deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-6019
Published: 2013-10-28
Description: Cross-site scripting (XSS) vulnerability in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to inject arbitrary web script or HTML via the accountNum parameter to an unspecified component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/911678; http://www.kb.cert.org/vuls/id/911678
CVE: CVE-2013-6020
Published: 2013-10-28
Description: passwordRequestPOST.jsp in Tyler Technologies TaxWeb 3.13.3.1 sends different HTTP status codes for invalid password-recovery requests depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of requests to the (1) Assessor, (2) Recorder, or (3) Treasurer application.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/911678; http://www.kb.cert.org/vuls/id/911678
CVE: CVE-2013-6285
Published: 2013-10-28
Description: The search component in the Treasurer application in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to obtain sensitive query-structure information via an invalid search request, a different vulnerability than CVE-2013-6020.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/911678; http://www.kb.cert.org/vuls/id/911678
CVE: CVE-2012-4529
Published: 2013-10-28
Description: The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a session, which allows remote attackers to obtain the session id (1) via a man-in-the-middle attack or (2) by reading a log.
CVSS Score: 4.3 (MEDIUM)
References: http://ocpsoft.org/support/topic/session-id-is-appended-as-url-path-parameter-in-very-first-request/; http://rhn.redhat.com/errata/RHSA-2013-0833.html; http://rhn.redhat.com/errata/RHSA-2013-0834.html
CVE: CVE-2012-4572
Published: 2013-10-28
Description: Red Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new application when an implementation is already loaded and the modules share class names, which allows local users to control certain applications' authorization decisions via a crafted application.
CVSS Score: 3.7 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-0833.html; http://rhn.redhat.com/errata/RHSA-2013-0834.html; http://rhn.redhat.com/errata/RHSA-2013-1437.html
CVE: CVE-2013-1056
Published: 2013-10-28
Description: X.org X server 1.13.3 and earlier, when not run as root, allows local users to cause a denial of service (crash) or possibly gain privileges via vectors involving cached xkb files.
CVSS Score: 1.9 (LOW)
References: http://www.ubuntu.com/usn/USN-1990-1; http://www.ubuntu.com/usn/USN-1990-1
CVE: CVE-2013-2102
Published: 2013-10-28
Description: The default configuration of Red Hat JBoss Portal before 6.1.0 enables the JGroups diagnostics service with no authentication when a JGroups channel is started, which allows remote attackers to obtain sensitive information (diagnostics) by accessing the service.
CVSS Score: 3.3 (LOW)
CWE: CWE-287
References: http://rhn.redhat.com/errata/RHSA-2013-1437.html; https://bugzilla.redhat.com/show_bug.cgi?id=963984; http://rhn.redhat.com/errata/RHSA-2013-1437.html
CVE: CVE-2013-2186
Published: 2013-10-28
Description: The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00008.html; http://lists.opensuse.org/opensuse-updates/2013-10/msg00033.html; http://lists.opensuse.org/opensuse-updates/2013-10/msg00050.html
CVE: CVE-2010-1159
Published: 2013-10-28
Description: Multiple heap-based buffer overflows in Aircrack-ng before 1.1 allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a (1) large length value in an EAPOL packet or (2) long EAPOL packet.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://pyrit.googlecode.com/svn/tags/opt/aircrackng_exploit.py; http://secunia.com/advisories/39150; http://secunia.com/advisories/55053
CVE: CVE-2012-0825
Published: 2013-10-28
Description: Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://openid.net/2011/05/05/attribute-exchange-security-alert/; http://www.debian.org/security/2013/dsa-2776; https://drupal.org/node/1425084
CVE: CVE-2012-0826
Published: 2013-10-28
Description: Cross-site request forgery (CSRF) vulnerability in the Aggregator module in Drupal 6.x before 6.23 and 7.x before 7.11 allows remote attackers to hijack the authentication of unspecified victims for requests that update feeds and possibly cause a denial of service (loss of updates due to rate limit) via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.debian.org/security/2013/dsa-2776; https://drupal.org/node/1425084; http://www.debian.org/security/2013/dsa-2776
CVE: CVE-2012-0827
Published: 2013-10-28
Description: The File module in Drupal 7.x before 7.11, when using unspecified field access modules, allows remote authenticated users to read arbitrary private files that are associated with restricted fields via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: https://drupal.org/node/1425084; https://drupal.org/node/1425084
CVE: CVE-2012-6303
Published: 2013-10-28
Description: Heap-based buffer overflow in the GetWavHeader function in generic/jkSoundFile.c in the Snack Sound Toolkit, as used in WaveSurfer 1.8.8p4, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large chunk size in a WAV file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00034.html; http://secunia.com/advisories/49889; http://security.gentoo.org/glsa/glsa-201309-04.xml
