CVE-2015-7204

Mozilla Firefox before 43.0 does not properly store the properties of unboxed objects, which allows remote attackers to execute arbitrary code via crafted JavaScript variable assignments.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1216130
http://www.mozilla.org/security/announce/2015/mfsa2015-135.html	Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174253.html
http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html
http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html
http://www.securityfocus.com/bid/79280
http://www.securitytracker.com/id/1034426
https://security.gentoo.org/glsa/201512-10
http://lists.opensuse.org/opensuse-updates/2015-12/msg00104.html
http://www.ubuntu.com/usn/USN-2833-1

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:opensuse:opensuse:13.1:::::::*
	cpe:2.3:o:opensuse:leap:42.1:::::::*
	cpe:2.3:o:opensuse:opensuse:13.2:::::::*

Configuration 2 (hide)

OR	cpe:2.3:o:fedoraproject:fedora:23:::::::*
	cpe:2.3:o:fedoraproject:fedora:22:::::::*

Configuration 3 (hide)

OR	cpe:2.3:a:mozilla:firefox:41.0:::::::*
	cpe:2.3:a:mozilla:firefox:41.0.2:::::::*
	cpe:2.3:a:mozilla:firefox:41.0.1:::::::*
	cpe:2.3:a:mozilla:firefox::::::::

Information

Published : 2015-12-16 11:59

Updated : 2018-10-30 16:27

NVD link : CVE-2015-7204

Mitre link : CVE-2015-7204

JSON object : View

Products Affected

opensuse

leap
opensuse

fedoraproject

fedora

mozilla

firefox

CWE

CWE-17

DEPRECATED: Code

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1216130", "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1216130", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.mozilla.org/security/announce/2015/mfsa2015-135.html", "name": "http://www.mozilla.org/security/announce/2015/mfsa2015-135.html", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html", "name": "FEDORA-2015-51b1105902", "tags": [], "refsource": "FEDORA"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174253.html", "name": "FEDORA-2015-7ab3d3afcf", "tags": [], "refsource": "FEDORA"}, {"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html", "name": "openSUSE-SU-2016:0308", "tags": [], "refsource": "SUSE"}, {"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html", "name": "openSUSE-SU-2016:0307", "tags": [], "refsource": "SUSE"}, {"url": "http://www.securityfocus.com/bid/79280", "name": "79280", "tags": [], "refsource": "BID"}, {"url": "http://www.securitytracker.com/id/1034426", "name": "1034426", "tags": [], "refsource": "SECTRACK"}, {"url": "https://security.gentoo.org/glsa/201512-10", "name": "GLSA-201512-10", "tags": [], "refsource": "GENTOO"}, {"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00104.html", "name": "openSUSE-SU-2015:2353", "tags": [], "refsource": "SUSE"}, {"url": "http://www.ubuntu.com/usn/USN-2833-1", "name": "USN-2833-1", "tags": [], "refsource": "UBUNTU"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Mozilla Firefox before 43.0 does not properly store the properties of unboxed objects, which allows remote attackers to execute arbitrary code via crafted JavaScript variable assignments."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-17"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2015-7204", "ASSIGNER": "security@mozilla.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2015-12-16T11:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:mozilla:firefox:41.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mozilla:firefox:41.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mozilla:firefox:41.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "42.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-30T16:27Z"}