deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-1650
Published: 2012-08-28
Description: The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://drupalcode.org/project/zipcart.git/commitdiff/fe143c2; http://www.openwall.com/lists/oss-security/2012/04/07/1; http://www.osvdb.org/79766
CVE: CVE-2012-2085
Published: 2012-08-28
Description: The exec_command function in common/helpers.py in Gajim before 0.15 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in an href attribute.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/48708; http://secunia.com/advisories/48794; http://security.gentoo.org/glsa/glsa-201208-04.xml
CVE: CVE-2012-4685
Published: 2012-08-28
Description: Cross-site scripting (XSS) vulnerability in Arbor Networks Peakflow SP 5.1.1 before patch 6, 5.5 before patch 4, and 5.6.0 before patch 1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0019.html; http://archives.neohapsis.com/archives/bugtraq/2012-04/0036.html; http://archives.neohapsis.com/archives/bugtraq/2012-04/0037.html
CVE: CVE-2012-4686
Published: 2012-08-28
Description: SQL injection vulnerability in announcement.php in vBulletin 4.1.10 allows remote attackers to execute arbitrary SQL commands via the announcementid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0042.html; http://osvdb.org/80962; http://www.securityfocus.com/bid/52897
CVE: CVE-2011-4918
Published: 2012-08-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in Elxis CMS 2009.2, 2009.3 and 2009.3 Aphrodite before revision 2684 allow remote attackers to inject arbitrary web script or HTML via the (1) task parameter to elxis/index.php, and (2) PATH_INFO to elxis/administrator/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forum.elxis.org/index.php?PHPSESSID=v9i7kgmmb2554ldmlcmbj32ugjd0ngpc&topic=5144.msg43327#msg43327; http://secunia.com/advisories/47073; http://www.openwall.com/lists/oss-security/2011/12/31/2
CVE: CVE-2011-4926
Published: 2012-08-29
Description: Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://plugins.trac.wordpress.org/changeset?reponame=&new=467338%40adminimize&old=466900%40adminimize#file5; http://wordpress.org/extend/plugins/adminimize/changelog/; http://www.openwall.com/lists/oss-security/2012/01/05/10
CVE: CVE-2011-5128
Published: 2012-08-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Adminimize plugin before 1.7.22 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) inc-options/deinstall_options.php, (2) inc-options/theme_options.php, or (3) inc-options/im_export_options.php, or the (4) post or (5) post_ID parameters to adminimize.php, different vectors than CVE-2011-4926.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://plugins.trac.wordpress.org/changeset?reponame=&new=467338%40adminimize&old=466900%40adminimize#file5; http://wordpress.org/extend/plugins/adminimize/changelog/; http://plugins.trac.wordpress.org/changeset?reponame=&new=467338%40adminimize&old=466900%40adminimize#file5
CVE: CVE-2012-0307
Published: 2012-08-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in Symantec Messaging Gateway (SMG) before 10.0 allow remote attackers to inject arbitrary web script or HTML via (1) web content or (2) e-mail content.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/55138; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120827_00; https://exchange.xforce.ibmcloud.com/vulnerabilities/78031
CVE: CVE-2012-0308
Published: 2012-08-29
Description: Cross-site request forgery (CSRF) vulnerability in Symantec Messaging Gateway (SMG) before 10.0 allows remote attackers to hijack the authentication of administrators.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/bid/55137; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120827_00; http://www.securityfocus.com/bid/55137
CVE: CVE-2012-1956
Published: 2012-08-29
Description: Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12 do not prevent use of the Object.defineProperty method to shadow the location object (aka window.location), which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a plugin.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-1970
Published: 2012-08-29
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-1971
Published: 2012-08-29
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to garbage collection after certain MethodJIT execution, and unknown other vectors.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html; http://www.mozilla.org/security/announce/2012/mfsa2012-57.html
CVE: CVE-2012-1972
Published: 2012-08-29
Description: Use-after-free vulnerability in the nsHTMLEditor::CollapseAdjacentTextNodes function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-1973
Published: 2012-08-29
Description: Use-after-free vulnerability in the nsObjectLoadingContent::LoadObject function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-1974
Published: 2012-08-29
Description: Use-after-free vulnerability in the gfxTextRun::CanBreakLineBefore function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-1975
Published: 2012-08-29
Description: Use-after-free vulnerability in the PresShell::CompleteMove function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-1976
Published: 2012-08-29
Description: Use-after-free vulnerability in the nsHTMLSelectElement::SubmitNamesValues function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3579
Published: 2012-08-29
Description: Symantec Messaging Gateway (SMG) before 10.0 has a default password for an unspecified account, which makes it easier for remote attackers to obtain privileged access via an SSH session.
