Published: 24/03/2015 Updated: 03/01/2017

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

The asm.js implementation in Mozilla Firefox prior to 36.0.3, Firefox ESR 31.x prior to 31.5.2, and SeaMonkey prior to 2.33.1 does not properly determine the cases in which bounds checking may be safely skipped during JIT compilation and heap access, which allows remote malicious users to read or write to unintended memory locations, and consequently execute arbitrary code, via crafted JavaScript.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox esr 31.4
mozilla firefox esr 31.3.0
mozilla seamonkey
mozilla firefox esr 31.1.1
mozilla firefox esr 31.1.0
mozilla firefox
mozilla firefox esr 31.5
mozilla firefox esr 31.5.1
mozilla firefox esr 31.1
mozilla firefox esr 31.0
mozilla firefox esr 31.3
mozilla firefox esr 31.2

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2015-0817 ilxu1a reported a flaw in Mozilla's implementation of typed array bounds checking in JavaScript just-in-time compilation (JIT) and its ...

Mozilla Foundation Security Advisory 2015-29 Code execution through incorrect JavaScript bounds checking elimination Announced March 20, 2015 Reporter ilxu1a Impact Critical Products Firefox, Firefox ESR, SeaMonkey Fixe ...

The asmjs implementation in Mozilla Firefox before 3603, Firefox ESR 31x before 3152, and SeaMonkey before 2331 does not properly determine the cases in which bounds checking may be safely skipped during JIT compilation and heap access, which allows remote attackers to read or write to unintended memory locations, and consequently execute a ...

CWE-17 https://bugzilla.mozilla.org/show_bug.cgi?id=1145255 http://www.mozilla.org/security/announce/2015/mfsa2015-29.html http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00026.html http://rhn.redhat.com/errata/RHSA-2015-0718.html http://www.debian.org/security/2015/dsa-3201 http://www.ubuntu.com/usn/USN-2538-1 http://www.securitytracker.com/id/1031958 http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00029.html http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00035.html http://lists.opensuse.org/opensuse-updates/2015-03/msg00096.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html https://security.gentoo.org/glsa/201504-01 http://www.securityfocus.com/bid/73263 https://usn.ubuntu.com/2538-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2015-0817

CVE-2015-0817

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect