Mozilla Firefox up to 40.0.2 nsIPresShell Use-After-Free buffer overflow : 8/28/2015 10:58:01 AM
 | Communicate with co-workers in real time. Used by Netflix, Dropbox & Salesforce. $0/unlimited users. Get started >> From our sponsors  |
| Vulnerability Advisories |
| Vulnerabilities of scip VulDB |
Mozilla Firefox up to 40.0.2 nsIPresShell Use-After-Free buffer overflow
8/26/2015 7:00:00 PM
General
scipID: 77470
Affected: Mozilla Firefox up to 40.0.2
Published: 08/27/2015 (Ucha Gobejishvili)
Risk: critical
Created: 08/28/2015
Entry: 76% complete
Summary
A vulnerability was found in Mozilla Firefox up to 40.0.2. It has been declared as critical. This vulnerability affects an unknown function of the component nsIPresShell. The manipulation with an unknown input leads to a buffer overflow vulnerability (use-after-free). As an impact it is known to affect confidentiality, integrity, and availability.
The weakness was published 08/27/2015 by Ucha Gobejishvili as MFSA 2015-94 as confirmed security advisory (Website). The advisory is shared for download at mozilla.org. This vulnerability was named CVE-2015-4497. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available.
Upgrading to version 40.0.3 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability. The vulnerability is also documented in the databases at X-Force (105897) and SecurityTracker (ID 1033397).CVSS
Base Score: 6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P) [?]
Temp Score: 5.0 (CVSS2#E:U/RL:OF/RC:C) [?]
CPE
Exploiting
Class: Buffer overflow
Local: No
Remote: Yes
Availability: No
Status: Unproven
Countermeasures
Recommended: Upgrade
Status: Official fix
Reaction Time: 0 days since reported
0-Day Time: 0 days since found
Exposure Time: 0 days since known
Upgrade: Firefox 40.0.3
Timeline
08/27/2015 | Advisory disclosed
08/27/2015 | Countermeasure disclosed
08/27/2015 | SecurityTracker entry created
08/28/2015 | VulDB entry created
08/28/2015 | VulDB entry updated
Sources
Advisory: MFSA 2015-94
Researcher: Ucha Gobejishvili
Status: Confirmed
CVE: CVE-2015-4497 (mitre.org) (nvd.nist.org) (cvedetails.com)
X-Force: 105897 – Mozilla Firefox CanvasRenderingContext2D code execution
SecurityTracker: 1033397 – Mozilla Firefox Use-After-Free in nsIPresShell Lets Remote Users Execute Arbitrary Code
You are receiving this email because you subscribed to this feed at feedmyinbox.com
If you no longer wish to receive these emails, you can unsubscribe from this feed, or manage all your subscriptions
