CVE-2015-0817

CWE-17CWE-119 — Buffer Overflow8 documents7 sources
Severity
6.8MEDIUM
EPSS
1.3%
top 19.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mozilla FirefoxMozilla SeamonkeyMozilla Firefox ESR
Timeline
PublishedMar 24
Latest updateMay 17

Description

The asm.js implementation in Mozilla Firefox before 36.0.3, Firefox ESR 31.x before 31.5.2, and SeaMonkey before 2.33.1 does not properly determine the cases in which bounds checking may be safely skipped during JIT compilation and heap access, which allows remote attackers to read or write to unintended memory locations, and consequently execute arbitrary code, via crafted JavaScript.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages4 packages

▶NVDmozilla/firefox36.0.1+5
▶NVDmozilla/firefox_esr5 versions+4
▶Ubuntufirefox< 36.0.4+build1-0ubuntu0.14.04.1
▶NVDmozilla/seamonkey2.33.0

🔴Vulnerability Details

4
GHSA
GHSA-4rw7-7wpq-7g64: The asm↗2022-05-17
▶
CVEList
CVE-2015-0817: The asm↗2015-03-24
▶
OSV
CVE-2015-0817: The asm↗2015-03-22
▶
OSV
firefox vulnerabilities↗2015-03-22
▶

📋Vendor Advisories

2
Ubuntu
Firefox vulnerabilities↗2015-03-22
▶
Red Hat
Mozilla: Code execution through incorrect JavaScript bounds checking elimination (MFSA 2015-29)↗2015-03-21
▶

💬Community

1
Bugzilla
CVE-2015-0817 Mozilla: Code execution through incorrect JavaScript bounds checking elimination (MFSA 2015-29)↗2015-03-21
▶