Vulnerability in Mozilla Firefox
CVE-2015-0823
Multiple use-after-free vulnerabilities in OpenType Sanitiser, as used in Mozilla Firefox before 36.0, might allow remote attackers to trigger problematic Developer Console information or possibly have unspecified other impact by leveraging incorrect macro expansion, related to the ots::ots_gasp_parse function.
EPSS: 0.039 (89.2th percentile) — read the EPSS interpretation.
Affected products
- Mozilla Firefox — versions 0.1, 0.2, 0.3
- Opentype_sanitiser_project Opentype_sanitiser
- Canonical Ubuntu_linux — versions 12.04, 14.04, 14.10
- Opensuse — versions 13.1, 13.2
- N/a — versions n/a
References
- security@mozilla.org (vendor-advisory, x_refsource_GENTOO)
- security@mozilla.org (vendor-advisory, Third Party Advisory, x_refsource_SUSE)
- security@mozilla.org (x_refsource_CONFIRM)
- security@mozilla.org (x_refsource_CONFIRM, Issue Tracking)
- security@mozilla.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- security@mozilla.org (x_refsource_CONFIRM, Patch, Issue Tracking)
- security@mozilla.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- security@mozilla.org (x_refsource_CONFIRM, Vendor Advisory)
- security@mozilla.org (vendor-advisory, Third Party Advisory, x_refsource_SUSE)
- security@mozilla.org (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)