CVE: CVE-2013-2208
Published: 2013-10-28
Description: tpp 1.3.1 allows remote attackers to execute arbitrary commands via a --exec command in a TPP template file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=706644; http://security.gentoo.org/glsa/glsa-201309-19.xml; http://www.openwall.com/lists/oss-security/2013/06/21/4
CVE: CVE-2013-3243
Published: 2013-10-28
Description: Unspecified vulnerability in OpenText/IXOS ECM for SAP NetWeaver allows remote attackers to execute arbitrary ABAP code via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2013-04/0214.html; http://www.esnc.de/sap-security-audit-and-scan-services/security-advisories/57-esnc-2013-004-remote-abap-code-injection-in-opentext-ixos-ecm-suite-for-sap-netweaver.html; http://archives.neohapsis.com/archives/bugtraq/2013-04/0214.html
CVE: CVE-2013-3704
Published: 2013-10-28
Description: The RPM GPG key import and handling feature in libzypp 12.15.0 and earlier reports a different key fingerprint than the one used to sign a repository when multiple key blobs are used, which might allow remote attackers to trick users into believing that the repository was signed by a more-trustworthy key.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-updates/2013-09/msg00022.html; http://lists.opensuse.org/opensuse-updates/2013-09/msg00023.html; http://lists.opensuse.org/opensuse-updates/2013-09/msg00022.html
CVE: CVE-2013-4391
Published: 2013-10-28
Description: Integer overflow in the valid_user_field function in journal/journald-native.c in systemd allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large journal data field, which triggers a heap-based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357; http://cgit.freedesktop.org/systemd/systemd/commit/?id=505b6a61c22d5565e9308045c7b9bf79f7d0517e; http://www.debian.org/security/2013/dsa-2777
CVE: CVE-2013-4392
Published: 2013-10-28
Description: systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-59, CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357; http://www.openwall.com/lists/oss-security/2013/10/01/9; https://bugzilla.redhat.com/show_bug.cgi?id=859060
CVE: CVE-2013-4393
Published: 2013-10-28
Description: journald in systemd, when the origin of native messages is set to file, allows local users to cause a denial of service (logging service blocking) via a crafted file descriptor.
CVSS Score: 2.1 (LOW)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357; http://www.openwall.com/lists/oss-security/2013/10/01/9; https://bugzilla.redhat.com/show_bug.cgi?id=859104
CVE: CVE-2013-4394
Published: 2013-10-28
Description: The SetX11Keyboard function in systemd, when PolicyKit Local Authority (PKLA) is used to change the group permissions on the X Keyboard Extension (XKB) layouts description, allows local users in the group to modify the Xorg X11 Server configuration file and possibly gain privileges via vectors involving "special and control characters."
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-276
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357; http://www.debian.org/security/2013/dsa-2777; http://www.openwall.com/lists/oss-security/2013/10/01/9
CVE: CVE-2013-4402
Published: 2013-10-28
Description: The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725433; http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000333.html; http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000334.html
CVE: CVE-2013-5744
Published: 2013-10-28
Description: Cross-site scripting (XSS) vulnerability in Feng Office 2.3.2-rc and earlier allows remote attackers to inject arbitrary web script or HTML via an arbitrary ref_XXX parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-10/0031.html; https://www.htbridge.com/advisory/HTB23174; http://archives.neohapsis.com/archives/bugtraq/2013-10/0031.html
CVE: CVE-2013-6012
Published: 2013-10-28
Description: Juniper Junos 12.1X44 before 12.1.X44-D20 and 12.1X45 before 12.1X45-D15, when the no-validate option is enabled, does not properly handle configuration validation errors during the config commit phase of the boot-up sequence, which allows remote attackers to bypass authentication via unspecified vectors.
CVSS Score: 8.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/63389; https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10593; http://www.securityfocus.com/bid/63389
CVE: CVE-2013-6014
Published: 2013-10-28
Description: Juniper Junos 10.4 before 10.4S15, 11.4 before 11.4R9, 11.4X27 before 11.4X27.44, 12.1 before 12.1R7, 12.1X44 before 12.1X44-D20, 12.1X45 before 12.1X45-D15, 12.2 before 12.2R6, 12.3 before 12.3R3, 13.1 before 13.1R3, and 13.2 before 13.2R1, when Proxy ARP is enabled on an unnumbered interface, allows remote attackers to perform ARP poisoning attacks and possibly obtain sensitive information via a crafted ARP message.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-200
References: https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10595; https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10595
CVE: CVE-2013-6288
Published: 2013-10-28
Description: Unspecified vulnerability in the Apache Solr for TYPO3 (solr) extension before 2.8.3 for TYPO3 has unknown impact and remote attack vectors, related to "Insecure Unserialize."
