# CVEs published 2015-11-05 23 CVEs were published on November 5, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2015-4513](https://cve.now/CVE-2015-4513.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote atta (no CVSS) - [CVE-2015-4514](https://cve.now/CVE-2015-4514.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 42.0 allow remote attackers to cause a denial of servic (no CVSS) - [CVE-2015-4515](https://cve.now/CVE-2015-4515.md): Mozilla Firefox before 42.0, when NTLM v1 is enabled for HTTP authentication, allows remote attackers to obtain sensitive hostname informati (no CVSS) - [CVE-2015-4518](https://cve.now/CVE-2015-4518.md): The Reader View implementation in Mozilla Firefox before 42.0 has an improper whitelist, which makes it easier for remote attackers to bypas (no CVSS) - [CVE-2015-7181](https://cve.now/CVE-2015-7181.md): The sec\_asn1d\_parse\_leaf function in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox be (no CVSS) - [CVE-2015-7182](https://cve.now/CVE-2015-7182.md): Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used (no CVSS) - [CVE-2015-7183](https://cve.now/CVE-2015-7183.md): Integer overflow in the PL\_ARENA\_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) befo (no CVSS) - [CVE-2015-7185](https://cve.now/CVE-2015-7185.md): Mozilla Firefox before 42.0 on Android does not ensure that the address bar is restored upon fullscreen-mode exit, which allows remote attac (no CVSS) - [CVE-2015-7186](https://cve.now/CVE-2015-7186.md): Mozilla Firefox before 42.0 on Android allows user-assisted remote attackers to bypass the Same Origin Policy and trigger (1) a download or (no CVSS) - [CVE-2015-7187](https://cve.now/CVE-2015-7187.md): The Add-on SDK in Mozilla Firefox before 42.0 misinterprets a "script: false" panel setting, which makes it easier for remote attackers to c (no CVSS) - [CVE-2015-7188](https://cve.now/CVE-2015-7188.md): Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to bypass the Same Origin Policy for an IP address origi (no CVSS) - [CVE-2015-7189](https://cve.now/CVE-2015-7189.md): Race condition in the JPEGEncoder function in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allows remote attackers to execut (no CVSS) - [CVE-2015-7190](https://cve.now/CVE-2015-7190.md): The Search feature in Mozilla Firefox before 42.0 on Android through 4.4 supports search-engine URL registration through an intent and can a (no CVSS) - [CVE-2015-7191](https://cve.now/CVE-2015-7191.md): Mozilla Firefox before 42.0 on Android improperly restricts URL strings in intents, which allows attackers to conduct cross-site scripting ( (no CVSS) - [CVE-2015-7192](https://cve.now/CVE-2015-7192.md): The accessibility-tools feature in Mozilla Firefox before 42.0 on OS X improperly interacts with the implementation of the TABLE element, wh (no CVSS) - [CVE-2015-7193](https://cve.now/CVE-2015-7193.md): Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly follow the CORS cross-origin request algorithm for the POST method i (no CVSS) - [CVE-2015-7194](https://cve.now/CVE-2015-7194.md): Buffer underflow in libjar in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allows remote attackers to cause a denial of serv (no CVSS) - [CVE-2015-7195](https://cve.now/CVE-2015-7195.md): The URL parsing implementation in Mozilla Firefox before 42.0 improperly recognizes escaped characters in hostnames within Location headers, (no CVSS) - [CVE-2015-7196](https://cve.now/CVE-2015-7196.md): Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, when a Java plugin is enabled, allow remote attackers to cause a denial of ser (no CVSS) - [CVE-2015-7197](https://cve.now/CVE-2015-7197.md): Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly control the ability of a web worker to create a WebSocket object, wh (no CVSS) - [CVE-2015-7198](https://cve.now/CVE-2015-7198.md): Buffer overflow in the rx::TextureStorage11 class in ANGLE, as used in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, allows (no CVSS) - [CVE-2015-7199](https://cve.now/CVE-2015-7199.md): The (1) AddWeightedPathSegLists and (2) SVGPathSegListSMILType::Interpolate functions in Mozilla Firefox before 42.0 and Firefox ESR 38.x be (no CVSS) - [CVE-2015-7200](https://cve.now/CVE-2015-7200.md): The CryptoKey interface implementation in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lacks status checking, which allows a (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-11-05 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.