CVSS Score: 7.9 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/116277/Symantec-Messaging-Gateway-9.5-Default-SSH-Password.html; http://www.securityfocus.com/bid/55143; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120827_00
CVE: CVE-2012-3580
Published: 2012-08-29
Description: Symantec Messaging Gateway (SMG) before 10.0 allows remote authenticated users to modify the web application by leveraging access to the management interface.
CVSS Score: 7.7 (HIGH)
References: http://www.securityfocus.com/bid/55141; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120827_00; https://exchange.xforce.ibmcloud.com/vulnerabilities/78032
CVE: CVE-2012-3581
Published: 2012-08-29
Description: Symantec Messaging Gateway (SMG) before 10.0 allows remote attackers to obtain potentially sensitive information about component versions via unspecified vectors.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/55142; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120827_00; http://www.securityfocus.com/bid/55142
CVE: CVE-2012-3956
Published: 2012-08-29
Description: Use-after-free vulnerability in the MediaStreamGraphThreadRunnable::Run function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3957
Published: 2012-08-29
Description: Heap-based buffer overflow in the nsBlockFrame::MarkLineDirty function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3958
Published: 2012-08-29
Description: Use-after-free vulnerability in the nsHTMLEditRules::DeleteNonTableElements function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3959
Published: 2012-08-29
Description: Use-after-free vulnerability in the nsRangeUpdater::SelAdjDeleteNode function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3960
Published: 2012-08-29
Description: Use-after-free vulnerability in the mozSpellChecker::SetCurrentDictionary function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3961
Published: 2012-08-29
Description: Use-after-free vulnerability in the RangeData implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3962
Published: 2012-08-29
Description: Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 do not properly iterate through the characters in a text run, which allows remote attackers to execute arbitrary code via a crafted document.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3963
Published: 2012-08-29
Description: Use-after-free vulnerability in the js::gc::MapAllocToTraceKind function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3964
Published: 2012-08-29
Description: Use-after-free vulnerability in the gfxTextRun::GetUserData function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3965
Published: 2012-08-29
Description: Mozilla Firefox before 15.0 does not properly restrict navigation to the about:newtab page, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers creation of a new tab and then a new window.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3966
Published: 2012-08-29
Description: Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a negative height value in a BMP image within a .ICO file, related to (1) improper handling of the transparency bitmask by the nsICODecoder component and (2) improper processing of the alpha channel by the nsBMPDecoder component.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3967
Published: 2012-08-29
Description: The WebGL implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 on Linux, when a large number of sampler uniforms are used, does not properly interact with Mesa drivers, which allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted web site.
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3968
Published: 2012-08-29
Description: Use-after-free vulnerability in the WebGL implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via vectors related to deletion of a fragment shader by its accessor.
CVSS Score: 10.0 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3969
Published: 2012-08-29
Description: Integer overflow in the nsSVGFEMorphologyElement::Filter function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via a crafted SVG filter that triggers an incorrect sum calculation, leading to a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3970
Published: 2012-08-29
Description: Use-after-free vulnerability in the nsTArray_base::Length function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving movement of a requiredFeatures attribute from one SVG document to another.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3971
Published: 2012-08-29
Description: Summer Institute of Linguistics (SIL) Graphite 2, as used in Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the (1) Silf::readClassMap and (2) Pass::readPass functions.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3972
Published: 2012-08-29
Description: The format-number functionality in the XSLT implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based buffer over-read.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
CVE: CVE-2012-3973
Published: 2012-08-29
Description: The debugger in the developer-tools subsystem in Mozilla Firefox before 15.0, when remote debugging is disabled, does not properly restrict access to the remote-debugging service, which allows remote attackers to execute arbitrary code by leveraging the presence of the HTTPMonitor extension and connecting to that service through the HTTPMonitor port.
CVSS Score: 7.6 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html