Use-after-free vulnerability in the mozilla::dom::IndexedDB::IDBObjectStore::CreateIndex function in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted content that is improperly handled during IndexedDB index creation.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade thunderbirdUpgrade xulrunnerUpgrade xulrunner-develUpgrade firefox | Dec 1, 2016 | Feb 25, 2015 |
| Freebsd | — | Upgrade seamonkeyUpgrade linux-seamonkeyUpgrade firefoxUpgrade thunderbirdUpgrade firefox-esrUpgrade linux-thunderbirdUpgrade linux-firefoxUpgrade libxul | Dec 10, 2025 | Feb 27, 2015 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird-bin.Upgrade www-client/firefox-bin.Upgrade dev-libs/nspr.Upgrade www-client/firefox.Upgrade mail-client/thunderbird.Upgrade www-client/seamonkey.Upgrade www-client/seamonkey-bin. | Oct 30, 2017 | Feb 25, 2015 |
| Mfsa2015 16 | — | Upgrade to Mozilla Firefox version 36.0Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox ESR version 31.5 | Feb 26, 2015 | Feb 25, 2015 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.33.0 | Mar 23, 2015 | Feb 25, 2015 |
| Mozilla Thunderbird | — | Upgrade to the latest version of Mozilla ThunderbirdUpgrade to Mozilla Thunderbird version 31.5 | Feb 26, 2015 | Feb 25, 2015 |
| Oracle Solaris | — | Upgrade web/browser/firefox to version 31.6.0-0.175.2.11.0.3.0 on Solaris 11.2Upgrade web/data/firefox-bookmarks to version 31.6.0-0.175.2.11.0.3.0 on Solaris 11.2Upgrade consolidation/desktop/desktop-incorporation to version 0.5.11-0.175.3.0.0.28.0 on Solaris 11.3Upgrade web/browser/firefox/multi-user-desktop to version 31.6.0-0.175.2.11.0.3.0 on Solaris 11.2 | May 29, 2017 | Feb 25, 2015 |
| Oracle_linux | — | Upgrade thunderbirdUpgrade xulrunnerUpgrade firefoxUpgrade xulrunner-devel | Oct 16, 2024 | Feb 25, 2015 |
| Suse | — | Upgrade mozilla-nsprUpgrade mozilla-xulrunner192-translationsUpgrade mozilla-xulrunner192Upgrade MozillaFirefoxUpgrade libfreebl3-32bitUpgrade MozillaFirefox-translationsUpgrade mozilla-xulrunner191-translationsUpgrade mozilla-nspr-32bitUpgrade mozilla-xulrunner192-32bitUpgrade mozilla-nss-32bitUpgrade libfreebl3Upgrade MozillaFirefox-translations-commonUpgrade mozilla-xulrunner192-gnomeUpgrade MozillaFirefox-develUpgrade MozillaThunderbird-translations-commonUpgrade mozilla-nss-toolsUpgrade MozillaThunderbird-translations-otherUpgrade MozillaThunderbird-develUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nssUpgrade mozilla-xulrunner191-gnomevfsUpgrade MozillaThunderbirdUpgrade mozilla-xulrunner191-32bitUpgrade mozilla-xulrunner191 | Dec 18, 2015 | Feb 25, 2015 |
| Ubuntu | — | Upgrade firefoxUpgrade thunderbird | Nov 8, 2024 | Feb 25, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub