CVEvulnerability
CVE-2015-7178
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2015-09-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-119
Description
The ProgramBinary::linkAttributes function in libGLES in ANGLE, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows, mishandles shader access, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted (1) OpenGL or (2) WebGL content.
Affected configurations
• mozilla firefox 38.0
• mozilla firefox 38.0.1
• mozilla firefox 38.0.5
• mozilla firefox 38.1.0
• mozilla firefox 38.1.1
• mozilla firefox 38.2.0
• mozilla firefox 38.2.1
• mozilla firefox (<= 40.0.3)
Related
Weakness · CWE (1)
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00003.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00005.html lists.opensuse.org
- http://www.mozilla.org/security/announce/2015/mfsa2015-113.html Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html www.oracle.com
- http://www.securityfocus.com/bid/76816 www.securityfocus.com
- http://www.securitytracker.com/id/1033640 www.securitytracker.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=1189860 bugzilla.mozilla.org
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00003.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00005.html lists.opensuse.org
- http://www.mozilla.org/security/announce/2015/mfsa2015-113.html Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html www.oracle.com
- http://www.securityfocus.com/bid/76816 www.securityfocus.com
- http://www.securitytracker.com/id/1033640 www.securitytracker.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=1189860 bugzilla.mozilla.org