Lucene search

K
mozillaMozilla FoundationMFSA2015-143
HistoryDec 15, 2015 - 12:00 a.m.

Linux file chooser crashes on malformed images due to flaws in Jasper library — Mozilla

2015-12-1500:00:00
Mozilla Foundation
www.mozilla.org
18

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.031 Low

EPSS

Percentile

91.0%

Security researcher Gustavo Grieco reported that on Linux Gnome systems the dialog for choosing local files uses the operating system’s gdk-pixbuf library to render thumbnails for image file types. This library supports various image decoders, and Grieco reported that the Jasper and TGA decoders were unmaintained and have several known vulnerabilities. Firefox has disabled the use of those decoders in gdk-pixbuf.

Affected configurations

Vulners
Node
mozillafirefoxRange<43
CPENameOperatorVersion
firefoxlt43

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.031 Low

EPSS

Percentile

91.0%