Published: 06/07/2015 Updated: 28/12/2016

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

The AudioParamTimeline::AudioNodeInputValue function in the Web Audio implementation in Mozilla Firefox prior to 39.0 and Firefox ESR 38.x prior to 38.1 does not properly calculate an oscillator rendering range, which allows remote malicious users to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspecified vectors.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox esr 31.6.0
mozilla firefox esr 31.5.3
mozilla firefox esr 31.1.1
mozilla firefox esr 31.1.0
mozilla firefox esr 31.5.2
mozilla firefox esr 31.5.1
mozilla firefox esr 31.1
mozilla firefox esr 31.0
mozilla firefox esr 31.5
mozilla firefox esr 31.4
mozilla firefox esr 31.3.0
mozilla firefox esr 38.0
mozilla firefox esr 31.7.0
mozilla firefox esr 31.3
mozilla firefox esr 31.2
mozilla thunderbird
mozilla firefox
oracle solaris 11.3

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

Mozilla Foundation Security Advisory 2015-62 Out-of-bound read while computing an oscillator rendering range in Web Audio Announced July 2, 2015 Reporter Holger Fuhrmannek Impact Moderate Products Firefox, Firefox ESR, Firef ...

The AudioParamTimeline::AudioNodeInputValue function in the Web Audio implementation in Mozilla Firefox before 390 and Firefox ESR 38x before 381 does not properly calculate an oscillator rendering range, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspec ...

CWE-119 http://www.mozilla.org/security/announce/2015/mfsa2015-62.html https://bugzilla.mozilla.org/show_bug.cgi?id=1122218 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.securityfocus.com/bid/75541 https://security.gentoo.org/glsa/201512-10 http://www.ubuntu.com/usn/USN-2656-2 http://www.ubuntu.com/usn/USN-2656-1 http://www.securitytracker.com/id/1032783 http://rhn.redhat.com/errata/RHSA-2015-1207.html http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html https://nvd.nist.gov https://usn.ubuntu.com/2656-1/https://access.redhat.com/security/cve/cve-2015-2729

CVE-2015-2729

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect