PT-2015-1143 · Mozilla+2 · Firefox+2

Robert Kaiser · Published 2015-04-20 · Updated 2024-12-12 · CVE-2015-2706

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 37.0.2

Description The issue is related to a race condition in the AsyncPaintWaitEvent::AsyncPaintWaitEvent function. This allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted plugin that does not properly complete initialization.

Recommendations For versions prior to 37.0.2, update to version 37.0.2 or later to resolve the issue. As a temporary workaround, consider disabling the use of plugins that do not properly complete initialization until a patch is available. Restrict access to potentially vulnerable plugins to minimize the risk of exploitation.

Exploit

Fix

RCE

DoS

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALT-PU-2015-1406

ALT-PU-2015-1464

BDU:2015-10028

CVE-2015-2706

MGASA-2015-0342

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

USN-2571-1

Affected Products

Alt Linux

Firefox

Ubuntu

References · 2213

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_pdfjs_privilege_escalation.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proxy_prototype.rb · Exploit
• https://bdu.fstec.ru/vul/2015-09904 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-2706 · Security Note
• https://bdu.fstec.ru/vul/2015-09888 · Security Note
• https://bdu.fstec.ru/vul/2015-09892 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1584 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2015-51 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2015-40 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1581 · Security Note
• https://bdu.fstec.ru/vul/2015-09816 · Security Note
• https://bdu.fstec.ru/vul/2015-09901 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0824 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2717 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2716 · Security Note