deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-3707
Published: 2015-07-03
Description: The FireWire driver in IOFireWireFamily in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
CVSS Score: 9.3 (HIGH)
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3708
Published: 2015-07-03
Description: kextd in kext tools in Apple OS X before 10.10.4 allows attackers to write to arbitrary files via a crafted app that conducts a symlink attack.
CVSS Score: 8.8 (HIGH)
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3709
Published: 2015-07-03
Description: Race condition in kext tools in Apple OS X before 10.10.4 allows local users to bypass intended signature requirements for kernel extensions by leveraging improper pathname validation.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3710
Published: 2015-07-03
Description: Mail in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to trigger a refresh operation, and consequently cause a visit to an arbitrary web site, via a crafted HTML e-mail message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204941
CVE: CVE-2015-3711
Published: 2015-07-03
Description: The NTFS implementation in Apple OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information for the kernel via a crafted app.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3712
Published: 2015-07-03
Description: The NVIDIA graphics driver in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (out-of-bounds write) via a crafted app.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3713
Published: 2015-07-03
Description: QuickTime in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted movie file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3714
Published: 2015-07-03
Description: Apple OS X before 10.10.4 does not properly consider custom resource rules during app signature verification, which allows attackers to bypass intended launch restrictions via a modified app.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-254
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3715
Published: 2015-07-03
Description: The code-signing implementation in Apple OS X before 10.10.4 does not properly consider libraries that are external to an application bundle, which allows attackers to bypass intended launch restrictions via a crafted library.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-254
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3716
Published: 2015-07-03
Description: Spotlight in Apple OS X before 10.10.4 allows attackers to execute arbitrary commands via a crafted name of a photo file within the local photo library.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-77
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3717
Published: 2015-07-03
Description: Multiple buffer overflows in the printf functionality in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204941
CVE: CVE-2015-3718
Published: 2015-07-03
Description: systemstatsd in the System Stats subsystem in Apple OS X before 10.10.4 does not properly interpret data types encountered in interprocess communication, which allows attackers to execute arbitrary code with systemstatsd privileges via a crafted app, related to a "type confusion" issue.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3719
Published: 2015-07-03
Description: TrueTypeScaler in FontParser in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3694.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204941
CVE: CVE-2015-3720
Published: 2015-07-03
Description: The kernel in Apple OS X before 10.10.4 does not properly manage memory in kernel-extension APIs, which allows attackers to obtain sensitive memory-layout information via a crafted app.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3721
Published: 2015-07-03
Description: The kernel in Apple iOS before 8.4 and OS X before 10.10.4 does not properly handle HFS parameters, which allows attackers to obtain sensitive memory-layout information via a crafted app.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204941
CVE: CVE-2015-3722
Published: 2015-07-03
Description: Application Store in Apple iOS before 8.4 does not ensure the uniqueness of bundle IDs, which allows attackers to cause a denial of service (ID collision and launch outage) via a crafted universal provisioning profile app.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://support.apple.com/kb/HT204941; http://www.securityfocus.com/bid/75490
CVE: CVE-2015-3723
Published: 2015-07-03
Description: CoreGraphics in Apple iOS before 8.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted ICC profile in a PDF document, a different vulnerability than CVE-2015-3724.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://support.apple.com/kb/HT204941; http://www.securityfocus.com/bid/75490
CVE: CVE-2015-3724
Published: 2015-07-03
Description: CoreGraphics in Apple iOS before 8.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted ICC profile in a PDF document, a different vulnerability than CVE-2015-3723.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://support.apple.com/kb/HT204941; http://www.securityfocus.com/bid/75490
CVE: CVE-2015-3725
Published: 2015-07-03
Description: MobileInstallation in Apple iOS before 8.4 does not ensure the uniqueness of Watch bundle IDs, which allows attackers to cause a denial of service (ID collision and Watch launch outage) via a crafted universal provisioning profile app.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://support.apple.com/kb/HT204941; http://www.securityfocus.com/bid/75490
CVE: CVE-2015-3726
Published: 2015-07-03
Description: The Telephony subsystem in Apple iOS before 8.4 allows physically proximate attackers to execute arbitrary code via a crafted (1) SIM or (2) UIM card.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://support.apple.com/kb/HT204941; http://www.securityfocus.com/bid/75490
CVE: CVE-2015-3727
Published: 2015-07-03
Description: WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict rename operations on WebSQL tables, which allows remote attackers to access an arbitrary web site's database via a crafted web site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00004.html; http://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html
CVE: CVE-2015-3728
Published: 2015-07-03
Description: The WiFi Connectivity feature in Apple iOS before 8.4 allows remote Wi-Fi access points to trigger an automatic association, with an arbitrary security type, by operating with a recognized ESSID within an 802.11 network's coverage area.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-254
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://support.apple.com/kb/HT204941; http://www.securityfocus.com/bid/75490
CVE: CVE-2015-4231
Published: 2015-07-03
Description: The Python interpreter in Cisco NX-OS 6.2(8a) on Nexus 7000 devices allows local users to bypass intended access restrictions and delete an arbitrary VDC's files by leveraging administrative privileges in one VDC, aka Bug ID CSCur08416.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39568; http://www.securitytracker.com/id/1032763; http://tools.cisco.com/security/center/viewAlert.x?alertId=39568
CVE: CVE-2015-4232
Published: 2015-07-03
Description: Cisco NX-OS 6.2(10) on Nexus and MDS 9000 devices allows local users to execute arbitrary OS commands by entering crafted tar parameters in the CLI, aka Bug ID CSCus44856.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39569; http://www.securityfocus.com/bid/75503; http://www.securitytracker.com/id/1032764
CVE: CVE-2015-4234
Published: 2015-07-03
Description: Cisco NX-OS 6.0(2) and 6.2(2) on Nexus devices has an improper OS configuration, which allows local users to obtain root access via unspecified input to the Python interpreter, aka Bug IDs CSCun02887, CSCur00115, and CSCur00127.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39571; http://www.securityfocus.com/bid/75502; http://www.securitytracker.com/id/1032765
CVE: CVE-2015-4237
Published: 2015-07-03
Description: The CLI parser in Cisco NX-OS 4.1(2)E1(1), 6.2(11b), 6.2(12), 7.2(0)ZZ(99.1), 7.2(0)ZZ(99.3), and 9.1(1)SV1(3.1.8) on Nexus devices allows local users to execute arbitrary OS commands via crafted characters in a filename, aka Bug IDs CSCuv08491, CSCuv08443, CSCuv08480, CSCuv08448, CSCuu99291, CSCuv08434, and CSCuv08436.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-78, CWE-264
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39583; http://www.securitytracker.com/id/1032775; http://tools.cisco.com/security/center/viewAlert.x?alertId=39583
CVE: CVE-2015-4239
Published: 2015-07-03
Description: Cisco Adaptive Security Appliance (ASA) Software 9.3(2.243) and 100.13(0.21) allows remote attackers to cause a denial of service (device reload) by sending crafted OSPFv2 packets on the local network, aka Bug ID CSCus84220.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=39612; http://www.securitytracker.com/id/1032780; http://tools.cisco.com/security/center/viewAlert.x?alertId=39612
CVE: CVE-2015-0547
Published: 2015-07-04
Description: The D2CenterstageService.getComments service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended read-access restrictions via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://seclists.org/bugtraq/2015/Jul/10; http://www.securitytracker.com/id/1032769; http://seclists.org/bugtraq/2015/Jul/10
CVE: CVE-2015-0548
Published: 2015-07-04
Description: The D2DownloadService.getDownloadUrls service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended read-access restrictions via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://seclists.org/bugtraq/2015/Jul/10; http://www.securitytracker.com/id/1032769; http://seclists.org/bugtraq/2015/Jul/10
CVE: CVE-2015-4196
Published: 2015-07-04
Description: Platform Software before 4.4.5 in Cisco Unified Communications Domain Manager (CDM) 8.x has a hardcoded password for a privileged account, which allows remote attackers to obtain root access by leveraging knowledge of this password and entering it in an SSH session, aka Bug ID CSCuq45546.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150701-cucdm; http://www.securitytracker.com/id/1032774; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150701-cucdm
CVE: CVE-2015-4525
Published: 2015-07-04
Description: The log-gather implementation in the web administration interface in EMC Isilon OneFS 6.5.x.x through 7.1.1.x before 7.1.1.5 and 7.2.0.x before 7.2.0.2 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.
