Buffer overflow in Mozilla Firefox
CVE-2015-7182
Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.102 (95.6th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 95.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.102 · newest: 0.102 · change: 0.000
Affected products
- Mozilla Firefox — versions 38.0, 38.0.1, 38.0.5
- Mozilla Network Security Services — versions 3.20.0
- Oracle Glassfish Server — versions 2.1.1
- Oracle Iplanet Web Proxy Server — versions 4.0
- Oracle Iplanet Web Server — versions 7.0
- Oracle Opensso — versions 3.0-0.7
- Oracle Traffic Director — versions 11.1.1.7.0, 11.1.1.9.0
Weakness classification (CWE)
References
- www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- www.securitytracker.com/id/1034069 (vdb-entry)
- bto.bluecoat.com/security-advisory/sa119
- www.debian.org/security/2016/dsa-3688 (vendor-advisory)
- www.debian.org/security/2015/dsa-3410 (vendor-advisory)
- lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html (vendor-advisory)
- security.gentoo.org/glsa/201512-10 (vendor-advisory)
- www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- lists.opensuse.org/opensuse-security-announce/2015-11/msg00021.html (vendor-advisory)
- bugzilla.mozilla.org/show_bug.cgi
Frequently asked questions
- What is CVE-2015-7182?
- CVE-2015-7182 is a critical-severity vulnerability in Mozilla Firefox, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 9.8/10. Published 2015-11-05.
- How severe is CVE-2015-7182?
- Critical severity. CVSS v3 base score is 9.8 out of 10.