Published: 29/08/2015 Updated: 22/12/2016

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 890

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox prior to 40.0.3 and Firefox ESR 38.x prior to 38.2.1 allows remote malicious users to execute arbitrary code by leveraging improper interaction between resize events and changes to Cascading Style Sheets (CSS) token sequences for a CANVAS element.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox esr 38.0.5
mozilla firefox esr 38.1.0
mozilla firefox 40.0.2
mozilla firefox esr 38.0
mozilla firefox esr 38.0.1
mozilla firefox esr 38.2.0

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2015-4497 Jean-Max Reymond and Ucha Gobejishvili discovered a use-after-free vulnerability which occurs when resizing of a canvas element is ...

Mozilla Foundation Security Advisory 2015-94 Use-after-free when resizing canvas element during restyling Announced August 27, 2015 Reporter Jean-Max Reymond Impact Critical Products Firefox, Firefox ESR, SeaMonkey Fixe ...

Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 4003 and Firefox ESR 38x before 3821 allows remote attackers to execute arbitrary code by leveraging improper interaction between resize events and changes to Cascading Style Sheets (CSS) token sequences for a CANVAS element ...

NVD-CWE-Other https://bugzilla.mozilla.org/show_bug.cgi?id=1164766 https://bugzilla.mozilla.org/show_bug.cgi?id=1175278 http://www.mozilla.org/security/announce/2015/mfsa2015-94.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securityfocus.com/bid/76502 http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html http://www.zerodayinitiative.com/advisories/ZDI-15-406 http://www.ubuntu.com/usn/USN-2723-1 http://www.securitytracker.com/id/1033397 http://www.debian.org/security/2015/dsa-3345 http://rhn.redhat.com/errata/RHSA-2015-1693.html http://lists.opensuse.org/opensuse-updates/2015-09/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00013.html https://usn.ubuntu.com/2723-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2015-4497

CVE-2015-4497

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect