deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-2790
Published: 2015-03-30
Description: Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1 allow remote attackers to cause a denial of service (memory corruption and crash) via a crafted (1) Ubyte Size in a DataSubBlock structure or (2) LZWMinimumCodeSize in a GIF image.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://protekresearchlab.com/PRL-2015-02/; http://protekresearchlab.com/prl-2015-01prl-foxit-products-gif-conversion-memory-corruption-vulnerabilities-lzwminimumcodesize/; http://securitytracker.com/id/1031878
CVE: CVE-2015-2791
Published: 2015-03-30
Description: The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to delete arbitrary posts, pages, and menus via a crafted request to sitepress-multilingual-cms/menu/menus-sync.php.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://klikki.fi/adv/wpml.html; http://packetstormsecurity.com/files/130810/WordPress-WPML-XSS-Deletion-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Mar/71
CVE: CVE-2015-2792
Published: 2015-03-30
Description: The WPML plugin before 3.1.9 for WordPress does not properly handle multiple actions in a request, which allows remote attackers to bypass nonce checks and perform arbitrary actions via a request containing an action POST parameter, an action GET parameter, and a valid nonce for the action GET parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://klikki.fi/adv/wpml.html; http://packetstormsecurity.com/files/130839/WordPress-WPML-Missing-Authentication.html; http://seclists.org/fulldisclosure/2015/Mar/79
CVE: CVE-2014-9209
Published: 2015-03-31
Description: Untrusted search path vulnerability in the Clean Utility application in Rockwell Automation FactoryTalk Services Platform before 2.71.00 and FactoryTalk View Studio 8.00.00 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 6.9 (MEDIUM)
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-062-02; https://rockwellautomation.custhelp.com/app/answers/detail/a_id/646323; https://ics-cert.us-cert.gov/advisories/ICSA-15-062-02
CVE: CVE-2015-0984
Published: 2015-03-31
Description: Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000C50 52 I/O, XL1000C100 104 I/O, XL1000C500 300 I/O, XL1000C1000 600 I/O, XL1000C50U 52 I/O UUKL, XL1000C100U 104 I/O UUKL, XL1000C500U 300 I/O UUKL, and XL1000C1000U 600 I/O UUKL controllers before 2.04.01 allows remote attackers to read files under the web root, and consequently obtain administrative login access, via a crafted pathname.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2015/Apr/79; https://ics-cert.us-cert.gov/advisories/ICSA-15-076-02; https://www.outpost24.com/hacking-industrial-control-systems-case-study-falcon/
CVE: CVE-2015-0985
Published: 2015-03-31
Description: Cross-site request forgery (CSRF) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to hijack the authentication of admins for requests that modify the default user's password via a GET request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-076-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-076-01
CVE: CVE-2014-7876
Published: 2015-03-31
Description: Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27 and 4 before 2.03 and iLO Chassis Management (CM) firmware before 1.30 allows remote attackers to gain privileges, execute arbitrary code, or cause a denial of service via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.securitytracker.com/id/1031972; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04486432; http://www.securitytracker.com/id/1031972
CVE: CVE-2015-0900
Published: 2015-03-31
Description: Cross-site scripting (XSS) vulnerability in schedule.cgi in Nishishi Factory Fumy Teacher's Schedule Board 1.10 through 2.21 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN74547976/995592/index.html; http://jvn.jp/en/jp/JVN74547976/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000043
CVE: CVE-2015-0901
Published: 2015-03-31
Description: Cross-site scripting (XSS) vulnerability in the duwasai flashy theme 1.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN97281747/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000044; https://wpvulndb.com/vulnerabilities/7872
CVE: CVE-2015-2106
Published: 2015-03-31
Description: Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27, 3 before 1.82, and 4 before 2.10 allows remote attackers to bypass intended access restrictions or cause a denial of service via unknown vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://www.securityfocus.com/bid/73324; http://www.securitytracker.com/id/1031974; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04582368
CVE: CVE-2015-2108
Published: 2015-03-31
Description: Unspecified vulnerability in Powershell Operations in HP Operations Orchestration 9.x and 10.x allows remote authenticated users to obtain sensitive information via unknown vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/73320; http://www.securitytracker.com/id/1031987; https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04595417
CVE: CVE-2015-2109
Published: 2015-03-31
Description: Unspecified vulnerability in HP Operations Orchestration 10.x allows remote attackers to bypass authentication, and obtain sensitive information or modify data, via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/73323; https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04595607; http://www.securityfocus.com/bid/73323
CVE: CVE-2014-2027
Published: 2015-03-31
Description: eGroupware before 1.8[PII_REDACTED]7 allows remote attackers to conduct PHP object injection attacks, delete arbitrary files, and possibly execute arbitrary code via the (1) addr_fields or (2) trans parameter to addressbook/csv_import.php, (3) cal_fields or (4) trans parameter to calendar/csv_import.php, (5) info_fields or (6) trans parameter to csv_import.php in (a) projectmanager/ or (b) infolog/, or (7) processed parameter to preferences/inc/class.uiaclprefs.inc.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://advisories.mageia.org/MGASA-2014-0116.html; http://openwall.com/lists/oss-security/2014/02/19/10; http://openwall.com/lists/oss-security/2014/02/19/4
CVE: CVE-2014-2830
Published: 2015-03-31
Description: Stack-based buffer overflow in cifskey.c or cifscreds.c in cifs-utils before 6.4, as used in pam_cifscreds, allows remote attackers to have unspecified impact via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0242.html; http://seclists.org/oss-sec/2014/q2/96; http://www.mandriva.com/security/advisories?name=MDVSA-2015:114
CVE: CVE-2014-9462
Published: 2015-03-31
Description: The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://chargen.matasano.com/chargen/2015/3/17/this-new-vulnerability-mercurial-command-injection-cve-2014-9462.html; http://lists.opensuse.org/opensuse-updates/2015-03/msg00085.html; http://mercurial.selenic.com/wiki/WhatsNew
CVE: CVE-2014-9706
Published: 2015-03-31
Description: The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154523.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154551.html; http://www.debian.org/security/2015/dsa-3206
CVE: CVE-2014-9707
Published: 2015-03-31
Description: EmbedThis GoAhead 3.0.0 through 3.4.1 does not properly handle path segments starting with a . (dot), which allows remote attackers to conduct directory traversal attacks, cause a denial of service (heap-based buffer overflow and crash), or possibly execute arbitrary code via a crafted URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: http://packetstormsecurity.com/files/131156/GoAhead-3.4.1-Heap-Overflow-Traversal.html; http://seclists.org/fulldisclosure/2015/Mar/157; http://www.securityfocus.com/archive/1/535027/100/0/threaded
CVE: CVE-2014-9708
Published: 2015-03-31
Description: Embedthis Appweb before 4.6.6 and 5.x before 5.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a Range header with an empty value, as demonstrated by "Range: x=,".
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-476
References: http://packetstormsecurity.com/files/131157/Appweb-Web-Server-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2015/Apr/19; http://seclists.org/fulldisclosure/2015/Mar/158
CVE: CVE-2015-0838
Published: 2015-03-31
Description: Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2015/dsa-3206; https://lists.launchpad.net/dulwich-users/msg00829.html; http://www.debian.org/security/2015/dsa-3206
CVE: CVE-2015-2684
Published: 2015-03-31
Description: Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause a denial of service (crash) via a crafted SAML message.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2015/dsa-3207; http://www.securityfocus.com/bid/73314; https://shibboleth.net/community/advisories/secadv_20150319.txt
CVE: CVE-2015-2753
Published: 2015-03-31
Description: FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) or possibly execute arbitrary code via a crafted sector in a workbook.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2015/dsa-3208; http://www.openwall.com/lists/oss-security/2015/03/25/1; http://www.openwall.com/lists/oss-security/2015/03/27/1
CVE: CVE-2015-2754
Published: 2015-03-31
Description: FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) and possibly execute arbitrary code via a crafted workbook, related to a "premature EOF."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2015/dsa-3208; http://www.openwall.com/lists/oss-security/2015/03/25/1; http://www.openwall.com/lists/oss-security/2015/03/27/1
CVE: CVE-2015-2776
Published: 2015-03-31
Description: The parse_SST function in FreeXL before 1.0.0i allows remote attackers to cause a denial of service (memory consumption) via a crafted shared strings table in a workbook.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2015/dsa-3208; http://www.openwall.com/lists/oss-security/2015/03/25/1; http://www.openwall.com/lists/oss-security/2015/03/27/13
CVE: CVE-2015-1892
Published: 2015-04-01
Description: The Multicast DNS (mDNS) responder in IBM Security Access Manager for Web 7.x before 7.0.0 FP12 and 8.x before 8.0.1 FP1 inadvertently responds to unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service (traffic amplification) or obtain potentially sensitive information via port-5353 UDP packets.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV70911; http://www-01.ibm.com/support/docview.wss?uid=swg1IV70913; http://www-01.ibm.com/support/docview.wss?uid=swg21699497
CVE: CVE-2015-2808
Published: 2015-04-01
Description: The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-327
References: http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727
CVE: CVE-2015-2809
Published: 2015-04-01
Description: The Multicast DNS (mDNS) responder in Synology DiskStation Manager (DSM) before 3.1 inadvertently responds to unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service (traffic amplification) or obtain potentially sensitive information via port-5353 UDP packets to the Avahi component.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/550620; http://www.kb.cert.org/vuls/id/BLUU-9TLSHD; http://www.securityfocus.com/bid/73683
CVE: CVE-2012-2808
Published: 2015-04-01
Description: The PRNG implementation in the DNS resolver in Bionic in Android before 4.1.1 incorrectly uses time and PID information during the generation of random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a related issue to CVE-2015-0800.
CVSS Score: 5.0 (MEDIUM)
References: http://blog.watchfire.com/files/androiddnsweakprng.pdf; http://www.mozilla.org/security/announce/2015/mfsa2015-41.html; http://blog.watchfire.com/files/androiddnsweakprng.pdf
CVE: CVE-2015-0800
Published: 2015-04-01
Description: The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a related issue to CVE-2012-2808.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.mozilla.org/security/announce/2015/mfsa2015-41.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html; http://www.securitytracker.com/id/1031996
CVE: CVE-2015-0801
Published: 2015-04-01
Description: Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.html
CVE: CVE-2015-0802
Published: 2015-04-01
Description: Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html; http://www.mozilla.org/security/announce/2015/mfsa2015-42.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-0803
Published: 2015-04-01
Description: The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does not properly constrain the original data type of a casted value during the setting of a SOURCE element's attributes, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html; http://www.mozilla.org/security/announce/2015/mfsa2015-39.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-0804
Published: 2015-04-01
Description: The HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does not properly constrain a data type after omitting namespace validation during certain tree-binding operations, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document containing a SOURCE element.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html; http://www.mozilla.org/security/announce/2015/mfsa2015-39.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-0805
Published: 2015-04-01
Description: The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 makes an incorrect memset call during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors that trigger rendering of 2D graphics content.
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html; http://www.mozilla.org/security/announce/2015/mfsa2015-38.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-0806
Published: 2015-04-01
Description: The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 attempts to use memset for a memory region of negative length during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors that trigger rendering of 2D graphics content.
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html; http://www.mozilla.org/security/announce/2015/mfsa2015-38.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-0807
Published: 2015-04-01
Description: The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site, a similar issue to CVE-2014-8638.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.html
CVE: CVE-2015-0808
Published: 2015-04-01
Description: The webrtc::VPMContentAnalysis::Release function in the WebRTC implementation in Mozilla Firefox before 37.0 uses incompatible approaches to the deallocation of memory for simple-type arrays, which might allow remote attackers to cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html; http://www.mozilla.org/security/announce/2015/mfsa2015-36.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-0810
Published: 2015-04-01
Description: Mozilla Firefox before 37.0 on OS X does not ensure that the cursor is visible, which allows remote attackers to conduct clickjacking attacks via a Flash object in conjunction with DIV elements associated with layered presentation, and crafted JavaScript code that interacts with an IMG element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.mozilla.org/security/announce/2015/mfsa2015-35.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html; http://www.securitytracker.com/id/1031996
CVE: CVE-2015-0811
Published: 2015-04-01
Description: The QCMS implementation in Mozilla Firefox before 37.0 allows remote attackers to obtain sensitive information from process heap memory or cause a denial of service (out-of-bounds read) via an image that is improperly handled during transformation.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html; http://www.mozilla.org/security/announce/2015/mfsa2015-34.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-0812
Published: 2015-04-01
Description: Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an intended user-confirmation requirement by deploying a crafted web site and conducting a DNS spoofing attack against a mozilla.org subdomain.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-17
References: http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html; http://www.mozilla.org/security/announce/2015/mfsa2015-32.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-0813
Published: 2015-04-01
Description: Use-after-free vulnerability in the AppendElements function in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 on Linux, when the Fluendo MP3 plugin for GStreamer is used, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted MP3 file.
CVSS Score: 5.1 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.html
CVE: CVE-2015-0814
Published: 2015-04-01
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00006.html; http://www.mozilla.org/security/announce/2015/mfsa2015-30.html
CVE: CVE-2015-0815
Published: 2015-04-01
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.html
CVE: CVE-2015-0816
Published: 2015-04-01
Description: Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.html