CVE-2015-7204

Mozilla Firefox before 43.0 does not properly store the properties of unboxed objects, which allows remote attackers to execute arbitrary code via crafted JavaScript variable assignments.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1216130
http://www.mozilla.org/security/announce/2015/mfsa2015-135.html	Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174253.html
http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html
http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html
http://www.securityfocus.com/bid/79280
http://www.securitytracker.com/id/1034426
https://security.gentoo.org/glsa/201512-10
http://lists.opensuse.org/opensuse-updates/2015-12/msg00104.html
http://www.ubuntu.com/usn/USN-2833-1

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:opensuse:opensuse:13.1:::::::*
	cpe:2.3:o:opensuse:leap:42.1:::::::*
	cpe:2.3:o:opensuse:opensuse:13.2:::::::*

Configuration 2 (hide)

OR	cpe:2.3:o:fedoraproject:fedora:23:::::::*
	cpe:2.3:o:fedoraproject:fedora:22:::::::*

Configuration 3 (hide)

OR	cpe:2.3:a:mozilla:firefox:41.0:::::::*
	cpe:2.3:a:mozilla:firefox:41.0.2:::::::*
	cpe:2.3:a:mozilla:firefox:41.0.1:::::::*
	cpe:2.3:a:mozilla:firefox::::::::

Information

Published : 2015-12-16 03:59

Updated : 2018-10-30 09:27

NVD link : CVE-2015-7204

Mitre link : CVE-2015-7204

JSON object : View

CWE

CWE-17

DEPRECATED: Code

Advertisement

Products Affected

mozilla

firefox

opensuse

opensuse
leap

fedoraproject

fedora

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1216130", "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1216130", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.mozilla.org/security/announce/2015/mfsa2015-135.html", "name": "http://www.mozilla.org/security/announce/2015/mfsa2015-135.html", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html", "name": "FEDORA-2015-51b1105902", "tags": [], "refsource": "FEDORA"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174253.html", "name": "FEDORA-2015-7ab3d3afcf", "tags": [], "refsource": "FEDORA"}, {"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html", "name": "openSUSE-SU-2016:0308", "tags": [], "refsource": "SUSE"}, {"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html", "name": "openSUSE-SU-2016:0307", "tags": [], "refsource": "SUSE"}, {"url": "http://www.securityfocus.com/bid/79280", "name": "79280", "tags": [], "refsource": "BID"}, {"url": "http://www.securitytracker.com/id/1034426", "name": "1034426", "tags": [], "refsource": "SECTRACK"}, {"url": "https://security.gentoo.org/glsa/201512-10", "name": "GLSA-201512-10", "tags": [], "refsource": "GENTOO"}, {"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00104.html", "name": "openSUSE-SU-2015:2353", "tags": [], "refsource": "SUSE"}, {"url": "http://www.ubuntu.com/usn/USN-2833-1", "name": "USN-2833-1", "tags": [], "refsource": "UBUNTU"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Mozilla Firefox before 43.0 does not properly store the properties of unboxed objects, which allows remote attackers to execute arbitrary code via crafted JavaScript variable assignments."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-17"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2015-7204", "ASSIGNER": "security@mozilla.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2015-12-16T11:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:mozilla:firefox:41.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mozilla:firefox:41.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mozilla:firefox:41.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "42.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-30T16:27Z"}