Buffer overflow in Linux Kernel
CVE-2015-4512
gfx/2d/DataSurfaceHelpers.cpp in Mozilla Firefox before 41.0 on Linux improperly attempts to use the Cairo library with 32-bit color-depth surface creation followed by 16-bit color-depth surface display, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) by using a CANVAS element to trigger 2D rendering.
Vulnerability class: Buffer Overflow
EPSS: 0.035 (87.9th percentile) — read the EPSS interpretation.
Affected products
- Linux Linux_kernel
- Mozilla Firefox
- N/a — versions n/a
Weakness classification (CWE)
References
- security@mozilla.org (vendor-advisory, x_refsource_SUSE)
- security@mozilla.org (x_refsource_CONFIRM, Vendor Advisory)
- security@mozilla.org (x_refsource_UBUNTU, vendor-advisory)
- security@mozilla.org (x_refsource_CONFIRM)
- security@mozilla.org (x_refsource_UBUNTU, vendor-advisory)
- security@mozilla.org (vdb-entry, x_refsource_BID)
- security@mozilla.org (x_refsource_UBUNTU, vendor-advisory)
- security@mozilla.org (vdb-entry, x_refsource_SECTRACK)
- security@mozilla.org (x_refsource_CONFIRM)
- security@mozilla.org (vendor-advisory, x_refsource_SUSE)