CVE-2015-4497: Use After Free

Published Aug 29, 2015

Updated

Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute arbitrary code by leveraging improper interaction between resize events and changes to Cascading Style Sheets (CSS) token sequences for a CANVAS element.

Affected Software

11 affected components

Mozilla Firefox=38.0

Mozilla Firefox=38.0.1

Mozilla Firefox=38.0.5

Mozilla Firefox=38.1.0

Mozilla Firefox=38.2.0

Mozilla Firefox=40.0.2

Mozilla Firefox ESR=38.0

Mozilla Firefox ESR=38.0.1

Mozilla Firefox ESR=38.0.5

Mozilla Firefox ESR=38.1.0

Mozilla Firefox ESR=38.2.0

Event History

Aug 29, 2015

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4497?

CVE-2015-4497 is classified as a critical vulnerability due to its potential to allow remote code execution.

How do I fix CVE-2015-4497?

To fix CVE-2015-4497, update Mozilla Firefox to version 40.0.3 or later, or Firefox ESR to version 38.2.1 or later.

What versions of Firefox are affected by CVE-2015-4497?

CVE-2015-4497 affects Mozilla Firefox versions before 40.0.3 and Firefox ESR versions before 38.2.1.

Can CVE-2015-4497 be exploited remotely?

Yes, CVE-2015-4497 can be exploited remotely by attackers through malicious web content.

What type of vulnerability is CVE-2015-4497?

CVE-2015-4497 is a use-after-free vulnerability in the CanvasRenderingContext2D implementation.