CVE-2015-2712
At a glance
- Source
- NVD
- EPSS
- EPSS 3.60 % · percentile 89 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mozilla
- NVD status
- Modified
Description
The asm.js implementation in Mozilla Firefox before 38.0 does not properly determine heap lengths during identification of cases in which bounds checking may be safely skipped, which allows remote attackers to trigger out-of-bounds write operations and possibly execute arbitrary code, or trigger out-of-bounds read operations and possibly obtain sensitive information from process memory, via crafted JavaScript.
Weaknesses (CWE)
- CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
References
- http://www.ubuntu.com/usn/USN-2602-1
- http://www.securityfocus.com/bid/74611
- https://bugzilla.mozilla.org/show_bug.cgi?id=1152280
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://lists.opensuse.org/opensuse-updates/2015-05/msg00036.html
- https://security.gentoo.org/glsa/201605-06
- http://www.mozilla.org/security/announce/2015/mfsa2015-50.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2015-2802
- GCVE · GCVE-0-2015-2712
CERT-FR advisories
- CERTFR-2015-AVI-371 — Multiples vulnérabilités dans les produits Mozilla · cert.ssi.gouv.fr
- CERTFR-2015-AVI-221 — Multiples vulnérabilités dans les produits Mozilla · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*≤ 37.0.2cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |