NetSight
IP …
critical10.0

CVE-2015-2738

The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x …

Impact

The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.

Affected products

VendorProductAffected versions
CanonicalUbuntu Linux
Versions 12.04, 14.04, 14.10, 15.04
SuseLinux Enterprise Desktop
Version 12
SuseLinux Enterprise Server
Version 11
SuseLinux Enterprise Software Development Kit
Version 12
SuseSuse Linux Enterprise Server
Version 12
DebianDebian Linux
Versions 7.0, 8.0
MozillaFirefox
through 38.1.0
Versions 31.0, 31.1.0, 31.1.1, 31.3.0, 31.5.1
MozillaFirefox Esr
Versions 31.1, 31.2, 31.3, 31.4, 31.5, 31.6.0
MozillaThunderbird
through 38.0.1
OracleSolaris
Version 11.3

Weakness classification

CWE-17

References