Rapid7 Vulnerability & Exploit Database

MFSA2015-29 SeaMonkey: Code execution through incorrect JavaScript bounds checking elimination (CVE-2015-0817)

Back to Search

MFSA2015-29 SeaMonkey: Code execution through incorrect JavaScript bounds checking elimination (CVE-2015-0817)

Severity
7
CVSS
(AV:N/AC:M/Au:N/C:P/I:P/A:P)
Published
03/20/2015
Created
07/25/2018
Added
03/23/2015
Modified
04/05/2017

Description

The asm.js implementation in Mozilla Firefox before 36.0.3, Firefox ESR 31.x before 31.5.2, and SeaMonkey before 2.33.1 does not properly determine the cases in which bounds checking may be safely skipped during JIT compilation and heap access, which allows remote attackers to read or write to unintended memory locations, and consequently execute arbitrary code, via crafted JavaScript.

Solution(s)

  • mozilla-seamonkey-upgrade-2_33_1

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;