Vulnerability Details : CVE-2015-7216
The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly enables the JasPer decoder, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JPEG 2000 image.
Vulnerability category: Input validationDenial of service
Products affected by CVE-2015-7216
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-7216
2.79%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 89 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-7216
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
CWE ids for CVE-2015-7216
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-7216
-
http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html
openSUSE-SU-2016:0307-1: moderate: Security update for seamonkey
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174253.html
[SECURITY] Fedora 22 Update: firefox-43.0-1.fc22
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1197059
1197059 - (CVE-2015-7216) Firefox in Linux is using Jasper which is unmaintained and vulnerable
-
http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html
openSUSE-SU-2016:0308-1: moderate: Security update for Seamonkey
-
https://security.gentoo.org/glsa/201512-10
Mozilla Products: Multiple vulnerabilities (GLSA 201512-10) — Gentoo security
-
http://www.mozilla.org/security/announce/2015/mfsa2015-143.html
Linux file chooser crashes on malformed images due to flaws in Jasper library — MozillaVendor Advisory
-
http://www.securitytracker.com/id/1034426
Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code, Obtain Potentially Sensitive Information, Bypass Same-Origin Policy, and Cause Denial of Service Conditions - SecurityTracker
-
http://lists.opensuse.org/opensuse-updates/2015-12/msg00104.html
openSUSE-SU-2015:2353-1: moderate: Security update for MozillaFirefox
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html
[SECURITY] Fedora 23 Update: firefox-43.0-1.fc23
-
http://www.ubuntu.com/usn/USN-2833-1
USN-2833-1: Firefox vulnerabilities | Ubuntu security notices
-
http://www.securityfocus.com/bid/79278
Mozilla Firefox MFSA 2015-143 Multiple Security Vulnerabilities
Jump to