype>>2.4.7

cpe:2.3:a:freetype:freetype:2.4.7:*:*:*:*:*:*:*

Mozilla Corporation

>>firefox_mobile>>Versions up to 10.0.3(inclusive)

cpe:2.3:a:mozilla:firefox_mobile:*:*:*:*:*:*:*:*

Mozilla Corporation

>>firefox_mobile>>1.0

cpe:2.3:a:mozilla:firefox_mobile:1.0:*:*:*:*:*:*:*

Mozilla Corporation

>>firefox_mobile>>4.0

cpe:2.3:a:mozilla:firefox_mobile:4.0:*:*:*:*:*:*:*

Mozilla Corporation

>>firefox_mobile>>4.0

cpe:2.3:a:mozilla:firefox_mobile:4.0:beta1:*:*:*:*:*:*

Mozilla Corporation

>>firefox_mobile>>4.0

cpe:2.3:a:mozilla:firefox_mobile:4.0:beta2:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-119	Primary	nvd@nist.gov

CWE ID: CWE-119

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html	secalert@redhat.com	N/A
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html	secalert@redhat.com	N/A
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00004.html	secalert@redhat.com	N/A
http://secunia.com/advisories/48508	secalert@redhat.com	N/A
http://secunia.com/advisories/48822	secalert@redhat.com	N/A
http://secunia.com/advisories/48973	secalert@redhat.com	N/A
http://security.gentoo.org/glsa/glsa-201204-04.xml	secalert@redhat.com	N/A
http://support.apple.com/kb/HT5503	secalert@redhat.com	N/A
http://www.mandriva.com/security/advisories?name=MDVSA-2012:057	secalert@redhat.com	N/A
http://www.mozilla.org/security/announce/2012/mfsa2012-21.html	secalert@redhat.com	Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/03/06/16	secalert@redhat.com	N/A
http://www.securityfocus.com/bid/52318	secalert@redhat.com	N/A
http://www.securitytracker.com/id?1026765	secalert@redhat.com	N/A
http://www.ubuntu.com/usn/USN-1403-1	secalert@redhat.com	N/A
https://bugzilla.mozilla.org/show_bug.cgi?id=733512	secalert@redhat.com	N/A
https://bugzilla.redhat.com/show_bug.cgi?id=800584	secalert@redhat.com	N/A
http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00004.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://secunia.com/advisories/48508	af854a3a-2127-422b-91ae-364da2661108	N/A
http://secunia.com/advisories/48822	af854a3a-2127-422b-91ae-364da2661108	N/A
http://secunia.com/advisories/48973	af854a3a-2127-422b-91ae-364da2661108	N/A
http://security.gentoo.org/glsa/glsa-201204-04.xml	af854a3a-2127-422b-91ae-364da2661108	N/A
http://support.apple.com/kb/HT5503	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.mandriva.com/security/advisories?name=MDVSA-2012:057	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.mozilla.org/security/announce/2012/mfsa2012-21.html	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/03/06/16	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securityfocus.com/bid/52318	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securitytracker.com/id?1026765	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.ubuntu.com/usn/USN-1403-1	af854a3a-2127-422b-91ae-364da2661108	N/A
https://bugzilla.mozilla.org/show_bug.cgi?id=733512	af854a3a-2127-422b-91ae-364da2661108	N/A
https://bugzilla.redhat.com/show_bug.cgi?id=800584	af854a3a-2127-422b-91ae-364da2661108	N/A

Hyperlink: http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html

Source: secalert@redhat.com

Resource: N/A

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html

Source: secalert@redhat.com

Resource: N/A

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00004.html

Source: secalert@redhat.com

Resource: N/A

Hyperlink: http://secunia.com/advisories/48508

Source: secalert@redhat.com

Resource: N/A

Hyperlink: http://secunia.com/advisories/48822

Source: secalert@redhat.com

Resource: N/A

Hyperlink: http://secunia.com/advisories/48973

Source: secalert@redhat.com

Resource: N/A

Hyperlink: http://security.gentoo.org/glsa/glsa-201204-04.xml

Source: secalert@redhat.com

Resource: N/A

Hyperlink: http://support.apple.com/kb/HT5503

Source: secalert@redhat.com

Resource: N/A

Hyperlink: http://www.mandriva.com/security/advisories?name=MDVSA-2012:057

Source: secalert@redhat.com

Resource: N/A

Hyperlink: http://www.mozilla.org/security/announce/2012/mfsa2012-21.html

Source: secalert@redhat.com

Resource:

