← Back

CVE-2015-2731

nvd nist
Published: Jul 6, 2015Modified: May 6, 2026

JSON object

Loading...
10.0
Vector
AV:N/AC:L/Au:N/C:C/I:C/A:C
Exploitability: 10.0 / Impact: 10.0
Source: NVD

Description

Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allows remote attackers to execute arbitrary code by leveraging client-side JavaScript that triggers removal of a DOM object on the basis of a Content Policy.

Affected (18)

Mozilla
3 products
Firefox
Thunderbird
Firefox Esr
Oracle
1 product
Solaris
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Firefox
Up to 38.1.0
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Thunderbird
Up to 38.0.1
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Solaris
Version 11.3
Configuration D
15 vulnerable
Vulnerable SoftwareAffected Versions
Mozilla
Firefox
Version 31.0
Firefox
Version 31.1.0
Firefox
Version 31.1.1
Firefox
Version 31.3.0
Firefox
Version 31.5.1
Firefox
Version 31.5.2
Firefox
Version 31.5.3
Firefox
Version 38.0
Mozilla
Firefox Esr
Version 31.1
Firefox Esr
Version 31.2
Firefox Esr
Version 31.3
Firefox Esr
Version 31.4
Firefox Esr
Version 31.5
Firefox Esr
Version 31.6.0
Firefox Esr
Version 31.7.0

References (28)

Source: security@mozilla.org
Source: security@mozilla.org
Source: security@mozilla.org
Source: security@mozilla.org
Source: security@mozilla.org
Vendor Advisory
Source: security@mozilla.org
Third Party Advisory
Source: security@mozilla.org
Third Party Advisory
Source: security@mozilla.org
Source: security@mozilla.org
Source: security@mozilla.org
Source: security@mozilla.org
Source: security@mozilla.org
Source: security@mozilla.org
Issue Tracking
Source: security@mozilla.org
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Issue Tracking
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.