deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-1975
Published: 2014-03-18
Description: Directory traversal vulnerability in the R-Company Unzipper application 1.0.1 and earlier for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN38227002/995495/index.html; http://jvn.jp/en/jp/JVN38227002/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000031
CVE: CVE-2014-1976
Published: 2014-03-18
Description: The Demaecan application 2.1.0 and earlier for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://jvn.jp/en/jp/JVN16263849/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000030; https://play.google.com/store/apps/details?id=com.demaecan.androidapp
CVE: CVE-2014-2532
Published: 2014-03-18
Description: sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://advisories.mageia.org/MGASA-2014-0143.html; http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc; http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
CVE: CVE-2014-2533
Published: 2014-03-18
Description: /sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain privileges by providing an arbitrary program name as a command-line argument.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://seclists.org/bugtraq/2014/Mar/66; http://seclists.org/bugtraq/2014/Mar/88; http://seclists.org/fulldisclosure/2014/Mar/124
CVE: CVE-2014-2534
Published: 2014-03-18
Description: /sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain sensitive information by reading "bad parameter" lines in error messages, as demonstrated by reading the root password hash in /etc/shadow.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/bugtraq/2014/Mar/66; http://seclists.org/bugtraq/2014/Mar/88; http://seclists.org/fulldisclosure/2014/Mar/124
CVE: CVE-2012-5641
Published: 2014-03-18
Description: Directory traversal vulnerability in the partition2 function in mochiweb_util.erl in MochiWeb before 2.4.0, as used in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1, allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the default URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2013/Jan/81; http://secunia.com/advisories/51765; http://www.securityfocus.com/bid/57313
CVE: CVE-2012-5650
Published: 2014-03-18
Description: Cross-site scripting (XSS) vulnerability in the Futon UI in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to the browser-based test suite.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-01/0056.html; http://mail-archives.apache.org/mod_mbox/couchdb-user/201301.mbox/%3C2FFF2FD7-8EAF-4EBF-AFDA-5AEB6EAC853F%40apache.org%3E; http://archives.neohapsis.com/archives/bugtraq/2013-01/0056.html
CVE: CVE-2013-0201
Published: 2014-03-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) QUERY_STRING to core/lostpassword/templates/resetpassword.php, (2) mime parameter to apps/files/ajax/mimeicon.php, or (3) token parameter to apps/gallery/sharing.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/89505; http://osvdb.org/89506; http://osvdb.org/89511
CVE: CVE-2013-2619
Published: 2014-03-18
Description: Directory traversal vulnerability in Aspen before 0.22 allows remote attackers to read arbitrary files via a .. (dot dot) to the default URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/121035/Aspen-0.8-Directory-Traversal.html; http://seclists.org/fulldisclosure/2013/Apr/2; http://www.exploit-db.com/exploits/24915
CVE: CVE-2013-2641
Published: 2014-03-18
Description: Directory traversal vulnerability in patience.cgi in Sophos Web Appliance before 3.7.8.2 allows remote attackers to read arbitrary files via the id parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.sophos.com/en-us/support/knowledgebase/118969.aspx; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130403-0_Sophos_Web_Protection_Appliance_Multiple_Vulnerabilities.txt; http://www.sophos.com/en-us/support/knowledgebase/118969.aspx
CVE: CVE-2013-2642
Published: 2014-03-18
Description: Sophos Web Appliance before 3.7.8.2 allows (1) remote attackers to execute arbitrary commands via shell metacharacters in the client-ip parameter to the Block page, when using the user_workstation variable in a customized template, and remote authenticated users to execute arbitrary commands via shell metacharacters in the (2) url parameter to the Diagnostic Tools functionality or (3) entries parameter to the Local Site List functionality.
CVSS Score: 9.3 (HIGH)
CWE: CWE-78
References: http://www.sophos.com/en-us/support/knowledgebase/118969.aspx; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130403-0_Sophos_Web_Protection_Appliance_Multiple_Vulnerabilities.txt; http://www.sophos.com/en-us/support/knowledgebase/118969.aspx
CVE: CVE-2013-2643
Published: 2014-03-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Sophos Web Appliance before 3.7.8.2 allow remote attackers to inject arbitrary web script or HTML via the (1) xss parameter in an allow action to rss.php, (2) msg parameter to end-user/errdoc.php, (3) h parameter to end-user/ftp_redirect.php, or (4) threat parameter to the Blocked component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.sophos.com/en-us/support/knowledgebase/118969.aspx; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130403-0_Sophos_Web_Protection_Appliance_Multiple_Vulnerabilities.txt; http://www.sophos.com/en-us/support/knowledgebase/118969.aspx
CVE: CVE-2013-3938
Published: 2014-03-18
Description: Integer overflow in xnview.exe in XnView 2.13 allows remote attackers to execute arbitrary code via a large NUM_ELEMENTS field in an IFD_ENTRY structure in a JXR file, which triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/56172; http://www.securityfocus.com/bid/66187; http://secunia.com/advisories/56172
CVE: CVE-2014-0057
Published: 2014-03-18
Description: The x_button method in the ServiceController (vmdb/app/controllers/service_controller.rb) in Red Hat CloudForms 3.0 Management Engine 5.2 allows remote attackers to execute arbitrary methods via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://rhn.redhat.com/errata/RHSA-2014-0215.html; http://secunia.com/advisories/57376; https://bugzilla.redhat.com/show_bug.cgi?id=1064140
CVE: CVE-2014-0132
Published: 2014-03-18
Description: The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: http://rhn.redhat.com/errata/RHSA-2014-0292.html; http://secunia.com/advisories/57412; http://secunia.com/advisories/57427
CVE: CVE-2014-1608
Published: 2014-03-18
Description: SQL injection vulnerability in the mci_file_get function in api/soap/mc_file_api.php in MantisBT before 1.2.16 allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a mc_issue_attachment_get SOAP request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/103118; http://secunia.com/advisories/61432; http://www.debian.org/security/2014/dsa-3030
CVE: CVE-2014-2087
Published: 2014-03-18
Description: Stack-based buffer overflow in the CDownloads_Deleted::UpdateDownload function in Downloads_Deleted.cpp in Free Download Manager 3.9.3 build 1360, 3.8 build 1173, 3.0 build 852, and earlier allows user-assisted remote attackers to execute arbitrary code via a long file name, which is then deleted from the download queue by the user.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://seclists.org/fulldisclosure/2014/Mar/137; http://www.securityfocus.com/archive/1/531465/100/0/threaded; http://www.securityfocus.com/bid/66211
CVE: CVE-2014-2241
Published: 2014-03-18
Description: The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=135c3faebb96f8f550bd4f318716f2e1e095a969; http://savannah.nongnu.org/bugs/?41697; http://secunia.com/advisories/57447
CVE: CVE-2014-2535
Published: 2014-03-18
Description: Directory traversal vulnerability in McAfee Web Gateway (MWG) 7.4.x before 7.4.1, 7.3.x before 7.3.2.6, and 7.2.0.9 and earlier allows remote authenticated users to read arbitrary files via a crafted request to the web filtering port.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/56958; http://www.securityfocus.com/bid/66193; https://exchange.xforce.ibmcloud.com/vulnerabilities/91772
CVE: CVE-2014-2536
Published: 2014-03-18
Description: Directory traversal vulnerability in McAfee Cloud Identity Manager 3.0, 3.1, and 3.5.1, McAfee Cloud Single Sign On (MCSSO) before 4.0.1, and Intel Expressway Cloud Access 360-SSO 2.1 and 2.5 allows remote authenticated users to read an unspecified file containing a hash of the administrator password via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/57368; http://secunia.com/advisories/57381; http://www.securityfocus.com/bid/66181
CVE: CVE-2014-2537
Published: 2014-03-18
Description: Memory leak in the TCP stack in the kernel in Sophos UTM before 9.109 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://blogs.sophos.com/2014/02/20/utm-up2date-9-109/; http://secunia.com/advisories/57344; http://www.securityfocus.com/bid/66231
CVE: CVE-2014-2120
Published: 2014-03-19
Description: Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2120; http://www.securityfocus.com/bid/66290; http://www.securitytracker.com/id/1029935
CVE: CVE-2014-2121
Published: 2014-03-19
Description: The Java-based software in Cisco Hosted Collaboration Solution (HCS) allows remote attackers to cause a denial of service (closing of TCP ports) via unspecified vectors, aka Bug IDs CSCug77633, CSCug77667, CSCug78266, CSCug82795, and CSCuh58643.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2121; http://www.securityfocus.com/bid/66283; http://www.securitytracker.com/id/1029933
CVE: CVE-2014-2122
Published: 2014-03-19
Description: Memory leak in the GUI in the Impact server in Cisco Hosted Collaboration Solution (HCS) allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, aka Bug ID CSCub58999.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2122; http://www.securityfocus.com/bid/66293; http://www.securitytracker.com/id/1029936
CVE: CVE-2014-1493
Published: 2014-03-19
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html
CVE: CVE-2014-1494
Published: 2014-03-19
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html
CVE: CVE-2014-1496
Published: 2014-03-19
Description: Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 might allow local users to gain privileges by modifying the extracted Mar contents during an update.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html; http://www.mozilla.org/security/announce/2014/mfsa2014-16.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2014-1497
Published: 2014-03-19
Description: The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process heap memory, cause a denial of service (out-of-bounds read and application crash), or possibly have unspecified other impact via a crafted WAV file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html
CVE: CVE-2014-1498
Published: 2014-03-19
Description: The crypto.generateCRMFRequest method in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not properly validate a certain key type, which allows remote attackers to cause a denial of service (application crash) via vectors that trigger generation of a key that supports the Elliptic Curve ec-dual-use algorithm.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-347
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html
CVE: CVE-2014-1499
Published: 2014-03-19
Description: Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to spoof the domain name in the WebRTC (1) camera or (2) microphone permission prompt by triggering navigation at a certain time during generation of this prompt.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html
CVE: CVE-2014-1500
Published: 2014-03-19
Description: Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (resource consumption and application hang) via onbeforeunload events that trigger background JavaScript execution.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html
CVE: CVE-2014-1501
Published: 2014-03-19
Description: Mozilla Firefox before 28.0 on Android allows remote attackers to bypass the Same Origin Policy and access arbitrary file: URLs via vectors involving the "Open Link in New Tab" menu selection.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html; http://www.mozilla.org/security/announce/2014/mfsa2014-21.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2014-1502
Published: 2014-03-19
Description: The (1) WebGL.compressedTexImage2D and (2) WebGL.compressedTexSubImage2D functions in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to bypass the Same Origin Policy and render content in a different domain via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-346
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html
CVE: CVE-2014-1504
Published: 2014-03-19
Description: The session-restore feature in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not consider the Content Security Policy of a data: URL, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document that is accessed after a browser restart.
CVSS Score: 2.6 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html
CVE: CVE-2014-1505
Published: 2014-03-19
Description: The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information, and possibly bypass the Same Origin Policy and read text from a different domain, via a timing attack involving feDisplacementMap elements, a related issue to CVE-2013-1693.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html
CVE: CVE-2014-1506
Published: 2014-03-19
Description: Directory traversal vulnerability in Android Crash Reporter in Mozilla Firefox before 28.0 on Android allows attackers to trigger the transmission of local files to arbitrary servers, or cause a denial of service (application crash), via a crafted application that specifies Android Crash Reporter arguments.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2014-03/0153.html; http://www.mozilla.org/security/announce/2014/mfsa2014-24.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2014-1507
Published: 2014-03-19
Description: Directory traversal vulnerability in the DeviceStorage API in Mozilla FirefoxOS before 1.2.2 allows attackers to bypass the media sandbox protection mechanism, and read or modify arbitrary files, via a crafted application that uses a relative pathname for a DeviceStorageFile object.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://www.mozilla.org/security/announce/2014/mfsa2014-25.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html; https://bugzilla.mozilla.org/show_bug.cgi?id=940684
CVE: CVE-2014-1508
Published: 2014-03-19
Description: The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process memory, cause a denial of service (out-of-bounds read and application crash), or possibly bypass the Same Origin Policy via vectors involving MathML polygon rendering.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html
CVE: CVE-2014-1509
Published: 2014-03-19
Description: Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, as used in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25, allows remote attackers to execute arbitrary code via a crafted extension that renders fonts in a PDF document.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html
CVE: CVE-2014-1510
Published: 2014-03-19
Description: The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript code with chrome privileges by using an IDL fragment to trigger a window.open call.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html
CVE: CVE-2014-1511
Published: 2014-03-19
Description: Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html
CVE: CVE-2014-1512
Published: 2014-03-19
Description: Use-after-free vulnerability in the TypeObject class in the JavaScript engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary code by triggering extensive memory consumption while garbage collection is occurring, as demonstrated by improper handling of BumpChunk objects.
CVSS Score: 10.0 (HIGH)
CWE: CWE-416
References: http://archives.neohapsis.com/archives/bugtraq/2014-03/0145.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
CVE: CVE-2014-1513
Published: 2014-03-19
Description: TypedArrayObject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not prevent a zero-length transition during use of an ArrayBuffer object, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based out-of-bounds write or read) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html