Vulnerability Details : CVE-2015-7200
The CryptoKey interface implementation in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lacks status checking, which allows attackers to have an unspecified impact via vectors related to a cryptographic key.
Products affected by CVE-2015-7200
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.3.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-7200
1.10%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 85 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-7200
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2015-7200
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-7200
-
http://lists.opensuse.org/opensuse-updates/2015-12/msg00037.html
openSUSE-SU-2015:2229-1: moderate: Security update for MozillaThunderbir
-
http://rhn.redhat.com/errata/RHSA-2015-2519.html
RHSA-2015:2519 - Security Advisory - Red Hat Customer Portal
-
http://www.ubuntu.com/usn/USN-2785-1
USN-2785-1: Firefox vulnerabilities | Ubuntu security notices
-
https://security.gentoo.org/glsa/201512-10
Mozilla Products: Multiple vulnerabilities (GLSA 201512-10) — Gentoo security
-
http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00021.html
[security-announce] SUSE-SU-2015:1981-1: important: Security update for
-
http://www.securityfocus.com/bid/77411
Mozilla Firefox Multiple Security Vulnerabilities
-
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
Oracle Solaris Bulletin - April 2016
-
http://www.debian.org/security/2015/dsa-3393
Debian -- Security Information -- DSA-3393-1 iceweasel
-
http://rhn.redhat.com/errata/RHSA-2015-1982.html
RHSA-2015:1982 - Security Advisory - Red Hat Customer Portal
-
http://www.debian.org/security/2015/dsa-3410
Debian -- Security Information -- DSA-3410-1 icedove
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1204155
1204155 - (CVE-2015-7200) Missing status check in CryptoKey::SetSymKey creates potential security bug
-
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
Oracle Linux Bulletin - October 2015
-
http://lists.opensuse.org/opensuse-updates/2015-12/msg00049.html
openSUSE-SU-2015:2245-1: moderate: Security update for Mozilla Thunderbi
-
http://www.ubuntu.com/usn/USN-2819-1
USN-2819-1: Thunderbird vulnerabilities | Ubuntu security notices
-
http://www.securitytracker.com/id/1034069
Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code, Obtain Potentially Sensitive Information, Bypass Security Restrictions, and Conduct Cross-Site Scripting Attacks - SecurityTrack
-
http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html
[security-announce] SUSE-SU-2015:1926-1: important: Security update for
-
http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html
[security-announce] openSUSE-SU-2015:1942-1: important: Security update
-
http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html
[security-announce] SUSE-SU-2015:2081-1: important: Security update for
-
http://www.mozilla.org/security/announce/2015/mfsa2015-131.html
Vulnerabilities found through code inspection — MozillaVendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html
[security-announce] SUSE-SU-2015:1978-1: important: Security update for
Jump to