# CVEs published 2015-09-24 30 CVEs were published on September 24, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2015-6303](https://cve.now/CVE-2015-6303.md): The Cisco Spark application 2015-07-04 for mobile operating systems does not properly verify X.509 certificates from SSL servers, which allo (no CVSS) - [CVE-2015-6304](https://cve.now/CVE-2015-6304.md): Cross-site request forgery (CSRF) vulnerability in Cisco TelePresence Server software 3.0(2.24) allows remote attackers to hijack the authen (no CVSS) - [CVE-2015-4476](https://cve.now/CVE-2015-4476.md): Mozilla Firefox before 41.0 on Android allows user-assisted remote attackers to spoof address-bar attributes by leveraging lack of navigatio (no CVSS) - [CVE-2015-4500](https://cve.now/CVE-2015-4500.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote atta (no CVSS) - [CVE-2015-4501](https://cve.now/CVE-2015-4501.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 41.0 allow remote attackers to cause a denial of servic (no CVSS) - [CVE-2015-4502](https://cve.now/CVE-2015-4502.md): js/src/proxy/Proxy.cpp in Mozilla Firefox before 41.0 mishandles certain receiver arguments, which allows remote attackers to bypass intende (no CVSS) - [CVE-2015-4503](https://cve.now/CVE-2015-4503.md): The TCP Socket API implementation in Mozilla Firefox before 41.0 mishandles array boundaries that were established with a navigator.mozTCPSo (no CVSS) - [CVE-2015-4504](https://cve.now/CVE-2015-4504.md): The lut\_inverse\_interp16 function in the QCMS library in Mozilla Firefox before 41.0 allows remote attackers to obtain sensitive information (no CVSS) - [CVE-2015-4505](https://cve.now/CVE-2015-4505.md): updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allows local users to write to arbitrary files by con (no CVSS) - [CVE-2015-4506](https://cve.now/CVE-2015-4506.md): Buffer overflow in the vp9\_init\_context\_buffers function in libvpx, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3, (no CVSS) - [CVE-2015-4507](https://cve.now/CVE-2015-4507.md): The SavedStacks class in the JavaScript implementation in Mozilla Firefox before 41.0, when the Debugger API is enabled, allows remote attac (no CVSS) - [CVE-2015-4508](https://cve.now/CVE-2015-4508.md): Mozilla Firefox before 41.0, when reader mode is enabled, allows remote attackers to spoof the relationship between address-bar URLs and web (no CVSS) - [CVE-2015-4509](https://cve.now/CVE-2015-4509.md): Use-after-free vulnerability in the HTMLVideoElement interface in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote (no CVSS) - [CVE-2015-4510](https://cve.now/CVE-2015-4510.md): Race condition in the WorkerPrivate::NotifyFeatures function in Mozilla Firefox before 41.0 allows remote attackers to execute arbitrary cod (no CVSS) - [CVE-2015-4511](https://cve.now/CVE-2015-4511.md): Heap-based buffer overflow in the nestegg\_track\_codec\_data function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows r (no CVSS) - [CVE-2015-4512](https://cve.now/CVE-2015-4512.md): gfx/2d/DataSurfaceHelpers.cpp in Mozilla Firefox before 41.0 on Linux improperly attempts to use the Cairo library with 32-bit color-depth s (no CVSS) - [CVE-2015-4516](https://cve.now/CVE-2015-4516.md): Mozilla Firefox before 41.0 allows remote attackers to bypass certain ECMAScript 5 (aka ES5) API protection mechanisms and modify immutable (no CVSS) - [CVE-2015-4517](https://cve.now/CVE-2015-4517.md): NetworkUtils.cpp in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service ( (no CVSS) - [CVE-2015-4519](https://cve.now/CVE-2015-4519.md): Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow user-assisted remote attackers to bypass intended access restrictions and (no CVSS) - [CVE-2015-4520](https://cve.now/CVE-2015-4520.md): Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to bypass CORS preflight protection mechanisms by levera (no CVSS) - [CVE-2015-4521](https://cve.now/CVE-2015-4521.md): The ConvertDialogOptions function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a de (no CVSS) - [CVE-2015-4522](https://cve.now/CVE-2015-4522.md): The nsUnicodeToUTF8::GetMaxLength function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to c (no CVSS) - [CVE-2015-7174](https://cve.now/CVE-2015-7174.md): The nsAttrAndChildArray::GrowBy function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cau (no CVSS) - [CVE-2015-7175](https://cve.now/CVE-2015-7175.md): The XULContentSinkImpl::AddText function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cau (no CVSS) - [CVE-2015-7176](https://cve.now/CVE-2015-7176.md): The AnimationThread function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 uses an incorrect argument to the sscanf functi (no CVSS) - [CVE-2015-7177](https://cve.now/CVE-2015-7177.md): The InitTextures function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of (no CVSS) - [CVE-2015-7178](https://cve.now/CVE-2015-7178.md): The ProgramBinary::linkAttributes function in libGLES in ANGLE, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on W (no CVSS) - [CVE-2015-7179](https://cve.now/CVE-2015-7179.md): The VertexBufferInterface::reserveVertexSpace function in libGLES in ANGLE, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x befo (no CVSS) - [CVE-2015-7180](https://cve.now/CVE-2015-7180.md): The ReadbackResultWriterD3D11::Run function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 misinterprets the return value o (no CVSS) - [CVE-2015-7327](https://cve.now/CVE-2015-7327.md): Mozilla Firefox before 41.0 does not properly restrict the availability of High Resolution Time API times, which allows remote attackers to (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-09-24 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.