Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-2716

Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.

Published

2015-05-14T10:59:09.117

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-119
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application mozilla firefox ≤ 37.0.2 Yes
Application novell suse_linux_enterprise_software_development_kit 12.0 Yes
Operating System novell suse_linux_enterprise_desktop 12.0 Yes
Operating System novell suse_linux_enterprise_server 12.0 Yes
Operating System opensuse opensuse 13.1 Yes
Operating System opensuse opensuse 13.2 Yes
Application mozilla thunderbird ≤ 31.5 Yes
Operating System oracle solaris 11.3 Yes
Application mozilla firefox 31.0 Yes
Application mozilla firefox 31.1.0 Yes
Application mozilla firefox 31.1.1 Yes
Application mozilla firefox 31.3.0 Yes
Application mozilla firefox 31.5.1 Yes
Application mozilla firefox 31.5.2 Yes
Application mozilla firefox 31.5.3 Yes
Application mozilla firefox_esr 31.1 Yes
Application mozilla firefox_esr 31.2 Yes
Application mozilla firefox_esr 31.3 Yes
Application mozilla firefox_esr 31.4 Yes
Application mozilla firefox_esr 31.5 Yes
Application mozilla firefox_esr 31.6.0 Yes
References