Mozilla FoundationMFSA2015-66Vulnerabilities found through code inspection — Mozilla
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.046 Low
EPSS
Percentile
92.4%
Security researcher Ronald Crane reported seven vulnerabilities affecting released code that he found through code inspection. These included three uses of uninitialized memory, one poor validation leading to an exploitable crash, one read of unowned memory in zip files, and two buffer overflows. These do not all have clear mechanisms to be exploited through web content but are vulnerable if a mechanism can be found to trigger them.
| CPE | Name | Operator | Version |
|---|---|---|---|
| firefox | lt | 39 | |
| firefox esr | lt | 31.8 | |
| firefox esr | lt | 38.1 | |
| firefox os | lt | 2.2 | |
| seamonkey | lt | 2.35 | |
| thunderbird | lt | 31.8 | |
| thunderbird | lt | 38.1 |
References
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2734
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2735
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2736
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2737
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2738
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2739
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2740
bugzilla.mozilla.org/show_bug.cgi?id=1166082
bugzilla.mozilla.org/show_bug.cgi?id=1166900
bugzilla.mozilla.org/show_bug.cgi?id=1167332
bugzilla.mozilla.org/show_bug.cgi?id=1167356
bugzilla.mozilla.org/show_bug.cgi?id=1167888
bugzilla.mozilla.org/show_bug.cgi?id=1168207
bugzilla.mozilla.org/show_bug.cgi?id=1170809
Related
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.046 Low
EPSS
Percentile
92.4%