Vulnerability Description
Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a dedicated worker.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | <= 38.1.0 |
| Oracle | Solaris | 11.3 |
| Mozilla | Firefox Esr | 31.1 |
| Novell | Suse Linux Enterprise Desktop | 11 |
| Novell | Suse Linux Enterprise Server | 12.0 |
References
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html
- http://rhn.redhat.com/errata/RHSA-2015-1207.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-65.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlThird Party Advisory
- http://www.securityfocus.com/bid/75541
- http://www.securitytracker.com/id/1032783
- http://www.securitytracker.com/id/1032784
- http://www.ubuntu.com/usn/USN-2656-1
- http://www.ubuntu.com/usn/USN-2656-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1169867Issue Tracking
FAQ
What is CVE-2015-2733?
CVE-2015-2733 is a vulnerability with a CVSS score of 10.0 (HIGH). Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitr...
How severe is CVE-2015-2733?
CVE-2015-2733 has been rated HIGH with a CVSS base score of 10.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-2733?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Oracle Solaris, Mozilla Firefox Esr, Novell Suse Linux Enterprise Desktop, Novell Suse Linux Enterprise Server.