Heap-based buffer overflow in the mozilla::gfx::CopyRect function in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to obtain sensitive information from uninitialized process memory via a malformed SVG graphic.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xulrunnerUpgrade thunderbirdUpgrade firefoxUpgrade xulrunner-devel | Dec 1, 2016 | Feb 25, 2015 |
| Freebsd | — | Upgrade linux-firefoxUpgrade linux-seamonkeyUpgrade seamonkeyUpgrade thunderbirdUpgrade firefoxUpgrade libxulUpgrade firefox-esrUpgrade linux-thunderbird | Dec 10, 2025 | Feb 27, 2015 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird-bin.Upgrade www-client/firefox-bin.Upgrade dev-libs/nspr.Upgrade www-client/seamonkey-bin.Upgrade www-client/seamonkey.Upgrade www-client/firefox.Upgrade mail-client/thunderbird. | Oct 30, 2017 | Feb 25, 2015 |
| Mfsa2015 19 | — | Upgrade to Mozilla Firefox ESR version 31.5Upgrade to Mozilla Firefox version 36.0Upgrade to the latest version of Mozilla Firefox | Feb 26, 2015 | Feb 25, 2015 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.33.0 | Mar 23, 2015 | Feb 25, 2015 |
| Mozilla Thunderbird | — | Upgrade to the latest version of Mozilla ThunderbirdUpgrade to Mozilla Thunderbird version 31.5 | Feb 26, 2015 | Feb 25, 2015 |
| Oracle Solaris | — | Upgrade web/data/firefox-bookmarks to version 31.6.0-0.175.2.11.0.3.0 on Solaris 11.2Upgrade web/browser/firefox to version 31.6.0-0.175.2.11.0.3.0 on Solaris 11.2Upgrade web/browser/firefox/multi-user-desktop to version 31.6.0-0.175.2.11.0.3.0 on Solaris 11.2Upgrade consolidation/desktop/desktop-incorporation to version 0.5.11-0.175.3.0.0.28.0 on Solaris 11.3 | May 29, 2017 | Feb 25, 2015 |
| Oracle_linux | — | Upgrade xulrunnerUpgrade firefoxUpgrade thunderbirdUpgrade xulrunner-devel | Oct 16, 2024 | Feb 25, 2015 |
| Suse | — | Upgrade MozillaFirefox-develUpgrade mozilla-xulrunner192-translationsUpgrade MozillaFirefox-translations-commonUpgrade MozillaThunderbirdUpgrade mozilla-nspr-32bitUpgrade mozilla-xulrunner191-32bitUpgrade mozilla-xulrunner192-gnomeUpgrade mozilla-nss-toolsUpgrade mozilla-nssUpgrade MozillaThunderbird-translations-otherUpgrade mozilla-xulrunner192-32bitUpgrade mozilla-xulrunner191Upgrade mozilla-nsprUpgrade MozillaFirefox-translations-otherUpgrade MozillaFirefox-translationsUpgrade mozilla-nss-32bitUpgrade mozilla-xulrunner192Upgrade mozilla-xulrunner191-gnomevfsUpgrade libfreebl3-32bitUpgrade MozillaFirefoxUpgrade MozillaThunderbird-translations-commonUpgrade MozillaThunderbird-develUpgrade mozilla-xulrunner191-translationsUpgrade libfreebl3 | Dec 18, 2015 | Feb 25, 2015 |
| Ubuntu | — | Upgrade firefoxUpgrade thunderbird | Nov 8, 2024 | Feb 25, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub