What’s Vulnerable › Vulnerabilities

CVE-2015-2729

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2015-07-06 · updated 2026-06-17
• Weakness: CWE-119

Description

The AudioParamTimeline::AudioNodeInputValue function in the Web Audio implementation in Mozilla Firefox before 39.0 and Firefox ESR 38.x before 38.1 does not properly calculate an oscillator rendering range, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspecified vectors.

Affected products

• Mozilla Firefox: through 38.1.0; 31.0, 31.1.0, 31.1.1, 31.3.0, 31.5.1, 31.5.2 (+2)
• Mozilla Firefox ESR: 31.1, 31.2, 31.3, 31.4, 31.5, 31.6.0 (+1)
• Mozilla Thunderbird: through 38.0.1
• Oracle Corporation Solaris Operating System: 11.3

References

• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html
• http://rhn.redhat.com/errata/RHSA-2015-1207.html
• http://www.mozilla.org/security/announce/2015/mfsa2015-62.html
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
• http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
• http://www.securityfocus.com/bid/75541
• http://www.securitytracker.com/id/1032783
• http://www.ubuntu.com/usn/USN-2656-1
• http://www.ubuntu.com/usn/USN-2656-2
• https://bugzilla.mozilla.org/show_bug.cgi?id=1122218
• https://security.gentoo.org/glsa/201512-10
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html

Get alerted when CVE-2015-2729 or the next vulnerability affects your stack