Skip to content
OpenAdvisories
Low USN-2656-1 21 CVEs

firefox vulnerabilities

Published Jul 9, 2015 · Updated May 29, 2026

Ecosystem: Ubuntu

Summary

Karthikeyan Bhargavan discovered that NSS incorrectly handled state
transitions for the TLS state machine. If a remote attacker were able to
perform a machine-in-the-middle attack, this flaw could be exploited to skip
the ServerKeyExchange message and remove the forward-secrecy property.
(CVE-2015-2721)

Looben Yan discovered 2 use-after-free issues when using XMLHttpRequest in
some circumstances. If a user were tricked in to opening a specially
crafted website, an attacker could potentially exploit these to cause a
denial of service via application crash, or execute arbitrary code with
the privileges of the user invoking Firefox. (CVE-2015-2722,
CVE-2015-2733)

Bob Clary, Christian Holler, Bobby Holley, Andrew McCreight, Terrence
Cole, Steve Fink, Mats Palmgren, Wes Kocher, Andreas Pehrson, Tooru
Fujisawa, Andrew Sutherland, and Gary Kwong discovered multiple memory
safety issues in Firefox. If a user were tricked in to opening a specially
crafted website, an attacker could potentially exploit these to cause a
denial of service via application crash, or execute arbitrary code with
the privileges of the user invoking Firefox. (CVE-2015-2724,
CVE-2015-2725, CVE-2015-2726)

Armin Razmdjou discovered that opening hyperlinks with specific mouse
and key combinations could allow a Chrome privileged URL to be opened
without context restrictions being preserved. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to bypass security restrictions. (CVE-2015-2727)

Paul Bandha discovered a type confusion bug in the Indexed DB Manager. If
a user were tricked in to opening a specially crafted website, an attacker
could potentially exploit this to cause a denial of service via
application crash or execute arbitrary code with the priviliges of the
user invoking Firefox. (CVE-2015-2728)

Holger Fuhrmannek discovered an out-of-bounds read in Web Audio. If a
user were tricked in to opening a specially crafted website, an attacker
could potentially exploit this to obtain sensitive information.
(CVE-2015-2729)

Watson Ladd discovered that NSS incorrectly handled Elliptical Curve
Cryptography (ECC) multiplication. A remote attacker could possibly use
this issue to spoof ECDSA signatures. (CVE-2015-2730)

A use-after-free was discovered when a Content Policy modifies the DOM to
remove a DOM object. If a user were tricked in to opening a specially
crafted website, an attacker could potentially exploit this to cause a
denial of service via application crash or execute arbitrary code with the
priviliges of the user invoking Firefox. (CVE-2015-2731)

Ronald Crane discovered multiple security vulnerabilities. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service via application
crash, or execute arbitrary code with the privileges of the user invoking
Firefox. (CVE-2015-2734, CVE-2015-2735, CVE-2015-2736, CVE-2015-2737,
CVE-2015-2738, CVE-2015-2739, CVE-2015-2740)

David Keeler discovered that key pinning checks can be skipped when an
overridable certificate error occurs. This allows a user to manually
override an error for a fake certificate, but cannot be exploited on its
own. (CVE-2015-2741)

Jonas Jenwald discovered that some internal workers were incorrectly
executed with a high privilege. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit this in
combination with another security vulnerability, to execute arbitrary code
in a privileged scope. (CVE-2015-2743)

Matthew Green discovered a DHE key processing issue in NSS where a MITM
could force a server to downgrade TLS connections to 512-bit export-grade
cryptography. An attacker could potentially exploit this to impersonate
the server. (CVE-2015-4000)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS firefox 39.0+build5-0ubuntu0.14.04.1

Vulnerabilities 21

  • Low 3.7
    CVE-2015-4000 Public exploit EPSS 100%

    The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pr…

    thunderbird firefox openssl openssl Debian Ubuntu
  • Unscored —
    CVE-2015-2721

    Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31…

    thunderbird firefox nss nss Debian Ubuntu
  • Unscored —
    CVE-2015-2722

    Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ES…

    firefox Ubuntu
  • Unscored —
    CVE-2015-2724

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8…

    thunderbird firefox Ubuntu
  • Unscored —
    CVE-2015-2725

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1…

    thunderbird firefox Ubuntu
  • Unscored —
    CVE-2015-2726

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0 allow remote attackers to cau…

    firefox Ubuntu
  • Unscored —
    CVE-2015-2727

    Mozilla Firefox 38.0 and Firefox ESR 38.0 allow user-assisted remote attackers to read arbitrary files or execute arbit…

    firefox Ubuntu
  • Unscored —
    CVE-2015-2728

    The IndexedDatabaseManager class in the IndexedDB implementation in Mozilla Firefox before 39.0 and Firefox ESR 31.x be…

    firefox Ubuntu
  • Unscored —
    CVE-2015-2729

    The AudioParamTimeline::AudioNodeInputValue function in the Web Audio implementation in Mozilla Firefox before 39.0 and…

    firefox Ubuntu
  • Unscored —
    CVE-2015-2730

    Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before …

    thunderbird firefox nss nss Debian Ubuntu
  • Unscored —
    CVE-2015-2731

    Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox …

    thunderbird firefox Ubuntu
  • Unscored —
    CVE-2015-2733

    Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ES…

    firefox Ubuntu
  • Unscored —
    CVE-2015-2734

    The CairoTextureClientD3D9::BorrowDrawTarget function in the Direct3D 9 implementation in Mozilla Firefox before 39.0, …

    thunderbird firefox Ubuntu
  • Unscored —
    CVE-2015-2735

    nsZipArchive.cpp in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird bef…

    thunderbird firefox Ubuntu
  • Unscored —
    CVE-2015-2736

    The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 3…

    thunderbird firefox Ubuntu
  • Unscored —
    CVE-2015-2737

    The rx::d3d11::SetBufferData function in the Direct3D 11 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.…

    thunderbird firefox Ubuntu
  • Unscored —
    CVE-2015-2738

    The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0…

    thunderbird firefox Ubuntu
  • Unscored —
    CVE-2015-2739

    The ArrayBufferBuilder::append function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38…

    thunderbird firefox Ubuntu
  • Unscored —
    CVE-2015-2740

    Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39.0, Firefox ESR 31.x…

    thunderbird firefox Ubuntu
  • Unscored —
    CVE-2015-2741

    Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 do not enforce key pinning upon …

    thunderbird firefox Ubuntu
  • Unscored —
    CVE-2015-2743

    PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables excessive privilege…

    firefox Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2015-2721
  • report
    https://ubuntu.com/security/CVE-2015-2722
  • report
    https://ubuntu.com/security/CVE-2015-2724
  • report
    https://ubuntu.com/security/CVE-2015-2725
  • report
    https://ubuntu.com/security/CVE-2015-2726
  • report
    https://ubuntu.com/security/CVE-2015-2727
  • report
    https://ubuntu.com/security/CVE-2015-2728
  • report
    https://ubuntu.com/security/CVE-2015-2729
  • report
    https://ubuntu.com/security/CVE-2015-2730
  • report
    https://ubuntu.com/security/CVE-2015-2731
  • report
    https://ubuntu.com/security/CVE-2015-2733
  • report
    https://ubuntu.com/security/CVE-2015-2734
  • report
    https://ubuntu.com/security/CVE-2015-2735
  • report
    https://ubuntu.com/security/CVE-2015-2736
  • report
    https://ubuntu.com/security/CVE-2015-2737
  • report
    https://ubuntu.com/security/CVE-2015-2738
  • report
    https://ubuntu.com/security/CVE-2015-2739
  • report
    https://ubuntu.com/security/CVE-2015-2740
  • report
    https://ubuntu.com/security/CVE-2015-2741
  • report
    https://ubuntu.com/security/CVE-2015-2743
  • report
    https://ubuntu.com/security/CVE-2015-4000