Arbitrary Code Execution

2019-01-1509:05:20

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.201 Low

EPSS

Percentile

96.3%

JSON

firefox is vulnerable to arbitrary code execution attacks. The vulnerability exists as the asm.js implementation in Mozilla Firefox before 36.0.3, Firefox ESR 31.x before 31.5.2, and SeaMonkey before 2.33.1 does not properly determine the cases in which bounds checking may be safely skipped during JIT compilation and heap access, which allows remote attackers to read or write to unintended memory locations, and consequently execute arbitrary code, via crafted JavaScript.

CPENameOperatorVersion
firefoxeq3.6.17__1.el6_0
firefoxeq31.5.0__1.el6_6
firefoxeq10.0.8__1.el6_3
firefoxeq10.0.5__1.el6_2
firefoxeq24.4.0__1.el6_5
firefoxeq1.5.0.12__15.el5_1
firefoxeq3.6.14__4.el6_0
firefoxeq17.0.10__1.el6_4
firefoxeq3.6.26__1.el5_7
firefoxeq3.0.11__2.el5_3

Name	Operator	Version
firefox	eq	3.6.17__1.el6_0
firefox	eq	31.5.0__1.el6_6
firefox	eq	10.0.8__1.el6_3
firefox	eq	10.0.5__1.el6_2
firefox	eq	24.4.0__1.el6_5
firefox	eq	1.5.0.12__15.el5_1
firefox	eq	3.6.14__4.el6_0
firefox	eq	17.0.10__1.el6_4
firefox	eq	3.6.26__1.el5_7
firefox	eq	3.0.11__2.el5_3