Back to feed
EUVD-2015-2802 · Published May 14, 2015
The asm.js implementation in Mozilla Firefox before 38.0 does not properly determine heap lengths during identification of cases in which bounds checking may be safely skipped, which allows remote attackers to trigger out-of-bounds write operations and possibly execute arbitrary code, or trigger out-of-bounds read operations and possibly obtain sensitive information from process memory, via crafted JavaScript.
Technologies
Mozilla FirefoxOpensuse Opensuse
Weaknesses
CWE-119
CVSS scores
- v2.07.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
- http://lists.opensuse.org/opensuse-updates/2015-05/msg00036.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-50.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securityfocus.com/bid/74611
- http://www.ubuntu.com/usn/USN-2602-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1152280
Potentially impacted assets
See if this affects your attack surface
