NVD Vulnerability Detail

CVE-2015-2729

Summary	The AudioParamTimeline::AudioNodeInputValue function in the Web Audio implementation in Mozilla Firefox before 39.0 and Firefox ESR 38.x before 38.1 does not properly calculate an oscillator rendering range, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspecified vectors.
Publication Date	July 6, 2015, 11:01 a.m.
Registration Date	Jan. 26, 2021, 2:48 p.m.
Last Update	Nov. 21, 2024, 11:27 a.m.

Affected software configurations

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:mozilla:thunderbird::::::::			38.0.1

Configuration3		or higher	or less	more than	less than
cpe:2.3:a:mozilla:firefox::::::::			38.1.0

Configuration4		or higher	or less	more than	less than
cpe:2.3:o:oracle:solaris:11.3:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html
2	http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html
3	http://rhn.redhat.com/errata/RHSA-2015-1207.html
4	http://rhn.redhat.com/errata/RHSA-2015-1207.html
5	http://www.mozilla.org/security/announce/2015/mfsa2015-62.html	Vendor Advisory
6	http://www.mozilla.org/security/announce/2015/mfsa2015-62.html	Vendor Advisory
7	http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html	Third Party Advisory
8	http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html	Third Party Advisory
9	http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html	Third Party Advisory
10	http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html	Third Party Advisory
11	http://www.securityfocus.com/bid/75541
12	http://www.securityfocus.com/bid/75541
13	http://www.securitytracker.com/id/1032783
14	http://www.securitytracker.com/id/1032783
15	http://www.ubuntu.com/usn/USN-2656-1
16	http://www.ubuntu.com/usn/USN-2656-1
17	http://www.ubuntu.com/usn/USN-2656-2
18	http://www.ubuntu.com/usn/USN-2656-2
19	https://bugzilla.mozilla.org/show_bug.cgi?id=1122218	Issue Tracking
20	https://bugzilla.mozilla.org/show_bug.cgi?id=1122218	Issue Tracking
21	https://security.gentoo.org/glsa/201512-10
22	https://security.gentoo.org/glsa/201512-10

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

JVN Vulnerability Information

Mozilla Firefox の Web Audio の実装の AudioParamTimeline::AudioNodeInputValue 関数におけるプロセスメモリから重要な情報を取得される脆弱性

Title	Mozilla Firefox の Web Audio の実装の AudioParamTimeline::AudioNodeInputValue 関数におけるプロセスメモリから重要な情報を取得される脆弱性
Summary	Mozilla Firefox の Web Audio の実装の AudioParamTimeline::AudioNodeInputValue 関数は、振動子レンダリング範囲を適切に計算しないため、プロセスメモリから重要な情報を取得される、またはサービス運用妨害 (out-of-bounds read) 状態にされる脆弱性が存在します。
Possible impacts	第三者により、プロセスメモリから重要な情報を取得される、またはサービス運用妨害 (out-of-bounds read) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 2, 2015, midnight
Registration Date	July 9, 2015, 12:31 p.m.
Last Update	Nov. 6, 2015, 3:21 p.m.

Affected System

Mozilla Foundation

Mozilla Firefox 39.0 未満

Mozilla Firefox ESR 38.1 未満の 38.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-2729	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2729
National Vulnerability Database (NVD)
2	CVE-2015-2729	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2729

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
Mozilla Foundation Security Advisory
1	MFSA2015-62	http://www.mozilla.org/security/announce/2015/mfsa2015-62.html
Mozilla Foundation セキュリティアドバイザリ
2	MFSA2015-62	http://www.mozilla-japan.org/security/announce/2015/mfsa2015-62.html
Oracle Technology Network
3	Oracle Solaris Third Party Bulletin - October 2015	http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html

Change Log

No	Changed Details	Date of change
0	[2015年07月09日] 掲載 [2015年11月06日] ベンダ情報：オラクル (Oracle Solaris Third Party Bulletin - October 2015) を追加	Feb. 17, 2018, 10:37 a.m.