CVE-2015-7199
published 2015-11-05CVE-2015-7199: The (1) AddWeightedPathSegLists and (2) SVGPathSegListSMILType::Interpolate functions in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lack…
PriorityP431high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
3.15%
86.5th percentile
The (1) AddWeightedPathSegLists and (2) SVGPathSegListSMILType::Interpolate functions in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lack status checking, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted SVG document.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | <= 41.0.2 | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 0 < 42.0+build2-0ubuntu0.14.04.1 | 42.0+build2-0ubuntu0.14.04.1 |
| mozilla | thunderbird | >= 0 < 1:38.4.0+build3-0ubuntu0.14.04.1 | 1:38.4.0+build3-0ubuntu0.14.04.1 |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2015-12-01·CVSS 7.5
CVE-2015-4513 [HIGH] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Christian Holler, David Major, Jesse Ruderman, Tyson Smith, Boris Zbarsky,
Randell Jesup, Olli Pettay, Karl Tomlinson, Jeff Walden, and Gary Kwong
discovered multiple memory safety issues in Thunderbird. If a user were
tricked in to opening a specially crafted message, an attacker could
potentially exploit these to cause a denial of service via application
crash, or execute arbitrary code with the privileges of the user invoking
Thunderbird. (CVE-2015-4513)
Tyson Smith and David Keeler discovered a use-after-poison and buffer
overflow in NSS. An attacker could potentially exploit these to cause a
denial of service via application crash, or execute arbitrary code with
the privileges of the user
Red Hat
Mozilla: Vulnerabilities found through code inspection (MFSA 2015-131)
vendor_redhat·2015-11-04·CVSS 7.5
CVE-2015-7199 [HIGH] Mozilla: Vulnerabilities found through code inspection (MFSA 2015-131)
Mozilla: Vulnerabilities found through code inspection (MFSA 2015-131)
The (1) AddWeightedPathSegLists and (2) SVGPathSegListSMILType::Interpolate functions in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lack status checking, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted SVG document.
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2015-11-04·CVSS 7.5
CVE-2015-4513 [HIGH] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
Christian Holler, David Major, Jesse Ruderman, Tyson Smith, Boris Zbarsky,
Randell Jesup, Olli Pettay, Karl Tomlinson, Jeff Walden, Gary Kwong,
Andrew McCreight, Georg Fritzsche, and Carsten Book discovered multiple
memory safety issues in Firefox. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit these to
cause a denial of service via application crash, or execute arbitrary
code with the privileges of the user invoking Firefox. (CVE-2015-4513,
CVE-2015-4514)
Tim Brown discovered that Firefox discloses the hostname during NTLM
authentication in some circumstances. If a user were tricked in to
opening
GHSA
GHSA-95j5-rfpg-w4rp: The (1) AddWeightedPathSegLists and (2) SVGPathSegListSMILType::Interpolate functions in Mozilla Firefox before 42
ghsa_unreviewed·2022-05-17
CVE-2015-7199 [HIGH] CWE-119 GHSA-95j5-rfpg-w4rp: The (1) AddWeightedPathSegLists and (2) SVGPathSegListSMILType::Interpolate functions in Mozilla Firefox before 42
The (1) AddWeightedPathSegLists and (2) SVGPathSegListSMILType::Interpolate functions in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lack status checking, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted SVG document.
OSV
thunderbird vulnerabilities
osv·2015-12-01·CVSS 7.5
CVE-2015-4513 [HIGH] thunderbird vulnerabilities
thunderbird vulnerabilities
Christian Holler, David Major, Jesse Ruderman, Tyson Smith, Boris Zbarsky,
Randell Jesup, Olli Pettay, Karl Tomlinson, Jeff Walden, and Gary Kwong
discovered multiple memory safety issues in Thunderbird. If a user were
tricked in to opening a specially crafted message, an attacker could
potentially exploit these to cause a denial of service via application
crash, or execute arbitrary code with the privileges of the user invoking
Thunderbird. (CVE-2015-4513)
Tyson Smith and David Keeler discovered a use-after-poison and buffer
overflow in NSS. An attacker could potentially exploit these to cause a
denial of service via application crash, or execute arbitrary code with
the privileges of the user invoking Thunderbird. (CVE-2015-7181,
CVE-2015-7182)
Ryan Sleevi d
OSV
CVE-2015-7199: The (1) AddWeightedPathSegLists and (2) SVGPathSegListSMILType::Interpolate functions in Mozilla Firefox before 42
osv·2015-11-04·CVSS 7.5
CVE-2015-7199 [HIGH] CVE-2015-7199: The (1) AddWeightedPathSegLists and (2) SVGPathSegListSMILType::Interpolate functions in Mozilla Firefox before 42
The (1) AddWeightedPathSegLists and (2) SVGPathSegListSMILType::Interpolate functions in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lack status checking, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted SVG document.
