Mozilla FoundationMFSA2015-112Vulnerabilities found through code inspection — Mozilla
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.072 Low
EPSS
Percentile
94.1%
Security researcher Ronald Crane reported eight vulnerabilities affecting released code that were found through code inspection. These included several potential memory safety issues resulting from the use of snprintf, one use of unowned memory, one use of a string without overflow checks, and five memory safety bugs. These do not all have clear mechanisms to be exploited through web content but are vulnerable if a mechanism can be found to trigger them.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| firefox | lt | 41 | |
| firefox esr | lt | 38.3 | |
| firefox os | lt | 2.5 | |
| seamonkey | lt | 2.38 | |
| thunderbird | lt | 38.3 |
References
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4517
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4521
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4522
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7174
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7175
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7176
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7177
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7180
bugzilla.mozilla.org/show_bug.cgi?id=1168959
bugzilla.mozilla.org/show_bug.cgi?id=1170246
bugzilla.mozilla.org/show_bug.cgi?id=1170794
bugzilla.mozilla.org/show_bug.cgi?id=1172055
bugzilla.mozilla.org/show_bug.cgi?id=1172189
bugzilla.mozilla.org/show_bug.cgi?id=1174479
bugzilla.mozilla.org/show_bug.cgi?id=1186725
bugzilla.mozilla.org/show_bug.cgi?id=1191463
Related
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.072 Low
EPSS
Percentile
94.1%