CVE-2015-2731
Fixed in a distro release EPSS 6%
Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allows remote attackers to execute arbitrary code by leveraging client-side JavaScript that triggers removal of a DOM object on the basis of a Content Policy.
Products: mozilla firefox, mozilla thunderbird, oracle solaris, mozilla firefox_esr
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 7 | iceweasel | 31.8.0esr-1~deb7u1 |
| Debian 8 | iceweasel | 31.8.0esr-1~deb8u1 |
| Red Hat Enterprise Linux 5 | firefox | 0:38.1.0-1.el5_11 |
| Red Hat Enterprise Linux 5 | firefox-debuginfo | 0:38.1.0-1.el5_11 |
| Red Hat Enterprise Linux 5 | thunderbird | 0:31.8.0-1.el5_11 |
| Red Hat Enterprise Linux 5 | thunderbird-debuginfo | 0:31.8.0-1.el5_11 |
| Red Hat Enterprise Linux 6 | firefox | 0:38.1.0-1.el6_6 |
| Red Hat Enterprise Linux 6 | firefox-debuginfo | 0:38.1.0-1.el6_6 |
| Red Hat Enterprise Linux 6 | thunderbird | 0:31.8.0-1.el6_6 |
| Red Hat Enterprise Linux 6 | thunderbird-debuginfo | 0:31.8.0-1.el6_6 |
| Red Hat Enterprise Linux 7 | firefox | 0:38.1.0-1.el7_1 |
| Red Hat Enterprise Linux 7 | firefox-debuginfo | 0:38.1.0-1.el7_1 |
| Red Hat Enterprise Linux 7 | thunderbird | 0:31.8.0-1.el7_1 |
| Red Hat Enterprise Linux 7 | thunderbird | 0:31.8.0-1.ael7b_1 |
| Red Hat Enterprise Linux 7 | thunderbird-debuginfo | 0:31.8.0-1.ael7b_1 |
| Red Hat Enterprise Linux 7 | thunderbird-debuginfo | 0:31.8.0-1.el7_1 |
| Red Hat rhel productivity 5 | thunderbird | 0:31.8.0-1.el5_11 |
| Red Hat rhel productivity 5 | thunderbird-debuginfo | 0:31.8.0-1.el5_11 |
| Ubuntu 14.04 LTS | firefox | 39.0+build5-0ubuntu0.14.04.1 |
| Ubuntu 14.04 LTS | thunderbird | 1:31.8.0+build1-0ubuntu0.14.04.1 |
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 |
| openSUSE Tumbleweed | MozillaThunderbird | 45.5.1-1.1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 |