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/54978; http://typo3.org/extensions/repository/view/solr; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-009/
CVE: CVE-2013-6289
Published: 2013-10-28
Description: Cross-site scripting (XSS) vulnerability in the Apache Solr for TYPO3 (solr) extension before 2.8.3 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/54978; http://typo3.org/extensions/repository/view/solr; http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-009/
CVE: CVE-2013-5741
Published: 2013-10-29
Description: Triangle Research International (aka Tri) Nano-10 PLC devices with firmware r81 and earlier do not properly handle large length values in MODBUS data, which allows remote attackers to cause a denial of service (transition to the interrupt state) via a crafted packet to TCP port 502.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://blogs.ixiacom.com/ixia-blog/hack-scada-zero-day-vulnerability-discovery-on-the-nano-10-plc/; http://osvdb.org/ref/97/tri-nano10.txt; http://www.osvdb.org/97728
CVE: CVE-2013-5968
Published: 2013-10-29
Description: Cross-site scripting (XSS) vulnerability in CA SiteMinder 12.0 through 12.51, and SiteMinder 6 Web Agents, allows remote attackers to inject arbitrary web script or HTML via vectors involving a " (double quote) character.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-10/0120.html; http://osvdb.org/98919; http://seclists.org/fulldisclosure/2013/Oct/230
CVE: CVE-2013-4185
Published: 2013-10-29
Description: Algorithmic complexity vulnerability in OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-3 does not properly handle network source security group policy updates, which allows remote authenticated users to cause a denial of service (nova-network consumption) via a large number of server-creation operations, which triggers a large number of update requests.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-310
References: http://rhn.redhat.com/errata/RHSA-2013-1199.html; http://seclists.org/oss-sec/2013/q3/282; https://bugs.launchpad.net/nova/+bug/1184041
CVE: CVE-2013-4261
Published: 2013-10-29
Description: OpenStack Compute (Nova) Folsom, Grizzly, and earlier, when using Apache Qpid for the RPC backend, does not properly handle errors that occur during messaging, which allows remote attackers to cause a denial of service (connection pool consumption), as demonstrated using multiple requests that send long strings to an instance console and retrieving the console log.
CVSS Score: 3.5 (LOW)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2013-1199.html; http://seclists.org/oss-sec/2013/q3/595; https://bugs.launchpad.net/nova/+bug/1215091
CVE: CVE-2013-5590
Published: 2013-10-30
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00014.html
CVE: CVE-2013-5591
Published: 2013-10-30
Description: Unspecified vulnerability in the browser engine in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html; http://www.mozilla.org/security/announce/2013/mfsa2013-93.html
CVE: CVE-2013-5592
Published: 2013-10-30
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 25.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html; http://www.mozilla.org/security/announce/2013/mfsa2013-93.html
CVE: CVE-2013-5593
Published: 2013-10-30
Description: The SELECT element implementation in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 does not properly restrict the nature or placement of HTML within a dropdown menu, which allows remote attackers to spoof the address bar or conduct clickjacking attacks via vectors that trigger navigation off of a page containing this element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html; http://www.mozilla.org/security/announce/2013/mfsa2013-94.html
CVE: CVE-2013-5595
Published: 2013-10-30
Description: The JavaScript engine in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 does not properly allocate memory for unspecified functions, which allows remote attackers to conduct buffer overflow attacks via a crafted web page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00014.html
CVE: CVE-2013-5596
Published: 2013-10-30
Description: The cycle collection (CC) implementation in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 does not properly determine the thread for release of an image object, which allows remote attackers to execute arbitrary code or cause a denial of service (race condition and application crash) via a large HTML document containing IMG elements, as demonstrated by the Never-Ending Reddit on reddit.com.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html; http://www.mozilla.org/security/announce/2013/mfsa2013-97.html
CVE: CVE-2013-5597
Published: 2013-10-30
Description: Use-after-free vulnerability in the nsDocLoader::doStopDocumentLoad function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving a state-change event during an update of the offline cache.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00014.html
CVE: CVE-2013-5598
Published: 2013-10-30
Description: PDF.js in Mozilla Firefox before 25.0 and Firefox ESR 24.x before 24.1 does not properly handle the appending of an IFRAME element, which allows remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges by using this element within an embedded PDF object.
CVSS Score: 8.3 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html; http://www.mozilla.org/security/announce/2013/mfsa2013-99.html
CVE: CVE-2013-5599
Published: 2013-10-30
Description: Use-after-free vulnerability in the nsIPresShell::GetPresContext function in the PresShell (aka presentation shell) implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via vectors involving a CANVAS element, a mozTextStyle attribute, and an onresize event.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00014.html
CVE: CVE-2013-5600
Published: 2013-10-30
Description: Use-after-free vulnerability in the nsIOService::NewChannelFromURIWithProxyFlags function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code via vectors involving a blob: URL.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00014.html
CVE: CVE-2013-5601
Published: 2013-10-30
Description: Use-after-free vulnerability in the nsEventListenerManager::SetEventHandler function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code via vectors related to a memory allocation through the garbage collection (GC) API.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00014.html
CVE: CVE-2013-5602
Published: 2013-10-30
Description: The Worker::SetEventListener function in the Web workers implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to direct proxies.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00014.html
CVE: CVE-2013-5603
Published: 2013-10-30
Description: Use-after-free vulnerability in the nsContentUtils::ContentIsHostIncludingDescendantOf function in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving HTML document templates.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html; http://www.mozilla.org/security/announce/2013/mfsa2013-102.html