CVE-2015-7183 Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox bef...
HighCVSS 7.5
EPSS 6.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/nspr(Debian:12) | < 2:4.10.10-1 | 2:4.10.10-1 |
| debian/nspr(Debian:13) | < 2:4.10.10-1 | 2:4.10.10-1 |
| debian/nspr(Debian:14) | < 2:4.10.10-1 | 2:4.10.10-1 |
| mozilla Firefox | <= 41.0.2 | No fix listed |
| mozilla Firefox | = 38.0 | No fix listed |
| mozilla Firefox | = 38.0.1 | No fix listed |
| mozilla Firefox | = 38.0.5 | No fix listed |
| mozilla Firefox | = 38.1.0 | No fix listed |
| mozilla Firefox | = 38.1.1 | No fix listed |
| mozilla Firefox | = 38.2.0 | No fix listed |
| mozilla Firefox | = 38.2.1 | No fix listed |
| mozilla Firefox | = 38.3.0 | No fix listed |
| mozilla network security services | <= 3.19.2.0 | No fix listed |
| mozilla network security services | = 3.20.0 | No fix listed |
References
- Debian Security Tracker CVE-2015-7183 vendor-advisory
- SUSE-SU-2015:1926 vendor-advisory
- openSUSE-SU-2015:1942 vendor-advisory
- SUSE-SU-2015:1978 vendor-advisory
- SUSE-SU-2015:1981 vendor-advisory
- SUSE-SU-2015:2081 vendor-advisory
- openSUSE-SU-2015:2229 vendor-advisory
- openSUSE-SU-2015:2245 vendor-advisory
- packetstormsecurity.com
- RHSA-2015:1980 vendor-advisory
- RHSA-2015:1981 vendor-advisory
- DSA-3393 vendor-advisory
- DSA-3406 vendor-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- 77415 vdb-entry
- 91787 vdb-entry
- 1034069 vdb-entry
- SSA:2015-310-02 vendor-advisory
- USN-2785-1 vendor-advisory
- USN-2790-1 vendor-advisory
- USN-2819-1 vendor-advisory
- bto.bluecoat.com
- bugzilla.mozilla.org
- developer.mozilla.org vendor-advisory
- developer.mozilla.org vendor-advisory
- developer.mozilla.org vendor-advisory
- GLSA-201512-10 vendor-advisory
- GLSA-201605-06 vendor-advisory