7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.058 Low
EPSS
Percentile
92.6%
Jesse Ruderman, Mats Palmgren, Byron Campen, and Steve Fink reported
memory safety problems and crashes that affect Firefox ESR 31.6 and
Firefox 37.
Gary Kwong, Andrew McCreight, Christian Holler, Jesse Ruderman, Mats
Palmgren, Jon Coppeard, and Milan Sreckovic reported memory safety
problems and crashes that affect Firefox 37.
Using the Address Sanitizer tool, security researcher Atte Kettunen
found a buffer overflow during the rendering of SVG format graphics when
combined with specific CSS properties on a page. This results in a
potentially exploitable crash.
Security researcher Alex Verstak reported that <meta name="referrer"> is
ignored when a link is opened through the context menu or a middle-click
by mouse. This means that, in some situations, the referrer policy is
ignored when opening links in new tabs and may cause some pages to open
without an HTTP Referer header being set according to the author’s
intended policy.
Security researcher Dougall Johnson reported an out-of-bounds read and
write in asm.js during JavaScript validation due to an error in how heap
lengths are defined. This results in a potentially exploitable crash and
could allow for the reading of random memory which may contain sensitive
data.
Security researcher Scott Bell used the Address Sanitizer tool to
discover a use-after-free error during the processing of text when
vertical text is enabled. This leads to a potentially exploitable crash.
Security researchers Tyson Smith and Jesse Schwartzentruber reported a
use-after-free during the shutdown process. This was caused by a race
condition when media decoder threads are created during the shutdown
process in some circumstances. This leads to a potentially exploitable
crash when triggered.
Security researcher Ucha Gobejishvili used the Address Sanitizer tool to
find a buffer overflow while parsing compressed XML content. This was
due to an error in how buffer space is created and modified when
handling large amounts of XML data. This results in a potentially
exploitable crash.
Security researcher laf.intel reported a buffer overflow and
out-of-bounds read in the libstagefright library while parsing invalid
metadata in MP4 video files. This can lead to a potentially exploitable
crash.
Mozilla developer Mark Hammond reported a flaw in how WebChannel.jsm
handles message traffic. He found that when a trusted page is hosted
within an <iframe> on an untrusted third-party untrusted framing page,
the untrusted page could intercept webchannel responses meant for the
trusted page, bypassing origin restrictions.
access.redhat.com/security/cve/CVE-2015-2708
access.redhat.com/security/cve/CVE-2015-2709
access.redhat.com/security/cve/CVE-2015-2710
access.redhat.com/security/cve/CVE-2015-2711
access.redhat.com/security/cve/CVE-2015-2712
access.redhat.com/security/cve/CVE-2015-2713
access.redhat.com/security/cve/CVE-2015-2715
access.redhat.com/security/cve/CVE-2015-2716
access.redhat.com/security/cve/CVE-2015-2717
access.redhat.com/security/cve/CVE-2015-2718
www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox38