Description
Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute arbitrary code by leveraging improper interaction between resize events and changes to Cascading Style Sheets (CSS) token sequences for a CANVAS element.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | iceweasel | 38.2.1esr-1~deb8u1 | DSA-3345-1 |
| Debian 7 | iceweasel | 38.2.1esr-1~deb7u1 | DSA-3345-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | firefox | 40.0.3+build1-0ubuntu0.14.04.1 | USN-2723-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | firefox | 38.2.1-1.el7_1 | RHSA-2015:1693 |
| RHEL 6 | firefox | 38.2.1-1.el6_7 | RHSA-2015:1693 |
| RHEL 5 | firefox | 38.2.1-1.el5_11 | RHSA-2015:1693 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | MozillaFirefox | 38.2.1esr-45.1 | SUSE-SU-2015:1476-1 |
| SLES 12 | MozillaFirefox-branding-SLE | 31.0-14.1 | SUSE-SU-2015:1476-1 |
| SLES 12 | mozilla-nss | 3.19.2.0-26.2 | SUSE-SU-2015:1476-1 |
| SLES 11 SP2 | MozillaFirefox | 38.2.1esr-17.1 | SUSE-SU-2015:1504-1 |
| SLES 11 SP1 | MozillaFirefox | 38.2.1esr-17.1 | SUSE-SU-2015:1504-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 | MozillaFirefox | 38.2.1esr-45.1 | SUSE-SU-2015:1476-1 |
| SLES for SAP 12 | MozillaFirefox-branding-SLE | 31.0-14.1 | SUSE-SU-2015:1476-1 |
| SLES for SAP 12 | mozilla-nss | 3.19.2.0-26.2 | SUSE-SU-2015:1476-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 | openSUSE-SU-2024:10071-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | firefox | 38.2.1-1.0.1.el7_1 | ELSA-2015-1693 |
Advisories 8
- RHSA-2015:1693 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-2723-1 firefox vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-3345-1 iceweasel - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2015:1476-1 Security update for MozillaFirefox, mozilla-nss SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:1504-1 Security update for MozillaFirefox SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10071-1 MozillaFirefox-50.1.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- ELSA-2015-1693 Critical: firefox security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 27, 2015
References
- http://www.mozilla.org/security/announce/2015/mfsa2015-94.html
- DSA-3345 vendor-advisory
- SUSE-SU-2015:2081 vendor-advisory
- USN-2723-1 vendor-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-15-406
- https://bugzilla.mozilla.org/show_bug.cgi?id=1175278
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- SUSE-SU-2015:1504 vendor-advisory
- openSUSE-SU-2015:1492 vendor-advisory
- 76502 vdb-entry
- RHSA-2015:1693 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1164766
- 1033397 vdb-entry