Vulnerability Details : CVE-2015-7201
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Vulnerability category: Memory CorruptionExecute codeDenial of service
Products affected by CVE-2015-7201
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.4.0:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-7201
3.63%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 92 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-7201
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
CWE ids for CVE-2015-7201
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-7201
-
http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html
openSUSE-SU-2016:0307-1: moderate: Security update for seamonkey
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174253.html
[SECURITY] Fedora 22 Update: firefox-43.0-1.fc22
-
http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html
openSUSE-SU-2016:0308-1: moderate: Security update for Seamonkey
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1203135
1203135 - crash in link_shaders
-
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00021.html
[security-announce] SUSE-SU-2015:2334-1: important: Security update for
-
https://security.gentoo.org/glsa/201512-10
Mozilla Products: Multiple vulnerabilities (GLSA 201512-10) — Gentoo security
-
http://www.debian.org/security/2015/dsa-3422
Debian -- Security Information -- DSA-3422-1 iceweasel
-
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00022.html
[security-announce] SUSE-SU-2015:2335-1: important: Security update for
-
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00049.html
[security-announce] openSUSE-SU-2015:2406-1: important: Security update
-
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00023.html
[security-announce] SUSE-SU-2015:2336-1: important: Security update for
-
http://rhn.redhat.com/errata/RHSA-2015-2657.html
RHSA-2015:2657 - Security Advisory - Red Hat Customer Portal
-
http://www.mozilla.org/security/announce/2015/mfsa2015-134.html
Miscellaneous memory safety hazards (rv:43.0 / rv:38.5) — MozillaVendor Advisory
-
http://www.securitytracker.com/id/1034426
Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code, Obtain Potentially Sensitive Information, Bypass Same-Origin Policy, and Cause Denial of Service Conditions - SecurityTracker
-
http://lists.opensuse.org/opensuse-updates/2015-12/msg00104.html
openSUSE-SU-2015:2353-1: moderate: Security update for MozillaFirefox
-
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
Oracle Linux Bulletin - October 2015
-
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
Oracle Linux Bulletin - January 2016
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html
[SECURITY] Fedora 23 Update: firefox-43.0-1.fc23
-
http://www.ubuntu.com/usn/USN-2833-1
USN-2833-1: Firefox vulnerabilities | Ubuntu security notices
-
http://www.securityfocus.com/bid/79279
Mozilla Firefox Multiple Security Vulnerabilities
-
http://www.debian.org/security/2016/dsa-3432
Debian -- Security Information -- DSA-3432-1 icedove
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1224100
1224100 - "Conditional jump or move depends on uninitialised value(s)" at imgFrame::Optimize
-
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00038.html
[security-announce] openSUSE-SU-2015:2380-1: important: Security update
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1225250
1225250 - «failed assertion "fPixelRef->rowBytes() == fRowBytes"» with canvas, shadow, drawImage(HTMLVideoElement)
-
http://www.ubuntu.com/usn/USN-2859-1
USN-2859-1: Thunderbird vulnerabilities | Ubuntu security notices
Jump to