{"id":"USN-2833-1","summary":"firefox vulnerabilities","details":"Andrei Vaida, Jesse Ruderman, Bob Clary, Christian Holler, Jesse Ruderman,\nEric Rahm, Robert Kaiser, Harald Kirschner, and Michael Henretty\ndiscovered multiple memory safety issues in Firefox. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit these to cause a denial of service via application\ncrash, or execute arbitrary code with the privileges of the user invoking\nFirefox. (CVE-2015-7201, CVE-2015-7202)\n\nRonald Crane discovered three buffer overflows through code inspection.\nIf a user were tricked in to opening a specially crafted website, an\nattacker could potentially exploit these to cause a denial of service via\napplication crash, or execute arbitrary code with the privileges of the\nuser invoking Firefox. (CVE-2015-7203, CVE-2015-7220, CVE-2015-7221)\n\nCajus Pollmeier discovered a crash during javascript variable assignments\nin some circumstances. If a user were tricked in to opening a specially\ncrafted website, an attacker could potentially exploit this to execute\narbitrary code with the privileges of the user invoking Firefox.\n(CVE-2015-7204)\n\nRonald Crane discovered a buffer overflow through code inspection. If a\nuser were tricked in to opening a specially crafted website, an attacker\ncould potentially exploit this to cause a denial of service via\napplication crash, or execute arbitrary code with the privileges of the\nuser invoking Firefox. (CVE-2015-7205)\n\nIt was discovered that it is possible to read cross-origin URLs following\na redirect if performance.getEntries() is used with an iframe to host a\npage. If a user were tricked in to opening a specially crafted website, an\nattacker could potentially exploit this to bypass same-origin\nrestrictions. (CVE-2015-7207)\n\nIt was discovered that Firefox allows for control characters to be set in\ncookies. An attacker could potentially exploit this to conduct cookie\ninjection attacks on some web servers. (CVE-2015-7208)\n\nLooben Yang discovered a use-after-free in WebRTC when closing channels in\nsome circumstances. If a user were tricked in to opening a specially\ncrafted website, an attacker could potentially exploit this to cause a\ndenial of service via application crash, or execute arbitrary code with\nthe privileges of the user invoking Firefox. (CVE-2015-7210)\n\nAbdulrahman Alqabandi discovered that hash symbol is incorrectly handled\nwhen parsing data: URLs. An attacker could potentially exploit this to\nconduct URL spoofing attacks. (CVE-2015-7211)\n\nAbhishek Arya discovered an integer overflow when allocating large\ntextures. If a user were tricked in to opening a specially crafted\nwebsite, an attacker could potentially exploit this to cause a denial of\nservice via application crash, or execute arbitrary code with the\nprivileges of the user invoking Firefox. (CVE-2015-7212)\n\nRonald Crane dicovered an integer overflow when processing MP4 format\nvideo in some circumstances. If a user were tricked in to opening a\nspecially crafted website, an attacker could potentially exploit this to\ncause a denial of service via application crash, or execute arbitrary code\nwith the privileges of the user invoking Firefox. (CVE-2015-7213)\n\nTsubasa Iinuma discovered a way to bypass same-origin restrictions using\ndata: and view-source: URLs. If a user were tricked in to opening a\nspecially crafted website, an attacker could potentially exploit this to\nobtain sensitive information and read local files. (CVE-2015-7214)\n\nMasato Kinugawa discovered a cross-origin information leak in error events\nin web workers. An attacker could potentially exploit this to obtain\nsensitive information. (CVE-2015-7215)\n\nGustavo Grieco discovered that the file chooser crashed on malformed\nimages due to flaws in the Jasper library. If a user were tricked in to\nopening a specially crafted website, an attacker could potentially\nexploit this to cause a denial of service.\n(CVE-2015-7216, CVE-2015-7217)\n\nStuart Larsen discoverd two integer underflows when handling malformed\nHTTP/2 frames in some circumstances. If a user were tricked in to opening\na specially crafted website, an attacker could potentially exploit these\nto cause a denial of service via application crash. (CVE-2015-7218,\nCVE-2015-7219)\n\nGerald Squelart discovered an integer underflow in the libstagefright\nlibrary when parsing MP4 format video in some circumstances. If a user\nwere tricked in to opening a specially crafted website, an attacker could\npotentially exploit this to cause a denial of service via application\ncrash, or execute arbitrary code with the privileges of the user invoking\nFirefox. (CVE-2015-7222)\n\nKris Maglione discovered a mechanism where web content could use\nWebExtension APIs to execute code with the privileges of a particular\nWebExtension. If a user were tricked in to opening a specially crafted\nwebsite with a vulnerable extension installed, an attacker could\npotentially exploit this to obtain sensitive information or conduct\ncross-site scripting (XSS) attacks. (CVE-2015-7223)\n","modified":"2026-04-22T09:18:47.023045Z","published":"2015-12-15T21:49:15Z","related":["UBUNTU-CVE-2015-7201","UBUNTU-CVE-2015-7202","UBUNTU-CVE-2015-7203","UBUNTU-CVE-2015-7204","UBUNTU-CVE-2015-7205","UBUNTU-CVE-2015-7207","UBUNTU-CVE-2015-7208","UBUNTU-CVE-2015-7210","UBUNTU-CVE-2015-7211","UBUNTU-CVE-2015-7212","UBUNTU-CVE-2015-7213","UBUNTU-CVE-2015-7214","UBUNTU-CVE-2015-7215","UBUNTU-CVE-2015-7216","UBUNTU-CVE-2015-7217","UBUNTU-CVE-2015-7218","UBUNTU-CVE-2015-7219","UBUNTU-CVE-2015-7220","UBUNTU-CVE-2015-7221","UBUNTU-CVE-2015-7222","UBUNTU-CVE-2015-7223"],"upstream":["CVE-2015-7201","CVE-2015-7202","CVE-2015-7203","CVE-2015-7204","CVE-2015-7205","CVE-2015-7207","CVE-2015-7208","CVE-2015-7210","CVE-2015-7211","CVE-2015-7212","CVE-2015-7213","CVE-2015-7214","CVE-2015-7215","CVE-2015-7216","CVE-2015-7217","CVE-2015-7218","CVE-2015-7219","CVE-2015-7220","CVE-2015-7221","CVE-2015-7222","CVE-2015-7223","UBUNTU-CVE-2015-7201","UBUNTU-CVE-2015-7202","UBUNTU-CVE-2015-7203","UBUNTU-CVE-2015-7204","UBUNTU-CVE-2015-7205","UBUNTU-CVE-2015-7207","UBUNTU-CVE-2015-7208","UBUNTU-CVE-2015-7210","UBUNTU-CVE-2015-7211","UBUNTU-CVE-2015-7212","UBUNTU-CVE-2015-7213","UBUNTU-CVE-2015-7214","UBUNTU-CVE-2015-7215","UBUNTU-CVE-2015-7216","UBUNTU-CVE-2015-7217","UBUNTU-CVE-2015-7218","UBUNTU-CVE-2015-7219","UBUNTU-CVE-2015-7220","UBUNTU-CVE-2015-7221","UBUNTU-CVE-2015-7222","UBUNTU-CVE-2015-7223"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-2833-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7201"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7202"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7203"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7204"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7205"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7207"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7208"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7210"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7211"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7212"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7213"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7214"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7215"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7216"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7217"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7218"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7219"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7220"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7221"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7222"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-7223"}],"affected":[{"package":{"name":"firefox","ecosystem":"Ubuntu:14.04:LTS","purl":"pkg:deb/ubuntu/firefox@43.0+build1-0ubuntu0.14.04.1?arch=source&distro=trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"43.0+build1-0ubuntu0.14.04.1"}]}],"versions":["24.0+build1-0ubuntu1","25.0+build3-0ubuntu0.13.10.1","28.0~b2+build1-0ubuntu2","28.0+build1-0ubuntu1","28.0+build2-0ubuntu1","28.0+build2-0ubuntu2","29.0+build1-0ubuntu0.14.04.2","30.0+build1-0ubuntu0.14.04.3","31.0+build1-0ubuntu0.14.04.1","32.0+build1-0ubuntu0.14.04.1","32.0.3+build1-0ubuntu0.14.04.1","33.0+build2-0ubuntu0.14.04.1","34.0+build2-0ubuntu0.14.04.1","35.0+build3-0ubuntu0.14.04.2","35.0.1+build1-0ubuntu0.14.04.1","36.0+build2-0ubuntu0.14.04.4","36.0.1+build2-0ubuntu0.14.04.1","36.0.4+build1-0ubuntu0.14.04.1","37.0+build2-0ubuntu0.14.04.1","37.0.1+build1-0ubuntu0.14.04.1","37.0.2+build1-0ubuntu0.14.04.1","38.0+build3-0ubuntu0.14.04.1","39.0+build5-0ubuntu0.14.04.1","39.0.3+build2-0ubuntu0.14.04.1","40.0+build4-0ubuntu0.14.04.1","40.0+build4-0ubuntu0.14.04.4","40.0.3+build1-0ubuntu0.14.04.1","41.0+build3-0ubuntu0.14.04.1","41.0.1+build2-0ubuntu0.14.04.1","41.0.2+build2-0ubuntu0.14.04.1","42.0+build2-0ubuntu0.14.04.1"],"ecosystem_specific":{"binaries":[{"binary_name":"firefox","binary_version":"43.0+build1-0ubuntu0.14.04.1"},{"binary_name":"firefox-globalmenu","binary_version":"43.0+build1-0ubuntu0.14.04.1"},{"binary_name":"firefox-mozsymbols","binary_version":"43.0+build1-0ubuntu0.14.04.1"},{"binary_name":"firefox-testsuite","binary_version":"43.0+build1-0ubuntu0.14.04.1"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-2833-1.json","cves_map":{"cves":[{"id":"CVE-2015-7201","severity":[{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2015-7202","severity":[{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2015-7203","severity":[{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2015-7204","severity":[{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2015-7205","severity":[{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2015-7207","severity":[{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2015-7208","severity":[{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2015-7210","severity":[{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2015-7211","severity":[{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2015-7212","severity":[{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2015-7213","severity":[{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2015-7214","severity":[{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2015-7215","severity":[{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2015-7216","severity":[{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2015-7217","severity":[{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2015-7218","severity":[{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2015-7219","severity":[{"type":"Ubuntu","score":"low"}]},{"id":"CVE-2015-7220","severity":[{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2015-7221","severity":[{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2015-7222","severity":[{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2015-7223","severity":[{"type":"Ubuntu","score":"medium"}]}],"ecosystem":"Ubuntu:14.04:LTS"}}}],"schema_version":"1.7.5"}