CVE-2015-7178
The ProgramBinary::linkAttributes function in libGLES in ANGLE, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows, mishandles shader access, which allows remote attackers to execute arbitrary code or cause a denial of…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.42%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The ProgramBinary::linkAttributes function in libGLES in ANGLE, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows, mishandles shader access, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted (1) OpenGL or (2) WebGL content.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 3.42% probability · 88th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- mozilla/firefox
- Source
- security@mozilla.org
References
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00005.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-113.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securityfocus.com/bid/76816
- http://www.securitytracker.com/id/1033640
- https://bugzilla.mozilla.org/show_bug.cgi?id=1189860
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00005.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-113.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securityfocus.com/bid/76816
- http://www.securitytracker.com/id/1033640
- https://bugzilla.mozilla.org/show_bug.cgi?id=1189860
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.