CVSS Score: 9.0 (HIGH)
CWE: CWE-77
References: http://seclists.org/bugtraq/2015/Jul/11; http://seclists.org/bugtraq/2015/Jul/11
CVE: CVE-2015-0551
Published: 2015-07-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before P23, 7.0 before P18, 7.1 before P15, and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before P25; Documentum Web Publishers 6.5 SP7 before P25; and Documentum Task Space 6.7SP1 before P31 and 6.7SP2 before P23 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://seclists.org/bugtraq/2015/Jul/9; http://www.securitytracker.com/id/1032770; http://seclists.org/bugtraq/2015/Jul/9
CVE: CVE-2015-1966
Published: 2015-07-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before FP17, 6.2.1 before FP9, and 6.2.2 before FP15, as used in Security Access Manager for Mobile and other products, allow remote attackers to inject arbitrary web script or HTML via a crafted URL, related to the (1) ERROR_DESCRIPTION and (2) TOKEN:RelayState macros.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV74198; http://www-01.ibm.com/support/docview.wss?uid=swg1IV74199; http://www-01.ibm.com/support/docview.wss?uid=swg1IV74200
CVE: CVE-2015-4524
Published: 2015-07-04
Description: Unrestricted file upload vulnerability in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before P23, 7.0 before P18, 7.1 before P15, and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before P25; Documentum Web Publishers 6.5 SP7 before P25; and Documentum Task Space 6.7SP1 before P31 and 6.7SP2 before P23 allows remote authenticated users to execute arbitrary code by uploading a file to the backend Content Server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: http://seclists.org/bugtraq/2015/Jul/9; http://www.securitytracker.com/id/1032770; http://seclists.org/bugtraq/2015/Jul/9
CVE: CVE-2015-2964
Published: 2015-07-05
Description: NAMSHI | JOSE 5.0.0 and earlier allows remote attackers to bypass signature verification via crafted tokens in a JSON Web Tokens (JWT) header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN25336719/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000090; http://www.securityfocus.com/bid/75423
CVE: CVE-2015-4453
Published: 2015-07-05
Description: interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts, as demonstrated by (1) interface/fax/fax_dispatch_newpid.php and (2) interface/billing/sl_eob_search.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://jvn.jp/en/jp/JVN22677713/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000092; http://packetstormsecurity.com/files/132368/OpenEMR-4.2.0-Authentication-Bypass.html
CVE: CVE-2015-0543
Published: 2015-07-05
Description: EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://seclists.org/bugtraq/2015/Jun/132; http://www.securitytracker.com/id/1032740; http://seclists.org/bugtraq/2015/Jun/132
CVE: CVE-2015-0544
Published: 2015-07-05
Description: EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value.
CVSS Score: 9.3 (HIGH)
References: http://seclists.org/bugtraq/2015/Jun/132; http://www.securitytracker.com/id/1032740; http://seclists.org/bugtraq/2015/Jun/132
CVE: CVE-2015-4129
Published: 2015-07-05
Description: SQL injection vulnerability in Subrion CMS before 3.3.3 allows remote authenticated users to execute arbitrary SQL commands via modified serialized data in a salt cookie.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.kb.cert.org/vuls/id/110532; http://www.securityfocus.com/bid/74570; http://www.subrion.org/forums/threads/subrion-cms-3-3-3-is-available.2024/
CVE: CVE-2015-2721
Published: 2015-07-06
Description: Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, Thunderbird before 38.1, and other products, does not properly determine state transitions for the TLS state machine, which allows man-in-the-middle attackers to defeat cryptographic protection mechanisms by blocking messages, as demonstrated by removing a forward-secrecy property by blocking a ServerKeyExchange message, aka a "SMACK SKIP-TLS" issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html
CVE: CVE-2015-2722
Published: 2015-07-06
Description: Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a shared worker.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html
CVE: CVE-2015-2724
Published: 2015-07-06
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html
CVE: CVE-2015-2725
Published: 2015-07-06
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html
CVE: CVE-2015-2726
Published: 2015-07-06
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html
CVE: CVE-2015-2727
Published: 2015-07-06
Description: Mozilla Firefox 38.0 and Firefox ESR 38.0 allow user-assisted remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges via a crafted web site that is accessed with unspecified mouse and keyboard actions.  NOTE: this vulnerability exists because of a CVE-2015-0821 regression.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html; http://rhn.redhat.com/errata/RHSA-2015-1207.html; http://www.mozilla.org/security/announce/2015/mfsa2015-60.html
CVE: CVE-2015-2728
Published: 2015-07-06
Description: The IndexedDatabaseManager class in the IndexedDB implementation in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 misinterprets an unspecified IDBDatabase field as a pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors, related to a "type confusion" issue.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html; http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html