PT-2015-2876 · Mozilla+2 · Firefox+2

Stuart Larsen · Published 2015-12-15 · Updated 2024-06-15 · CVE-2015-7219

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 43.0

Description The issue is related to the HTTP/2 implementation, which allows remote attackers to cause a denial of service due to an integer underflow, assertion failure, and application exit. This can be triggered by a malformed PushPromise frame that causes decompressed-buffer length miscalculation and incorrect memory allocation.

Recommendations For versions prior to 43.0, update to version 43.0 or later to resolve the issue. As a temporary workaround, consider disabling HTTP/2 support until a patch is available. Restrict access to untrusted websites to minimize the risk of exploitation.

Exploit

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

ALT-PU-2015-2196

ALT-PU-2016-1454

BDU:2015-12242

CVE-2015-7219

MGASA-2016-0124

OPENSUSE-SU-2024:10071-1

USN-2833-1

Affected Products

Alt Linux

Firefox

Ubuntu

References · 1239

• 🔥 https://github.com/llamakko/CVE-2015-7214 · Exploit
• https://bdu.fstec.ru/vul/2016-00719 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2807 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7196 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2796 · Security Note
• https://bdu.fstec.ru/vul/2015-11526 · Security Note
• https://bdu.fstec.ru/vul/2015-12010 · Security Note
• https://bdu.fstec.ru/vul/2016-00745 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2015-135 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01158 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7204 · Security Note
• https://bdu.fstec.ru/vul/2016-00760 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4520 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2015-140 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7175 · Security Note