Vendor Advisory

Hyperlink: http://www.openwall.com/lists/oss-security/2012/03/06/16

Source: secalert@redhat.com

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/52318

Source: secalert@redhat.com

Resource: N/A

Hyperlink: http://www.securitytracker.com/id?1026765

Source: secalert@redhat.com

Resource: N/A

Hyperlink: http://www.ubuntu.com/usn/USN-1403-1

Source: secalert@redhat.com

Resource: N/A

Hyperlink: https://bugzilla.mozilla.org/show_bug.cgi?id=733512

Source: secalert@redhat.com

Resource: N/A

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=800584

Source: secalert@redhat.com

Resource: N/A

Hyperlink: http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00004.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://secunia.com/advisories/48508

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://secunia.com/advisories/48822

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://secunia.com/advisories/48973

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://security.gentoo.org/glsa/glsa-201204-04.xml

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://support.apple.com/kb/HT5503

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.mandriva.com/security/advisories?name=MDVSA-2012:057

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.mozilla.org/security/announce/2012/mfsa2012-21.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Hyperlink: http://www.openwall.com/lists/oss-security/2012/03/06/16

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/52318

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.securitytracker.com/id?1026765

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.ubuntu.com/usn/USN-1403-1

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://bugzilla.mozilla.org/show_bug.cgi?id=733512

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=800584

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Similar CVEs

3209Records found

CVE-2014-1518

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-8.8||HIGH

EPSS-2.82% / 85.59%

7 Day CHG~0.00%

Published-30 Apr, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2014-1556

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-0.52% / 65.84%

7 Day CHG~0.00%

Published-23 Jul, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to execute arbitrary code via crafted WebGL content constructed with the Cesium JavaScript library.

Vendor-n/a Mozilla Corporation

Product-firefox firefox_esr thunderbird n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2014-1522

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-0.53% / 66.33%

7 Day CHG~0.00%

Published-30 Apr, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via crafted content.

Vendor-n/a Mozilla Corporation openSUSE Fedora Project Canonical Ltd.

Product-fedora opensuse firefox seamonkey ubuntu_linux n/a

CWE ID-CWE-125

Out-of-bounds Read

CVE-2014-1494

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-0.48% / 64.33%

7 Day CHG+0.10%

Published-19 Mar, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Vendor-n/a Mozilla Corporation openSUSE SUSE Oracle Corporation

Product-solaris firefox seamonkey opensuse linux_enterprise_desktop linux_enterprise_server linux_enterprise_software_development_kit n/a

CVE-2014-1531

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-8.8||HIGH

EPSS-1.72% / 81.64%

7 Day CHG~0.00%

Published-30 Apr, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving an imgLoader object that is not properly handled during an image-resize operation.

CWE ID-CWE-416

Use After Free

CVE-2014-1513

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-8.8||HIGH

EPSS-2.02% / 83.04%

7 Day CHG+0.42%

Published-19 Mar, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

TypedArrayObject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not prevent a zero-length transition during use of an ArrayBuffer object, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based out-of-bounds write or read) via a crafted web site.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2014-1567

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-1.80% / 82.07%

7 Day CHG~0.00%

Published-03 Sep, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout.

Vendor-n/a Mozilla Corporation

Product-firefox firefox_esr thunderbird n/a

CVE-2014-1557

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-1.51% / 80.43%

7 Day CHG~0.00%

Published-23 Jul, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

The ConvolveHorizontally function in Skia, as used in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, does not properly handle the discarding of image data during function execution, which allows remote attackers to execute arbitrary code by triggering prolonged image scaling, as demonstrated by scaling of a high-quality image.

Vendor-n/a Mozilla Corporation Debian GNU/Linux Oracle Corporation

Product-solaris firefox firefox_esr thunderbird debian_linux n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2020-15659

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-8.8||HIGH

EPSS-0.78% / 72.74%

7 Day CHG~0.00%

Published-10 Aug, 2020 | 17:43

Updated-04 Aug, 2024 | 13:22

Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1.

Vendor-Canonical Ltd.openSUSE Mozilla Corporation

Product-ubuntu_linux thunderbird firefox firefox_esr leap Firefox Firefox ESR Thunderbird

CWE ID-CWE-787

Out-of-bounds Write

CVE-2013-1674

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-4.03% / 88.03%

7 Day CHG~0.00%

Published-16 May, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code via vectors involving an onresize event during the playing of a video.

Vendor-n/a Mozilla Corporation

Product-thunderbird_esr firefox thunderbird n/a

CVE-2013-1735

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-4.50% / 88.69%

7 Day CHG~0.00%

Published-18 Sep, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the mozilla::layout::ScrollbarActivity function in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code via vectors related to image-document scrolling.

Vendor-n/a Mozilla Corporation

Product-thunderbird_esr firefox seamonkey thunderbird n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2013-1697

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-1.91% / 82.53%

7 Day CHG~0.00%

Published-26 Jun, 2013 | 01:00

Updated-11 Apr, 2025 | 00:51

The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method.

Vendor-n/a Mozilla Corporation

Product-thunderbird_esr firefox thunderbird n/a

CVE-2013-1722

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-3.86% / 87.76%

7 Day CHG~0.00%

Published-18 Sep, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the nsAnimationManager::BuildAnimations function in the Animation Manager in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving stylesheet cloning.

Vendor-n/a Mozilla Corporation

Product-thunderbird_esr firefox seamonkey thunderbird n/a

CVE-2013-0761

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-1.71% / 81.59%

7 Day CHG~0.00%

Published-13 Jan, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the mozilla::TrackUnionStream::EndTrack implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

Vendor-n/a SUSE Canonical Ltd.Mozilla Corporation openSUSE

Product-linux_enterprise_server linux_enterprise_software_development_kit ubuntu_linux thunderbird_esr seamonkey thunderbird linux_enterprise_desktop firefox opensuse n/a

CWE ID-CWE-416

Use After Free

CVE-2013-1685

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-0.56% / 67.28%

7 Day CHG~0.00%

Published-26 Jun, 2013 | 01:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the nsIDocument::GetRootElement function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted web site.

Vendor-n/a Mozilla Corporation

Product-thunderbird_esr firefox thunderbird n/a

CVE-2013-1738

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-3.36% / 86.84%

7 Day CHG~0.00%

Published-18 Sep, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the JS_GetGlobalForScopeChain function in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code by leveraging incorrect garbage collection in situations involving default compartments and frame-chain restoration.

Vendor-n/a Mozilla Corporation

Product-firefox seamonkey thunderbird n/a

CVE-2013-0744

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-13.45% / 93.94%

7 Day CHG~0.00%

Published-13 Jan, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the TableBackgroundPainter::TableBackgroundData::Destroy function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an HTML document with a table containing many columns and column groups.

CWE ID-CWE-416

Use After Free

CVE-2013-1688

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-1.20% / 78.06%

7 Day CHG~0.00%

Published-26 Jun, 2013 | 01:00

Updated-11 Apr, 2025 | 00:51

The Profiler implementation in Mozilla Firefox before 22.0 parses untrusted data during UI rendering, which allows user-assisted remote attackers to execute arbitrary JavaScript code via a crafted web site.

Vendor-n/a Mozilla Corporation

Product-firefox n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2013-1724

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-3.16% / 86.40%

7 Day CHG~0.00%

Published-18 Sep, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the mozilla::dom::HTMLFormElement::IsDefaultSubmitElement function in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving a destroyed SELECT element.

Vendor-n/a Mozilla Corporation

Product-firefox seamonkey thunderbird n/a

CVE-2013-1684

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-0.56% / 67.28%

7 Day CHG~0.00%

Published-26 Jun, 2013 | 01:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the mozilla::dom::HTMLMediaElement::LookupMediaElementURITable function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted web site.

Vendor-n/a Mozilla Corporation

Product-thunderbird_esr firefox thunderbird n/a

CVE-2013-0763

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-1.11% / 77.22%

7 Day CHG~0.00%

Published-13 Jan, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to Mesa drivers and a resized WebGL canvas.

CWE ID-CWE-416

Use After Free

CVE-2013-1687

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-1.91% / 82.53%

7 Day CHG~0.00%

Published-26 Jun, 2013 | 01:00

Updated-11 Apr, 2025 | 00:51

The System Only Wrapper (SOW) and Chrome Object Wrapper (COW) implementations in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly restrict XBL user-defined functions, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges, or conduct cross-site scripting (XSS) attacks, via a crafted web site.

Vendor-n/a Mozilla Corporation

Product-thunderbird_esr firefox thunderbird n/a

CVE-2013-1704

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-4.70% / 88.94%

7 Day CHG~0.00%

Published-07 Aug, 2013 | 01:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the nsINode::GetParentNode function in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via vectors involving a DOM modification at the time of a SetBody mutation event.

Vendor-n/a Mozilla Corporation

Product-firefox seamonkey n/a

CVE-2013-0787

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-3.36% / 86.84%

7 Day CHG~0.00%

Published-11 Mar, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the nsEditor::IsPreformatted function in editor/libeditor/base/nsEditor.cpp in Mozilla Firefox before 19.0.2, Firefox ESR 17.x before 17.0.4, Thunderbird before 17.0.4, Thunderbird ESR 17.x before 17.0.4, and SeaMonkey before 2.16.1 allows remote attackers to execute arbitrary code via vectors involving an execCommand call.

Vendor-n/a Mozilla Corporation

Product-thunderbird_esr firefox seamonkey thunderbird n/a

CVE-2013-0784

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-0.90% / 74.76%

7 Day CHG+0.26%

Published-19 Feb, 2013 | 23:00

Updated-11 Apr, 2025 | 00:51

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Vendor-n/a Mozilla Corporation openSUSE Canonical Ltd.

Product-thunderbird_esr firefox seamonkey opensuse ubuntu_linux thunderbird n/a

CVE-2013-0753

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-88.06% / 99.45%

7 Day CHG~0.00%

Published-13 Jan, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via crafted web content.

CWE ID-CWE-416

Use After Free

CVE-2013-0764

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-1.50% / 80.36%

7 Day CHG~0.00%

Published-13 Jan, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

The nsSOCKSSocketInfo::ConnectToProxy function in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not ensure thread safety for SSL sessions, which allows remote attackers to execute arbitrary code via crafted data, as demonstrated by e-mail message data.

Vendor-n/a SUSE Canonical Ltd.Mozilla Corporation openSUSE

Product-linux_enterprise_server linux_enterprise_software_development_kit ubuntu_linux thunderbird_esr seamonkey thunderbird linux_enterprise_desktop firefox opensuse n/a

CWE ID-CWE-326

Inadequate Encryption Strength

CVE-2013-0770

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-0.94% / 75.28%

7 Day CHG~0.00%

Published-13 Jan, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 18.0, Thunderbird before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Vendor-n/a SUSE Canonical Ltd.Mozilla Corporation openSUSE

Product-linux_enterprise_server linux_enterprise_software_development_kit ubuntu_linux thunderbird_esr seamonkey thunderbird linux_enterprise_desktop firefox opensuse n/a

CVE-2013-0773

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-1.52% / 80.51%

7 Day CHG+0.43%

Published-19 Feb, 2013 | 23:00

Updated-11 Apr, 2025 | 00:51

The Chrome Object Wrapper (COW) and System Only Wrapper (SOW) implementations in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 do not prevent modifications to a prototype, which allows remote attackers to obtain sensitive information from chrome objects or possibly execute arbitrary JavaScript code with chrome privileges via a crafted web site.

Vendor-n/a Mozilla Corporation openSUSE Debian GNU/Linux Canonical Ltd.

Product-thunderbird_esr firefox seamonkey opensuse ubuntu_linux thunderbird debian_linux n/a

CVE-2013-0758

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-87.37% / 99.42%

7 Day CHG~0.00%

Published-13 Jan, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging improper interaction between plugin objects and SVG elements.

