CVE-2015-4497
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
7.3 High
AI Score
Confidence
Low
0.245 Low
EPSS
Percentile
96.7%
Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute arbitrary code by leveraging improper interaction between resize events and changes to Cascading Style Sheets (CSS) token sequences for a CANVAS element.
Affected configurations
References
lists.opensuse.org/opensuse-security-announce/2015-09/msg00013.html
lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html
lists.opensuse.org/opensuse-updates/2015-09/msg00000.html
rhn.redhat.com/errata/RHSA-2015-1693.html
www.debian.org/security/2015/dsa-3345
www.mozilla.org/security/announce/2015/mfsa2015-94.html
www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
www.securityfocus.com/bid/76502
www.securitytracker.com/id/1033397
www.ubuntu.com/usn/USN-2723-1
www.zerodayinitiative.com/advisories/ZDI-15-406
bugzilla.mozilla.org/show_bug.cgi?id=1164766
bugzilla.mozilla.org/show_bug.cgi?id=1175278
Related
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
7.3 High
AI Score
Confidence
Low
0.245 Low
EPSS
Percentile
96.7%