CVE-2015-2740

HIGH
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 might allow remote attackers to cause a denial of service or have unspecified other impact via unknown vectors.

References

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html

http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html

http://rhn.redhat.com/errata/RHSA-2015-1207.html

http://rhn.redhat.com/errata/RHSA-2015-1455.html

http://www.debian.org/security/2015/dsa-3300

http://www.debian.org/security/2015/dsa-3324

http://www.mozilla.org/security/announce/2015/mfsa2015-66.html

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html

http://www.securityfocus.com/bid/75541

http://www.securitytracker.com/id/1032783

http://www.securitytracker.com/id/1032784

http://www.ubuntu.com/usn/USN-2656-1

http://www.ubuntu.com/usn/USN-2656-2

http://www.ubuntu.com/usn/USN-2673-1

https://bugzilla.mozilla.org/show_bug.cgi?id=1170809

https://security.gentoo.org/glsa/201512-10

Details

Source: MITRE

Published: 2015-07-06

Updated: 2016-12-28

Type: CWE-119

Risk Information

CVSS v2

Base Score: 10

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 10

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* versions up to 38.0.1 (inclusive)

Configuration 2

OR

cpe:2.3:a:mozilla:firefox_esr:31.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:31.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:31.1.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:31.1.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:31.2:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:31.3:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:31.3.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:31.4:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:31.5:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:31.5.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:31.5.2:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:31.5.3:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:31.6.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:31.7.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:38.0:*:*:*:*:*:*:*

Configuration 3

OR

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:*:*:*:*:*:*:*

cpe:2.3:o:novell:suse_linux_enterprise_server:11:sp4:*:*:*:*:*:*

cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:*:*:*:*:*:*:*

cpe:2.3:o:novell:suse_linux_enterprise_software_development_kit:12.0:*:*:*:*:*:*:*

Configuration 4

OR

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* versions up to 38.1.0 (inclusive)

Configuration 5

OR

cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*

Tenable Plugins

View all (30 total)

IDNameProductFamilySeverity
87710GLSA-201512-10 : Mozilla Products: Multiple vulnerabilities (Bar Mitzvah) (Logjam)NessusGentoo Local Security Checks
critical
8879Mozilla Thunderbird < 38.1 Multiple Vulnerabilities (Logjam)Nessus Network MonitorSMTP Clients
critical
8855Mozilla Firefox < 39.0 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
critical
85721SUSE SLES11 Security Update : MozillaFirefox, mozilla-nss (SUSE-SU-2015:1449-1) (Logjam)NessusSuSE Local Security Checks
low
85163Debian DSA-3324-1 : icedove - security update (Logjam)NessusDebian Local Security Checks
low
84900Ubuntu 12.04 LTS / 14.04 LTS / 14.10 / 15.04 : thunderbird vulnerabilities (USN-2673-1) (Logjam)NessusUbuntu Local Security Checks
low
84899SUSE SLED12 / SLES12 Security Update : MozillaFirefox, mozilla-nspr, mozilla-nss (SUSE-SU-2015:1269-1)NessusSuSE Local Security Checks
critical
84898SUSE SLED11 / SLES11 Security Update : MozillaFirefox, mozilla-nspr, mozilla-nss (SUSE-SU-2015:1268-2)NessusSuSE Local Security Checks
critical
84895Scientific Linux Security Update : thunderbird on SL5.x, SL6.x, SL7.x i386/x86_64 (20150720)NessusScientific Linux Local Security Checks
critical
84893RHEL 5 / 6 / 7 : thunderbird (RHSA-2015:1455)NessusRed Hat Local Security Checks
critical
84890Oracle Linux 6 / 7 : thunderbird (ELSA-2015-1455)NessusOracle Linux Local Security Checks
critical
84884CentOS 5 / 6 / 7 : thunderbird (CESA-2015:1455)NessusCentOS Local Security Checks
critical
84864openSUSE Security Update : MozillaThunderbird (openSUSE-2015-495) (Logjam)NessusSuSE Local Security Checks
low
84794Ubuntu 12.04 LTS : firefox vulnerabilities (USN-2656-2) (Logjam)NessusUbuntu Local Security Checks
low
84780FreeBSD : mozilla -- multiple vulnerabilities (44d9daee-940c-4179-86bb-6e3ffd617869) (Logjam)NessusFreeBSD Local Security Checks
low
84720openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2015-480) (Logjam)NessusSuSE Local Security Checks
low
84664Ubuntu 14.04 LTS / 14.10 / 15.04 : firefox vulnerabilities (USN-2656-1) (Logjam)NessusUbuntu Local Security Checks
low
84582Mozilla Thunderbird < 38.1 Multiple Vulnerabilities (Logjam)NessusWindows
critical
84581Firefox < 39.0 Multiple Vulnerabilities (Logjam)NessusWindows
critical
84580Firefox ESR < 38.1 Multiple Vulnerabilities (Logjam)NessusWindows
critical
84579Firefox ESR < 31.8 Multiple Vulnerabilities (Logjam)NessusWindows
critical
84578Mozilla Thunderbird < 38.1 Multiple Vulnerabilities (Mac OS X) (Logjam)NessusMacOS X Local Security Checks
critical
84577Firefox < 39.0 Multiple Vulnerabilities (Mac OS X) (Logjam)NessusMacOS X Local Security Checks
critical
84576Firefox ESR < 38.1 Multiple Vulnerabilities (Mac OS X) (Logjam)NessusMacOS X Local Security Checks
critical
84575Firefox ESR < 31.8 Multiple Vulnerabilities (Mac OS X) (Logjam)NessusMacOS X Local Security Checks
critical
84550CentOS 5 / 6 / 7 : firefox (CESA-2015:1207)NessusCentOS Local Security Checks
critical
84543Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20150703)NessusScientific Linux Local Security Checks
critical
84535RHEL 5 / 6 / 7 : firefox (RHSA-2015:1207)NessusRed Hat Local Security Checks
critical
84534Oracle Linux 5 / 6 / 7 : firefox (ELSA-2015-1207)NessusOracle Linux Local Security Checks
critical
84510Debian DSA-3300-1 : iceweasel - security update (Logjam)NessusDebian Local Security Checks
low