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2013-0765

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-1.42% / 79.82%

7 Day CHG~0.00%

Published-19 Feb, 2013 | 23:00

Updated-11 Apr, 2025 | 00:51

Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 do not prevent multiple wrapping of WebIDL objects, which allows remote attackers to bypass intended access restrictions via unspecified vectors.

Vendor-n/a Mozilla Corporation openSUSE Canonical Ltd.

Product-firefox seamonkey opensuse ubuntu_linux n/a

CVE-2012-3990

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-5.47% / 89.82%

7 Day CHG~0.00%

Published-10 Oct, 2012 | 17:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the IME State Manager implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors, related to the nsIContent::GetNameSpaceID function.

CWE ID-CWE-416

Use After Free

CVE-2013-0778

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-1.56% / 80.73%

7 Day CHG~0.00%

Published-19 Feb, 2013 | 23:00

Updated-11 Apr, 2025 | 00:51

The ClusterIterator::NextCluster function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.

Vendor-n/a Mozilla Corporation openSUSE Canonical Ltd.

Product-thunderbird_esr firefox seamonkey opensuse ubuntu_linux thunderbird n/a

CWE ID-CWE-125

Out-of-bounds Read

CVE-2013-0760

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-3.15% / 86.38%

7 Day CHG~0.00%

Published-13 Jan, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

Buffer overflow in the CharDistributionAnalysis::HandleOneChar function in Mozilla Firefox before 18.0, Thunderbird before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted document.

Vendor-n/a SUSE Canonical Ltd.Mozilla Corporation openSUSE

Product-linux_enterprise_server linux_enterprise_software_development_kit ubuntu_linux thunderbird_esr seamonkey thunderbird linux_enterprise_desktop firefox opensuse n/a

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2013-0781

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-1.56% / 80.73%

7 Day CHG~0.00%

Published-19 Feb, 2013 | 23:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the nsPrintEngine::CommonPrint function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

Vendor-n/a Mozilla Corporation openSUSE Canonical Ltd.

Product-thunderbird_esr firefox seamonkey opensuse ubuntu_linux thunderbird n/a

CWE ID-CWE-416

Use After Free

CVE-2012-4179

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-5.47% / 89.82%

7 Day CHG~0.00%

Published-10 Oct, 2012 | 17:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the nsHTMLCSSUtils::CreateCSSPropertyTxn function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CWE ID-CWE-416

Use After Free

CVE-2013-0757

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-74.57% / 98.80%

7 Day CHG~0.00%

Published-13 Jan, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not prevent modifications to the prototype of an object, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by referencing Object.prototype.__proto__ in a crafted HTML document.

Vendor-n/a SUSE Canonical Ltd.Mozilla Corporation openSUSE

Product-linux_enterprise_server linux_enterprise_software_development_kit ubuntu_linux thunderbird_esr seamonkey thunderbird linux_enterprise_desktop firefox opensuse n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2013-0780

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-2.15% / 83.54%

7 Day CHG+0.60%

Published-19 Feb, 2013 | 23:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the nsOverflowContinuationTracker::Finish function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted document that uses Cascading Style Sheets (CSS) -moz-column-* properties.

Vendor-n/a Mozilla Corporation openSUSE Red Hat, Inc.Debian GNU/Linux Canonical Ltd.

Product-enterprise_linux_server thunderbird_esr firefox seamonkey opensuse enterprise_linux_aus enterprise_linux_desktop enterprise_linux_eus ubuntu_linux enterprise_linux_workstation thunderbird debian_linux n/a

CWE ID-CWE-416

Use After Free

CVE-2013-0782

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-2.89% / 85.79%

7 Day CHG~0.00%

Published-19 Feb, 2013 | 23:00

Updated-11 Apr, 2025 | 00:51

Heap-based buffer overflow in the nsSaveAsCharset::DoCharsetConversion function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code via unspecified vectors.

Vendor-n/a Mozilla Corporation openSUSE Red Hat, Inc.Debian GNU/Linux Canonical Ltd.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2013-0783

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-1.21% / 78.12%

7 Day CHG+0.34%

Published-19 Feb, 2013 | 23:00

Updated-11 Apr, 2025 | 00:51

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Vendor-n/a Mozilla Corporation openSUSE Red Hat, Inc.Debian GNU/Linux Canonical Ltd.

