{"id":"CVE-2015-2736","url":"https://www.cyber-defence.io/tools/cve/CVE-2015-2736","generatedAt":"2026-10-28T03:22:27.215Z","title":"The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via…","description":"The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive.","published":"2015-07-06T02:01:05.000Z","lastModified":"2026-06-17T00:24:39.000Z","status":"Modified","sourceIdentifier":"security@mozilla.org","cvss":{"version":"2.0","score":9.3,"severity":"HIGH","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C"},"cwe":["CWE-17"],"affected":["mozilla/firefox","mozilla/thunderbird","mozilla/firefox esr","oracle/solaris","novell/suse linux enterprise software development kit","canonical/ubuntu linux","debian/debian linux","novell/suse linux enterprise desktop","novell/suse linux enterprise server"],"epss":{"score":0.0374,"percentile":0.89772,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (3.74%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html","source":"security@mozilla.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1207.html","source":"security@mozilla.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1455.html","source":"security@mozilla.org"},{"url":"http://www.debian.org/security/2015/dsa-3300","source":"security@mozilla.org"},{"url":"http://www.debian.org/security/2015/dsa-3324","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://www.mozilla.org/security/announce/2015/mfsa2015-66.html","tags":["Vendor Advisory"],"source":"security@mozilla.org"},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://www.securityfocus.com/bid/75541","source":"security@mozilla.org"},{"url":"http://www.securitytracker.com/id/1032783","source":"security@mozilla.org"},{"url":"http://www.securitytracker.com/id/1032784","source":"security@mozilla.org"},{"url":"http://www.ubuntu.com/usn/USN-2656-1","source":"security@mozilla.org"},{"url":"http://www.ubuntu.com/usn/USN-2656-2","source":"security@mozilla.org"},{"url":"http://www.ubuntu.com/usn/USN-2673-1","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1167888","tags":["Issue Tracking"],"source":"security@mozilla.org"},{"url":"https://security.gentoo.org/glsa/201512-10","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1207.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1455.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2015/dsa-3300","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2015/dsa-3324","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.mozilla.org/security/announce/2015/mfsa2015-66.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/75541","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1032783","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1032784","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-2656-1","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-2656-2","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-2673-1","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1167888","tags":["Issue Tracking"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201512-10","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-2736","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}