Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2014-1562
Unspecified vulnerability in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:0138', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html'}, {'name': '69519', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/69519'}, {'name': 'SUSE-SU-2014:1112', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00007.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1054359'}, {'name': 'GLSA-201504-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201504-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html'}, {'name': 'DSA-3018', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3018'}, {'name': '1030794', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030794'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2014/mfsa2014-67.html'}, {'name': 'SUSE-SU-2014:1120', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00012.html'}, {'name': 'openSUSE-SU-2015:1266', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html'}, {'name': '60186', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/60186'}, {'name': '61390', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61390'}, {'name': 'openSUSE-SU-2014:1098', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00003.html'}, {'name': '60148', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/60148'}, {'name': 'openSUSE-SU-2014:1099', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-09/msg00011.html'}, {'name': '61114', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61114'}, {'name': 'DSA-3028', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3028'}, {'name': 'SUSE-SU-2014:1107', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00005.html'}, {'name': '1030793', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030793'}]
CVE State: PUBLISHED
Explain CVE-2014-1563
Use-after-free vulnerability in the mozilla::DOMSVGLength::GetTearOff function in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG animation with DOM interaction that triggers incorrect cycle collection.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:0138', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html'}, {'name': 'GLSA-201504-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201504-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html'}, {'name': '1030794', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030794'}, {'name': '69523', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/69523'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1018524'}, {'name': 'openSUSE-SU-2015:1266', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html'}, {'name': 'openSUSE-SU-2014:1098', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00003.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2014/mfsa2014-68.html'}, {'name': '60148', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/60148'}, {'name': 'openSUSE-SU-2014:1099', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-09/msg00011.html'}, {'name': '61114', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61114'}, {'name': '1030793', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030793'}]
CVE State: PUBLISHED
Explain CVE-2014-1564
Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize memory for GIF rendering, which allows remote attackers to obtain sensitive information from process memory via crafted web script that interacts with a CANVAS element associated with a malformed GIF image.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:0138', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html'}, {'name': '20140904 Uninit memory disclosure via truncated images in Firefox', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/533357/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/128132/Mozilla-Firefox-Secret-Leak.html'}, {'name': '20140903 Uninit memory disclosure via truncated images in Firefox', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Sep/18'}, {'name': 'GLSA-201504-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201504-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html'}, {'name': '1030794', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030794'}, {'name': '69525', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/69525'}, {'name': 'openSUSE-SU-2015:1266', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2014/mfsa2014-69.html'}, {'name': 'openSUSE-SU-2014:1098', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00003.html'}, {'name': '60148', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/60148'}, {'name': 'openSUSE-SU-2014:1099', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-09/msg00011.html'}, {'name': '61114', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61114'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1045977'}, {'name': '1030793', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030793'}]
CVE State: PUBLISHED
Explain CVE-2014-1565
The mozilla::dom::AudioEventTimeline function in the Web Audio API implementation in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 does not properly create audio timelines, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via crafted API calls.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:0138', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html'}, {'name': '69521', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/69521'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2014/mfsa2014-70.html'}, {'name': 'GLSA-201504-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201504-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html'}, {'name': '1030794', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030794'}, {'name': 'openSUSE-SU-2015:1266', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html'}, {'name': 'openSUSE-SU-2014:1098', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00003.html'}, {'name': '60148', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/60148'}, {'name': 'openSUSE-SU-2014:1099', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-09/msg00011.html'}, {'name': '61114', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61114'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1047831'}, {'name': '1030793', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030793'}]
CVE State: PUBLISHED
Explain CVE-2014-1566
Mozilla Firefox before 31.1 on Android does not properly restrict copying of local files onto the SD card during processing of file: URLs, which allows attackers to obtain sensitive information from the Firefox profile directory via a crafted application.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1515.