CVE-2013-0755

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-2.67% / 85.23%

7 Day CHG~0.00%

Published-13 Jan, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the mozVibrate implementation in the Vibrate library in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via vectors related to the domDoc pointer.

Vendor-n/a SUSE Canonical Ltd.Mozilla Corporation openSUSE

Product-linux_enterprise_server linux_enterprise_software_development_kit ubuntu_linux thunderbird_esr seamonkey thunderbird linux_enterprise_desktop firefox opensuse n/a

CWE ID-CWE-416

Use After Free

CVE-2013-0779

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-2.36% / 84.31%

7 Day CHG~0.00%

Published-19 Feb, 2013 | 23:00

Updated-11 Apr, 2025 | 00:51

The nsCodingStateMachine::NextState function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.

Vendor-n/a Mozilla Corporation openSUSE Canonical Ltd.

Product-thunderbird_esr firefox seamonkey opensuse ubuntu_linux thunderbird n/a

CWE ID-CWE-125

Out-of-bounds Read

CVE-2013-0769

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-1.15% / 77.58%

7 Day CHG~0.00%

Published-13 Jan, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2013-0756

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-1.38% / 79.47%

7 Day CHG~0.00%

Published-13 Jan, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the obj_toSource function in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted web page referencing JavaScript Proxy objects that are not properly handled during garbage collection.

Vendor-n/a SUSE Canonical Ltd.Mozilla Corporation openSUSE

Product-linux_enterprise_server linux_enterprise_software_development_kit ubuntu_linux thunderbird_esr seamonkey thunderbird linux_enterprise_desktop firefox opensuse n/a

CWE ID-CWE-416

Use After Free

CVE-2013-0754

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-2.83% / 85.64%

7 Day CHG~0.00%

Published-13 Jan, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the ListenerManager implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via vectors involving the triggering of garbage collection after memory allocation for listener objects.

CWE ID-CWE-416

Use After Free

CVE-2013-0762

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-2.67% / 85.22%

7 Day CHG~0.00%

Published-13 Jan, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the imgRequest::OnStopFrame function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CWE ID-CWE-416

Use After Free

CVE-2013-0777

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-1.40% / 79.63%

7 Day CHG~0.00%

Published-19 Feb, 2013 | 23:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in the nsDisplayBoxShadowOuter::Paint function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

Vendor-n/a Mozilla Corporation openSUSE Canonical Ltd.

Product-thunderbird_esr firefox seamonkey opensuse ubuntu_linux thunderbird n/a

CWE ID-CWE-416

Use After Free

CVE-2013-0745

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-3.15% / 86.39%

7 Day CHG~0.00%

Published-13 Jan, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

The AutoWrapperChanger class in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not properly interact with garbage collection, which allows remote attackers to execute arbitrary code via a crafted HTML document referencing JavaScript objects.

Vendor-n/a SUSE Canonical Ltd.Mozilla Corporation openSUSE

Product-linux_enterprise_server linux_enterprise_software_development_kit ubuntu_linux thunderbird_esr seamonkey thunderbird linux_enterprise_desktop firefox opensuse n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2013-0746

Matching Score-8

Assigner-Mozilla Corporation

View Details

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-9.3||HIGH

EPSS-2.36% / 84.30%

7 Day CHG~0.00%

Published-13 Jan, 2013 | 20:00

Updated-11 Apr, 2025 | 00:51

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 do not properly implement quickstubs that use the jsval data type for their return values, which allows remote attackers to execute arbitrary code or cause a denial of service (compartment mismatch and application crash) via crafted JavaScript code that is not properly handled during garbage collection.

CVE-2012-5839

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-5.21% / 89.55%

7 Day CHG~0.00%

Published-21 Nov, 2012 | 11:00

Updated-11 Apr, 2025 | 00:51

Heap-based buffer overflow in the gfxShapedWord::CompressedGlyph::IsClusterStart function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code via unspecified vectors.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2012-1128

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs