Lucene search
Mozilla FoundationMFSA2015-138HistoryDec 15, 2015 - 12:00 a.m.
Use-after-free in WebRTC when datachannel is used after being destroyed — Mozilla
2015-12-1500:00:00
Mozilla Foundation
www.mozilla.org
26
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.057 Low
EPSS
Percentile
93.4%
Security researcher Looben Yang reported a use-after-free error in WebRTC that occurs due to timing issues in WebRTC when closing channels. WebRTC may still believe is has a datachannel open after another WebRTC function has closed it. This results in attempts to use the now destroyed datachannel, leading to a potentially exploitable crash.
Affected configurations
Node
mozillafirefoxRange<43
ORmozillafirefox_esrRange<38.5
ORmozillafirefox_osRange<2.5
| CPE | Name | Operator | Version |
|---|---|---|---|
| firefox | lt | 43 | |
| firefox esr | lt | 38.5 | |
| firefox os | lt | 2.5 |
Related
ubuntucve
ubuntucve
CVE-2015-7210
2015-12-15 00:00:00
prion
prion
Design/Logic Flaw
2015-12-16 11:59:00
nvd
nvd
CVE-2015-7210
2015-12-16 11:59:08
openvas
openvas
Mozilla Firefox Security Advisory (MFSA2015-138) - Linux
2021-11-11 00:00:00
Mozilla Firefox ESR Multiple Vulnerabilities (Dec 2015) - Windows
2015-12-18 00:00:00
Debian Security Advisory DSA 3422-1 (iceweasel - security update)
2015-12-16 00:00:00
cve
cve
CVE-2015-7210
2015-12-16 11:59:08
cvelist
cvelist
CVE-2015-7210
2015-12-16 11:00:00
nessus
nessus
Firefox ESR < 38.5 Multiple Vulnerabilities (Mac OS X)
2015-12-17 00:00:00
Firefox ESR < 38.5 Multiple Vulnerabilities
2015-12-17 00:00:00
Debian DSA-3422-1 : iceweasel - security update
2015-12-17 00:00:00
debian
debian
[SECURITY] [DSA 3422-1] iceweasel security update
2015-12-16 18:27:59
redhat
redhat
(RHSA-2015:2657) Critical: firefox security update
2015-12-16 00:00:00
suse
suse
Security update for xulrunner (important)
2015-12-28 17:10:26
Security update for Mozilla Thunderbird (important)
2015-12-31 19:13:51
Security update for MozillaFirefox (important)
2015-12-21 21:10:52
veracode
veracode
Arbitrary Code Execution
2019-05-02 05:51:51
Arbitrary Code Execution
2019-05-02 05:51:52
oraclelinux
oraclelinux
firefox security update
2015-12-16 00:00:00
mageia
mageia
Updated thunderbird packages fix security vulnerabilities
2015-12-28 22:23:26
Updated firefox packages fix security vulnerabilities
2015-12-17 00:01:04
Updated iceape packages fix security vulnerability
2016-03-25 09:38:37
centos
centos
firefox security update
2015-12-16 20:02:04
freebsd
freebsd
mozilla -- multiple vulnerabilities
2015-12-15 00:00:00
ubuntu
ubuntu
Firefox vulnerabilities
2015-12-15 00:00:00
archlinux
archlinux
firefox: multiple issues
2015-12-15 00:00:00
kaspersky
kaspersky
KLA10723 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR
2015-12-15 00:00:00
gentoo
gentoo
Mozilla Products: Multiple vulnerabilities
2015-12-30 00:00:00
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.057 Low
EPSS
Percentile
93.4%
Related for MFSA2015-138