PT-2015-5848 · Mozilla+5 · Firefox+7

Atte Kettunen

·

Publicado

2015-05-12

·

Atualizado

2024-12-12

·

CVE-2015-2710

CVSS v2.0

6.8

Média

VetorAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 38.0 Firefox ESR 31.x versions prior to 31.7 Thunderbird versions prior to 31.7
Description The issue allows remote attackers to execute arbitrary code via crafted SVG graphics data in conjunction with a crafted Cascading Style Sheets (CSS) token sequence. This is due to a heap-based buffer overflow in the SVGTextFrame class.
Recommendations For Mozilla Firefox versions prior to 38.0, update to version 38.0 or later. For Firefox ESR 31.x versions prior to 31.7, update to version 31.7 or later. For Thunderbird versions prior to 31.7, update to version 31.7 or later.

Exploit

Correção

RCE

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2015-1463
ALT-PU-2015-1464
ALT-PU-2015-1584
CESA-2015_0988
CESA-2015_1012
CVE-2015-2710
DSA-3260-1
DSA-3264-1
MGASA-2015-0234
MGASA-2015-0342
OPENSUSE-SU-2024:10071-1
OPENSUSE-SU-2024:10230-1
OPENSUSE-SU-2024:14572-1
RHSA-2015:0988
RHSA-2015:1012
RHSA-2015_0988
RHSA-2015_1012
SUSE-SU-2015:0960-1
USN-2602-1
USN-2603-1

Produtos afetados

Alt Linux
Centos
Firefox Esr
Firefox
Red Hat
Suse
Thunderbird
Ubuntu