OSV
firefox vulnerabilities
osv·2015-11-04·CVSS 7.5
[HIGH] firefox vulnerabilities
firefox vulnerabilities
Christian Holler, David Major, Jesse Ruderman, Tyson Smith, Boris Zbarsky,
Randell Jesup, Olli Pettay, Karl Tomlinson, Jeff Walden, Gary Kwong,
Andrew McCreight, Georg Fritzsche, and Carsten Book discovered multiple
memory safety issues in Firefox. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit these to
cause a denial of service via application crash, or execute arbitrary
code with the privileges of the user invoking Firefox. (CVE-2015-4513,
CVE-2015-4514)
Tim Brown discovered that Firefox discloses the hostname during NTLM
authentication in some circumstances. If a user were tricked in to
opening a specially crafted website with NTLM v1 enabled, an attacker
could exploit this to obtain sensitive information
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-7198 CVE-2015-7199 CVE-2015-7200 Mozilla: Vulnerabilities found through code inspection (MFSA 2015-131)
bugzilla·2015-11-03·CVSS 7.5
CVE-2015-7198 [HIGH] CVE-2015-7198 CVE-2015-7199 CVE-2015-7200 Mozilla: Vulnerabilities found through code inspection (MFSA 2015-131)
CVE-2015-7198 CVE-2015-7199 CVE-2015-7200 Mozilla: Vulnerabilities found through code inspection (MFSA 2015-131)
Security researcher Ronald Crane reported three vulnerabilities affecting released code that were found through code inspection. These included a buffer overflow in the ANGLE graphics library and two issues of missing status checks in SVG rendering and during cryptographic key manipulation. These do not all have clear mechanisms to be exploited through web content but are vulnerable if a mechanism can be found to trigger them.
External Reference:
https://www.mozilla.org/security/announce/2015/mfsa2015-131.html
Acknowledgements:
Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Ronald Crane as the original reporter.
Discussio
arXiv
Binary-level Directed Fuzzing for Use-After-Free Vulnerabilities
arxiv_fulltext·2020-08-17
Binary-level Directed Fuzzing for Use-After-Free Vulnerabilities
-2emBinary-level Directed Fuzzing for Use-After-Free Vulnerabilities
## Abstract
Directed fuzzing focuses on automatically testing specific parts of the code by taking advantage of additional information such as (partial) bug stack trace, patches
or risky operations. Key applications include bug reproduction, patch testing and static analysis report verification. Although directed fuzzing has received
a lot of attention recently,
hard-to-detect vulnerabilities such as Use-After-Free ( ) are still not well
addressed,
especially at the binary level.
We propose , the first (binary-level) directed greybox fuzzer dedicated to
\ bugs.
The technique features a fuzzing engine tailored to \ specifics, a lightweight code instrumentation and an efficient bug triage step.
Experimental evaluation f
http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-11/msg00021.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.htmlhttp://lists.opensuse.org/opensuse-updates/2015-12/msg00037.htmlhttp://lists.opensuse.org/opensuse-updates/2015-12/msg00049.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1982.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2519.htmlhttp://www.debian.org/security/2015/dsa-3393http://www.debian.org/security/2015/dsa-3410http://www.mozilla.org/security/announce/2015/mfsa2015-131.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlhttp://www.securityfocus.com/bid/77411http://www.securitytracker.com/id/1034069http://www.ubuntu.com/usn/USN-2785-1http://www.ubuntu.com/usn/USN-2819-1https://bugzilla.mozilla.org/show_bug.cgi?id=1204061https://security.gentoo.org/glsa/201512-10http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-11/msg00021.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.htmlhttp://lists.opensuse.org/opensuse-updates/2015-12/msg00037.htmlhttp://lists.opensuse.org/opensuse-updates/2015-12/msg00049.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1982.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2519.htmlhttp://www.debian.org/security/2015/dsa-3393http://www.debian.org/security/2015/dsa-3410http://www.mozilla.org/security/announce/2015/mfsa2015-131.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlhttp://www.securityfocus.com/bid/77411http://www.securitytracker.com/id/1034069http://www.ubuntu.com/usn/USN-2785-1http://www.ubuntu.com/usn/USN-2819-1https://bugzilla.mozilla.org/show_bug.cgi?id=1204061https://security.gentoo.org/glsa/201512-10
2015-11-05
Published