Уязвимость use-after-free в реализации WebGL, позволяющая удаленно выполнить произвольный код в Mozilla Firefox, Thunderbird и SeaMonkey
Описание
Use-after-free уязвимость была обнаружена в реализации WebGL, что позволяет злоумышленнику выполнить произвольный код. Эта уязвимость связана с удалением фрагментного шейдера через его аксессор.
Затронутые версии ПО
- Mozilla Firefox до версии 15.0
- Mozilla Firefox ESR 10.x до версии 10.0.7
- Mozilla Thunderbird до версии 15.0
- Mozilla Thunderbird ESR 10.x до версии 10.0.7
- Mozilla SeaMonkey до версии 2.12
Тип уязвимости
Удаленное выполнение произвольного кода
Ссылки
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Vendor Advisory
- Third Party AdvisoryVDB Entry
- Third Party Advisory
- Third Party Advisory
- http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdfThird Party Advisory
- Issue TrackingVendor Advisory
- Third Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Vendor Advisory
- Third Party AdvisoryVDB Entry
- Third Party Advisory
Уязвимые конфигурации
Одно из
Одно из
Одно из
Одно из
EPSS
10 Critical
CVSS2
Дефекты
Связанные уязвимости
Use-after-free vulnerability in the WebGL implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via vectors related to deletion of a fragment shader by its accessor.
Use-after-free vulnerability in the WebGL implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via vectors related to deletion of a fragment shader by its accessor.
Use-after-free vulnerability in the WebGL implementation in Mozilla Fi ...
Use-after-free vulnerability in the WebGL implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via vectors related to deletion of a fragment shader by its accessor.
EPSS
10 Critical
CVSS2