CVE-2015-0817

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-03-24 · updated 2026-06-17
Weakness: CWE-17

Description

The asm.js implementation in Mozilla Firefox before 36.0.3, Firefox ESR 31.x before 31.5.2, and SeaMonkey before 2.33.1 does not properly determine the cases in which bounds checking may be safely skipped during JIT compilation and heap access, which allows remote attackers to read or write to unintended memory locations, and consequently execute arbitrary code, via crafted JavaScript.

Affected products

Mozilla Firefox: through 36.0.1; 31.0, 31.1.0, 31.1.1, 31.3.0, 31.5.1
Mozilla Firefox ESR: 31.1, 31.2, 31.3, 31.4, 31.5
Mozilla Seamonkey: through 2.33.0

References

http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00026.html
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00029.html
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00035.html
http://lists.opensuse.org/opensuse-updates/2015-03/msg00096.html
http://rhn.redhat.com/errata/RHSA-2015-0718.html
http://www.debian.org/security/2015/dsa-3201
http://www.mozilla.org/security/announce/2015/mfsa2015-29.html
http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
http://www.securityfocus.com/bid/73263
http://www.securitytracker.com/id/1031958
http://www.ubuntu.com/usn/USN-2538-1
https://bugzilla.mozilla.org/show_bug.cgi?id=1145255

Get alerted when CVE-2015-0817 or the next vulnerability affects your stack