PT-2015-2172 · Mozilla+3 · Firefox+3

Loobenyang · Publicado 2015-09-22 · Atualizado 2024-12-12 · CVE-2015-4510

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 41.0

Description The issue is related to a race condition in the WorkerPrivate::NotifyFeatures function, which can be exploited by remote attackers to execute arbitrary code or cause a denial of service. This is due to improper interaction between shared workers and the IndexedDB implementation, leading to use-after-free and application crash.

Recommendations For versions prior to 41.0, update to version 41.0 or later to resolve the issue.

Exploit

Correção

RCE

DoS

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

ALT-PU-2015-1816

ALT-PU-2016-1454

BDU:2015-11518

CVE-2015-4510

MGASA-2015-0414

OPENSUSE-SU-2015_1658-1

OPENSUSE-SU-2015_1681-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

USN-2743-1

USN-2743-2

USN-2743-3

USN-2743-4

Produtos afetados

Alt Linux

Firefox

Suse

Ubuntu

Referências · 2441

• 🔥 https://github.com/llamakko/CVE-2015-7214 · Exploit
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb · Nota
• https://suse.com/security/cve/CVE-2009-0354 · Nota
• https://suse.com/security/cve/CVE-2024-3302 · Nota
• https://suse.com/security/cve/CVE-2024-1551 · Nota
• https://bdu.fstec.ru/vul/2015-12247 · Nota de Segurança
• https://suse.com/security/cve/CVE-2012-1937 · Nota
• https://suse.com/security/cve/CVE-2023-25731 · Nota
• https://suse.com/security/cve/CVE-2009-1307 · Nota
• https://suse.com/security/cve/CVE-2020-6812 · Nota
• https://suse.com/security/cve/CVE-2024-4769 · Nota
• https://suse.com/security/cve/CVE-2016-5282 · Nota
• https://suse.com/security/cve/CVE-2010-1210 · Nota
• https://suse.com/security/cve/CVE-2009-3381 · Nota
• https://suse.com/security/cve/CVE-2016-2798 · Nota