Affected Products: n/a
References: [{'name': '69522', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/69522'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2014/mfsa2014-71.html'}, {'name': 'GLSA-201504-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201504-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html'}, {'name': '1030792', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030792'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1050690'}]
CVE State: PUBLISHED
Explain CVE-2014-1567
Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:0138', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2014/mfsa2014-72.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1037641'}, {'name': 'SUSE-SU-2014:1112', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00007.html'}, {'name': '69520', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/69520'}, {'name': 'GLSA-201504-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201504-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html'}, {'name': 'DSA-3018', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3018'}, {'name': '1030794', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030794'}, {'name': 'SUSE-SU-2014:1120', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00012.html'}, {'name': 'openSUSE-SU-2015:1266', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html'}, {'name': '60186', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/60186'}, {'name': '61390', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61390'}, {'name': 'openSUSE-SU-2014:1098', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00003.html'}, {'name': '60148', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/60148'}, {'name': 'openSUSE-SU-2014:1099', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-09/msg00011.html'}, {'name': '61114', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61114'}, {'name': 'DSA-3028', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3028'}, {'name': 'SUSE-SU-2014:1107', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00005.html'}, {'name': '1030793', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030793'}]
CVE State: PUBLISHED
Explain CVE-2014-1569
The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1064670'}, {'name': 'openSUSE-SU-2015:0138', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.3_release_notes'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.intelsecurity.com/resources/wp-berserk-analysis-part-1.pdf'}, {'name': '1032909', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1032909'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html'}, {'name': 'SUSE-SU-2015:0173', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.html'}, {'name': 'SUSE-SU-2015:0171', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.imperialviolet.org/2014/09/26/pkcs1.html'}, {'name': 'openSUSE-SU-2015:0404', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00000.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html'}, {'name': 'DSA-3186', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2015/dsa-3186'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.reddit.com/r/netsec/comments/2hd1m8/rsa_signature_forgery_in_nss/cksnr02'}, {'name': 'SUSE-SU-2015:0180', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00036.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1571
Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 allows remote authenticated users to obtain sensitive private-comment information by leveraging a role as a flag recipient, related to Bug.pm, Flag.pm, and a mail template.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1064140'}, {'name': 'MDVSA-2014:200', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2014:200'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/128578/Bugzilla-Account-Creation-XSS-Information-Leak.html'}, {'name': 'FEDORA-2014-12591', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-November/142524.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://advisories.mageia.org/MGASA-2014-0412.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.bugzilla.org/security/4.0.14/'}, {'name': 'FEDORA-2014-12584', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141309.html'}, {'name': 'FEDORA-2014-12530', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141321.html'}, {'name': '1030978', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030978'}]
CVE State: PUBLISHED
Explain CVE-2014-1572
The confirm_create_account function in the account-creation feature in token.cgi in Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not specify a scalar context for the realname parameter, which allows remote attackers to create accounts with unverified e-mail addresses by sending three realname values with realname=login_name as the second, as demonstrated by selecting an e-mail address with a domain name for which group privileges are automatically granted.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.opennet.ru/opennews/art.shtml?num=40766'}, {'name': 'MDVSA-2014:200', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2014:200'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/128578/Bugzilla-Account-Creation-XSS-Information-Leak.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1074812'}, {'name': '[oss-security] 20141007 "New Class of Vulnerability in Perl Web Applications"', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/10/07/20'}, {'name': 'FEDORA-2014-12591', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-November/142524.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.reddit.com/r/netsec/comments/2ihen0/new_class_of_vulnerability_in_perl_web/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.gerv.net/2014/10/new-class-of-vulnerability-in-perl-web-applications/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://advisories.mageia.org/MGASA-2014-0412.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.bugzilla.org/security/4.0.14/'}, {'name': 'GLSA-201607-11', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201607-11'}, {'name': 'FEDORA-2014-12584', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141309.html'}, {'name': 'FEDORA-2014-12530', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141321.html'}, {'name': '1030978', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030978'}]
CVE State: PUBLISHED
Explain CVE-2014-1573
Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not ensure that a scalar context is used for certain CGI parameters, which allows remote attackers to conduct cross-site scripting (XSS) attacks by sending three values for a single parameter name.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.opennet.ru/opennews/art.shtml?num=40766'}, {'name': 'MDVSA-2014:200', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2014:200'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/128578/Bugzilla-Account-Creation-XSS-Information-Leak.html'}, {'name': '70257', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/70257'}, {'name': '[oss-security] 20141007 "New Class of Vulnerability in Perl Web Applications"', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2014/10/07/20'}, {'name': 'FEDORA-2014-12591', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-November/142524.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.reddit.com/r/netsec/comments/2ihen0/new_class_of_vulnerability_in_perl_web/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.gerv.net/2014/10/new-class-of-vulnerability-in-perl-web-applications/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://advisories.mageia.org/MGASA-2014-0412.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.bugzilla.org/security/4.0.14/'}, {'name': 'GLSA-201607-11', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201607-11'}, {'name': 'FEDORA-2014-12584', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141309.html'}, {'name': 'FEDORA-2014-12530', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141321.html'}, {'name': '1030978', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030978'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1075578'}]
CVE State: PUBLISHED
Explain CVE-2014-1575
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to improper interaction between threading and garbage collection in the GCRuntime::triggerGC function in js/src/jsgc.cpp, and unknown other vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1001994'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2014/mfsa2014-74.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1018916'}, {'name': 'openSUSE-SU-2014:1344', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1032208'}, {'name': 'FEDORA-2014-13042', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html'}, {'name': '1031028', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031028'}, {'name': 'openSUSE-SU-2014:1345', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1033020'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1020034'}, {'name': 'GLSA-201504-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201504-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html'}, {'name': 'FEDORA-2014-14084', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html'}, {'name': 'USN-2372-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2372-1'}, {'name': '62022', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62022'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1023035'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1034230'}, {'name': '1031030', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031030'}, {'name': '62023', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62023'}, {'name': '70439', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/70439'}]
CVE State: PUBLISHED
Explain CVE-2014-1580
Mozilla Firefox before 33.0 does not properly initialize memory for GIF images, which allows remote attackers to obtain sensitive information from process memory via a crafted web page that triggers a sequence of rendering operations for truncated GIF data within a CANVAS element.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2014:1344', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html'}, {'name': 'FEDORA-2014-13042', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html'}, {'name': '70431', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/70431'}, {'name': '1031028', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031028'}, {'name': 'openSUSE-SU-2014:1345', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html'}, {'name': 'GLSA-201504-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201504-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html'}, {'name': 'FEDORA-2014-14084', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html'}, {'name': 'USN-2372-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2372-1'}, {'name': '62022', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62022'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1063733'}, {'name': '62023', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62023'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2014/mfsa2014-78.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1582
The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 does not properly consider the connection-coalescing behavior of SPDY and HTTP/2 in the case of a shared IP address, which allows man-in-the-middle attackers to bypass an intended pinning configuration and spoof a web site by providing a valid certificate from an arbitrary recognized Certification Authority.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1049095'}, {'name': 'openSUSE-SU-2014:1344', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html'}, {'name': 'FEDORA-2014-13042', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2014/mfsa2014-80.html'}, {'name': '1031028', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031028'}, {'name': 'openSUSE-SU-2014:1345', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html'}, {'name': 'GLSA-201504-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201504-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html'}, {'name': 'FEDORA-2014-14084', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html'}, {'name': 'USN-2372-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2372-1'}, {'name': '62022', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62022'}, {'name': '62023', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62023'}, {'name': '70432', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/70432'}]
CVE State: PUBLISHED
Explain CVE-2014-1583
The Alarm API in Mozilla Firefox before 33.0 and Firefox ESR 31.x before 31.2 does not properly restrict toJSON calls, which allows remote attackers to bypass the Same Origin Policy via crafted API calls that access sensitive information within the JSON data of an alarm.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2014:1344', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html'}, {'name': 'FEDORA-2014-13042', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html'}, {'name': '1031028', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031028'}, {'name': 'openSUSE-SU-2014:1345', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2014/mfsa2014-82.html'}, {'name': '70424', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/70424'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://advisories.mageia.org/MGASA-2014-0421.html'}, {'name': 'GLSA-201504-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201504-01'}, {'name': 'RHSA-2014:1635', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-1635.html'}, {'name': 'FEDORA-2014-14084', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html'}, {'name': 'USN-2372-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2372-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html'}, {'name': '62022', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62022'}, {'name': '1031030', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031030'}, {'name': '62023', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62023'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1015540'}, {'name': 'DSA-3050', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3050'}, {'name': '61854', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61854'}]
CVE State: PUBLISHED
Explain CVE-2014-1584
The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2014:1344', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html'}, {'name': 'FEDORA-2014-13042', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2014/mfsa2014-80.html'}, {'name': '1031028', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1031028'}, {'name': 'openSUSE-SU-2014:1345', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html'}, {'name': '70434', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/70434'}, {'name': 'GLSA-201504-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201504-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1066190'}, {'name': 'FEDORA-2014-14084', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html'}, {'name': 'USN-2372-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2372-1'}, {'name': '62022', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62022'}, {'name': '62023', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/62023'}]
CVE State: PUBLISHED
Explain CVE-2014-1587
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:0138', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1080312'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2014/mfsa2014-83.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1042567'}, {'name': '71391', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71391'}, {'name': 'GLSA-201504-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201504-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1079729'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html'}, {'name': 'DSA-3090', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3090'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1072847'}, {'name': 'openSUSE-SU-2015:1266', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1089207'}, {'name': 'DSA-3092', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3092'}]
CVE State: PUBLISHED
Explain CVE-2014-1588
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 34.0 and SeaMonkey before 2.31 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1086842'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2014/mfsa2014-83.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1073577'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1064835'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1096026'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1037830'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1077687'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1023158'}, {'name': 'GLSA-201504-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201504-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1048517'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1075546'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1026037'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1013001'}]
CVE State: PUBLISHED
Explain CVE-2014-1589
Mozilla Firefox before 34.0 and SeaMonkey before 2.31 provide stylesheets with an incorrect primary namespace, which allows remote attackers to bypass intended access restrictions via an XBL binding.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2014/mfsa2014-84.html'}, {'name': 'GLSA-201504-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201504-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1043787'}]
CVE State: PUBLISHED
Explain CVE-2014-1590
The XMLHttpRequest.prototype.send method in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to cause a denial of service (application crash) via a crafted JavaScript object.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2014/mfsa2014-85.html'}, {'name': 'openSUSE-SU-2015:0138', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html'}, {'name': 'GLSA-201504-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201504-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1087633'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html'}, {'name': '71397', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71397'}, {'name': 'DSA-3090', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3090'}, {'name': 'openSUSE-SU-2015:1266', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html'}, {'name': 'DSA-3092', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3092'}]
CVE State: PUBLISHED
Explain CVE-2014-1591
Mozilla Firefox 33.0 and SeaMonkey before 2.31 include path strings in CSP violation reports, which allows remote attackers to obtain sensitive information via a web site that receives a report after a redirect.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1069762'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2014/mfsa2014-86.html'}, {'name': 'GLSA-201504-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201504-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1592
Use-after-free vulnerability in the nsHtml5TreeOperation function in xul.dll in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code by adding a second root element to an HTML5 document during parsing.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:0138', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html'}, {'name': '71398', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71398'}, {'name': 'GLSA-201504-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201504-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1088635'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html'}, {'name': 'DSA-3090', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3090'}, {'name': 'openSUSE-SU-2015:1266', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2014/mfsa2014-87.html'}, {'name': 'DSA-3092', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3092'}]
CVE State: PUBLISHED
Explain CVE-2014-1593
Stack-based buffer overflow in the mozilla::FileBlockCache::Read function in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code via crafted media content.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:0138', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1085175'}, {'name': 'GLSA-201504-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201504-01'}, {'name': '71395', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71395'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2014/mfsa2014-88.html'}, {'name': 'DSA-3090', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3090'}, {'name': 'openSUSE-SU-2015:1266', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html'}, {'name': 'DSA-3092', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3092'}]
CVE State: PUBLISHED
Explain CVE-2014-1594
Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 might allow remote attackers to execute arbitrary code by leveraging an incorrect cast from the BasicThebesLayer data type to the BasicContainerLayer data type.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2015:0138', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html'}, {'name': 'GLSA-201504-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201504-01'}, {'name': '71396', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/71396'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1074280'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html'}, {'name': 'DSA-3090', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3090'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2014/mfsa2014-89.html'}, {'name': 'openSUSE-SU-2015:1266', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html'}, {'name': 'DSA-3092', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3092'}]
CVE State: PUBLISHED
Explain CVE-2014-1595
Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, and Thunderbird before 31.3 on Apple OS X 10.10 omit a CoreGraphics disable-logging action that is needed by jemalloc-based applications, which allows local users to obtain sensitive information by reading /tmp files, as demonstrated by credential information.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1092855'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2014/mfsa2014-90.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/HT204244'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.reddit.com/r/netsec/comments/2ocxac/apple_coregraphics_framework_on_os_x_1010_is/'}, {'name': 'APPLE-SA-2015-01-27-4', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html'}]
CVE State: PUBLISHED
Explain CVE-2014-1597
SQL injection vulnerability in the CMDB web application in synetics i-doit pro before 1.2.5 and i-doit open allows remote attackers to execute arbitrary SQL commands via the objID parameter to the default URI.
Affected Products: n/a
References: [{'name': 'idoit-cve20141597-sql-injection(91269)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91269'}, {'name': '56931', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56931'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.i-doit.com/en/company/news/single-news/?tx_ttnews%5Btt_news%5D=141'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.csnc.ch/misc/files/advisories/CVE-2014-1597_i-doit_SQL_Injection.txt'}, {'name': '20140217 SQL Injection i-doit Pro (CVE-2014-1597)', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0154.html'}, {'name': '65557', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65557'}]
CVE State: PUBLISHED