ID CVE-2015-4497
Summary Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute arbitrary code by leveraging improper interaction between resize events and changes to Cascading Style Sheets (CSS) token sequences for a CANVAS element. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
References
Vulnerable Configurations
  • cpe:2.3:a:mozilla:firefox:40.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:40.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox_esr:38.0:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox_esr:38.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox_esr:38.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox_esr:38.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox_esr:38.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox_esr:38.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox_esr:38.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox_esr:38.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox_esr:38.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox_esr:38.2.0:*:*:*:*:*:*:*
CVSS
Base: 10.0 (as of 22-12-2016 - 02:59)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:C/I:C/A:C
redhat via4
advisories
rhsa
id RHSA-2015:1693
rpms
  • firefox-0:38.2.1-1.el5_11
  • firefox-0:38.2.1-1.el6_7
  • firefox-0:38.2.1-1.el7_1
refmap via4
bid 76502
confirm
debian DSA-3345
misc http://www.zerodayinitiative.com/advisories/ZDI-15-406
sectrack 1033397
suse
  • SUSE-SU-2015:1504
  • SUSE-SU-2015:2081
  • openSUSE-SU-2015:1492
ubuntu USN-2723-1
Last major update 22-12-2016 - 02:59
Published 29-08-2015 - 19:59
Back to Top