CVE-2015-7210

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-12-16 · updated 2026-06-17

Description

Use-after-free vulnerability in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering attempted use of a data channel that has been closed by a WebRTC function.

Affected products

Fedoraproject Fedora: 22, 23
Mozilla Firefox: through 42.0; 38.0, 38.0.1, 38.0.5, 38.1.0, 38.1.1, 38.2.0 (+3)
openSUSE Leap: 42.1
Opensuse: 13.1, 13.2

References

http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174253.html
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00021.html
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00022.html
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00023.html
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00038.html
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00049.html
http://lists.opensuse.org/opensuse-updates/2015-12/msg00104.html
http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html
http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html
http://rhn.redhat.com/errata/RHSA-2015-2657.html
http://www.debian.org/security/2015/dsa-3422

Get alerted when CVE-2015-7210 or the next vulnerability affects your stack