PT-2015-1047 · Mozilla+3 · Firefox+3

Nils · Published 2015-03-31 · Updated 2024-06-15 · CVE-2015-0804

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 37.0

Description The issue is related to the HTMLSourceElement::BindToTree function in Mozilla Firefox, which does not properly constrain a data type after omitting namespace validation during certain tree-binding operations. This allows a remote attacker to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document containing a SOURCE element.

Recommendations For versions prior to 37.0, update to version 37.0 or later to resolve the issue.

Exploit

Fix

RCE

DoS

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2015-1374

ALT-PU-2015-1464

BDU:2015-09899

CVE-2015-0804

MGASA-2015-0342

OPENSUSE-SU-2015_0677-1

OPENSUSE-SU-2024:10071-1

USN-2550-1

Affected Products

Alt Linux

Firefox

Suse

Ubuntu

References · 1101

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proxy_prototype.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_pdfjs_privilege_escalation.rb · Exploit
• https://bdu.fstec.ru/vul/2015-09904 · Security Note
• https://ubuntu.com/security/CVE-2015-0808 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09888 · Security Note
• http://ubuntu.com/usn/USN-2550-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8640 · Security Note
• https://ubuntu.com/security/notices/USN-2550-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8631 · Security Note
• https://bdu.fstec.ru/vul/2015-09892 · Security Note
• https://bdu.fstec.ru/vul/2015-09887 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1587 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0801 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0822 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1584 · Security Note