CVE-2015-0823 — Use After Free in Mozilla Firefox

CWE-416 — Use After Free11 documents7 sources
Severity
7.5HIGHNVD
OSV4.3
EPSS
1.7%
top 17.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mozilla FirefoxCanonical Ubuntu LinuxOpensuse
Timeline
PublishedFeb 25
Latest updateMay 14

Description

Multiple use-after-free vulnerabilities in OpenType Sanitiser, as used in Mozilla Firefox before 36.0, might allow remote attackers to trigger problematic Developer Console information or possibly have unspecified other impact by leveraging incorrect macro expansion, related to the ots::ots_gasp_parse function.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages3 packages

▶Ubuntumozilla/firefox< 36.0+build2-0ubuntu0.14.04.4+1
▶NVDmozilla/firefox35.0.1+214
▶NVDopensuse/opensuse13.1, 13.2+1

Also affects: Ubuntu Linux 12.04, 14.04, 14.10

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-45cf-8gr9-j528: Multiple use-after-free vulnerabilities in OpenType Sanitiser, as used in Mozilla Firefox before 36↗2022-05-14
▶
OSV
firefox regression↗2015-03-09
▶
OSV
firefox vulnerabilities↗2015-02-25
▶
OSV
CVE-2015-0823: Multiple use-after-free vulnerabilities in OpenType Sanitiser, as used in Mozilla Firefox before 36↗2015-02-25
▶

📋Vendor Advisories

3
Ubuntu
Firefox regression↗2015-03-09
▶
Ubuntu
Firefox vulnerabilities↗2015-02-25
▶
Red Hat
Mozilla: Use-after-free in Developer Console date with OpenType Sanitiser (MFSA 2015-23)↗2015-02-24
▶

🕵️Threat Intelligence

2
Talos
Research Spotlight: Exploiting Use-After-Free Vulnerabilities↗2015-03-17
▶
Talos
Research Spotlight: Exploiting Use-After-Free Vulnerabilities↗2015-03-17
▶

💬Community

1
Bugzilla
CVE-2015-0823 Mozilla: Use-after-free in Developer Console date with OpenType Sanitiser (MFSA 2015-23)↗2015-02-24
▶