2012-10-10 - CVE Archive

CVE-2012-3993 Oct 10, 17:55 CRITICAL POC THREAT Emergency

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 80.8%.

Privilege Escalation Chrome Google Mozilla Firefox +3

NVD Exploit-DB

CVSS 2.0

9.3

EPSS

80.8%

Threat

5.8

CVE-2012-4188 Oct 10, 17:55 CRITICAL Emergency

Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 52.5% and no vendor patch available.

RCE Buffer Overflow Debian Red Hat Mozilla +15

NVD

CVSS 2.0

9.3

EPSS

52.5%

CVE-2012-4186 Oct 10, 17:55 CRITICAL Emergency

Heap-based buffer overflow in the nsWaveReader::DecodeAudioData function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8,. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 52.5% and no vendor patch available.

RCE Buffer Overflow Debian Red Hat Mozilla +15

NVD

CVSS 2.0

9.3

EPSS

52.5%

CVE-2012-4187 Oct 10, 17:55 CRITICAL Act Now

Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly manage a certain insPos variable,. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 20.0% and no vendor patch available.

RCE Buffer Overflow Denial Of Service Red Hat Mozilla +14

NVD

CVSS 2.0

9.3

EPSS

20.0%

CVE-2012-4180 Oct 10, 17:55 CRITICAL Act Now

Heap-based buffer overflow in the nsHTMLEditor::IsPrevCharInNodeWhitespace function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.

RCE Buffer Overflow Debian Red Hat Mozilla +15

NVD

CVSS 2.0

9.3

EPSS

9.5%

CVE-2012-4179 Oct 10, 17:55 CRITICAL Act Now

Use-after-free vulnerability in the nsHTMLCSSUtils::CreateCSSPropertyTxn function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.

RCE Buffer Overflow Denial Of Service Use After Free Memory Corruption +18

NVD

CVSS 2.0

9.3

EPSS

6.1%

CVE-2012-3990 Oct 10, 17:55 CRITICAL Act Now

Use-after-free vulnerability in the IME State Manager implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.

RCE Use After Free Memory Corruption Debian Red Hat +16

NVD

CVSS 2.0

9.3

EPSS

6.1%

CVE-2012-4185 Oct 10, 17:55 CRITICAL Act Now

Buffer overflow in the nsCharTraits::length function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.

RCE Buffer Overflow Denial Of Service Red Hat Mozilla +14

NVD

CVSS 2.0

9.3

EPSS

5.2%

CVE-2012-4182 Oct 10, 17:55 CRITICAL Act Now

Use-after-free vulnerability in the nsTextEditRules::WillInsert function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8,. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.

RCE Buffer Overflow Denial Of Service Use After Free Memory Corruption +18

NVD

CVSS 2.0

9.3

EPSS

4.8%

CVE-2012-3983 Oct 10, 17:55 CRITICAL Act Now

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 allow remote attackers to cause a denial of service. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

RCE Buffer Overflow Denial Of Service Mozilla Canonical +7

NVD

CVSS 2.0

10.0

EPSS

0.8%

CVE-2012-3988 Oct 10, 17:55 CRITICAL Act Now

Use-after-free vulnerability in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 might allow. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.

RCE Use After Free Memory Corruption Red Hat Mozilla +14

NVD

CVSS 2.0

9.3

EPSS

4.0%

CVE-2012-4181 Oct 10, 17:55 CRITICAL Act Now

Use-after-free vulnerability in the nsSMILAnimationController::DoSample function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.

RCE Buffer Overflow Denial Of Service Use After Free Memory Corruption +12

NVD

CVSS 2.0

9.3

EPSS

3.5%

CVE-2012-4183 Oct 10, 17:55 CRITICAL Act Now

Use-after-free vulnerability in the DOMSVGTests::GetRequiredFeatures function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.

RCE Buffer Overflow Denial Of Service Use After Free Memory Corruption +17

NVD

CVSS 2.0

9.3

EPSS

2.7%

CVE-2012-3995 Oct 10, 17:55 CRITICAL Act Now

The IsCSSWordSpacingSpace function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.

RCE Buffer Overflow Denial Of Service Information Disclosure Red Hat +15

NVD

CVSS 2.0

9.3

EPSS

2.0%

CVE-2012-3991 Oct 10, 17:55 CRITICAL Act Now

Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict JSAPI access to the. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.

Privilege Escalation Red Hat Mozilla Canonical Enterprise Linux Desktop +12

NVD

CVSS 2.0

9.3

EPSS

1.4%

CVE-2012-3982 Oct 10, 17:55 CRITICAL Act Now

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.

RCE Buffer Overflow Denial Of Service Debian Red Hat +16

NVD

CVSS 2.0

9.3

EPSS

1.3%

CVE-2012-3989 Oct 10, 17:55 CRITICAL Act Now

Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly perform a cast of an unspecified variable during use of the instanceof operator on a JavaScript object,. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.

RCE Buffer Overflow Denial Of Service Mozilla Canonical +7

NVD

CVSS 2.0

9.3

EPSS

0.9%