CVE catalog

CVE-2015-4497

Security update for MozillaFirefox

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
8.01% · Oct 25, 2026

Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute arbitrary code by leveraging improper interaction between resize events and changes to Cascading Style Sheets (CSS) token sequences for a CANVAS element.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntufirefox14.0424.0+build1-0ubuntu1vulnerable
Ubuntufirefox14.0425.0+build3-0ubuntu0.13.10.1vulnerable
Ubuntufirefox14.0428.0~b2+build1-0ubuntu2vulnerable
Ubuntufirefox14.0428.0+build1-0ubuntu1vulnerable
Ubuntufirefox14.0428.0+build2-0ubuntu1vulnerable
Ubuntufirefox14.0428.0+build2-0ubuntu2vulnerable
Ubuntufirefox14.0429.0+build1-0ubuntu0.14.04.2vulnerable
Ubuntufirefox14.0430.0+build1-0ubuntu0.14.04.3vulnerable
Ubuntufirefox14.0431.0+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0432.0+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0432.0.3+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0433.0+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0434.0+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0435.0+build3-0ubuntu0.14.04.2vulnerable
Ubuntufirefox14.0435.0.1+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0436.0+build2-0ubuntu0.14.04.4vulnerable
Ubuntufirefox14.0436.0.1+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0436.0.4+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0437.0+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0437.0.1+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0437.0.2+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0438.0+build3-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0439.0+build5-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0439.0.3+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0440.0+build4-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0440.0+build4-0ubuntu0.14.04.4vulnerable
Ubuntufirefox14.0440.0.3+build1-0ubuntu0.14.04.1fixed
Ubuntufirefox14.0424.0+build1-0ubuntu1vulnerable
Ubuntufirefox14.0425.0+build3-0ubuntu0.13.10.1vulnerable
Ubuntufirefox14.0428.0~b2+build1-0ubuntu2vulnerable
Ubuntufirefox14.0428.0+build1-0ubuntu1vulnerable
Ubuntufirefox14.0428.0+build2-0ubuntu1vulnerable
Ubuntufirefox14.0428.0+build2-0ubuntu2vulnerable
Ubuntufirefox14.0429.0+build1-0ubuntu0.14.04.2vulnerable
Ubuntufirefox14.0430.0+build1-0ubuntu0.14.04.3vulnerable
Ubuntufirefox14.0431.0+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0432.0+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0432.0.3+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0433.0+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0434.0+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0435.0+build3-0ubuntu0.14.04.2vulnerable
Ubuntufirefox14.0435.0.1+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0436.0+build2-0ubuntu0.14.04.4vulnerable
Ubuntufirefox14.0436.0.1+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0436.0.4+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0437.0+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0437.0.1+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0437.0.2+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0438.0+build3-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0439.0+build5-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0439.0.3+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0440.0+build4-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0440.0+build4-0ubuntu0.14.04.4vulnerable
Ubuntufirefox14.0440.0.3+build1-0ubuntu0.14.04.1fixed
Debianiceweasel710.0.12esr-1vulnerable
Debianiceweasel710.0.12esr-1+alphavulnerable
Debianiceweasel710.0.12esr-1+nmu1vulnerable
Debianiceweasel710.0.12esr-1+nmu1+alphavulnerable
Debianiceweasel711.0-1vulnerable
Debianiceweasel711.0-2vulnerable
Debianiceweasel711.0-3vulnerable
Debianiceweasel711.0-4vulnerable
Debianiceweasel711.0~b1-1vulnerable
Debianiceweasel711.0~b1-2vulnerable
Debianiceweasel711.0~b2-1vulnerable
Debianiceweasel711.0~b3-1vulnerable
Debianiceweasel711.0~b4-1vulnerable
Debianiceweasel711.0~b5-1vulnerable
Debianiceweasel711.0~b6-1vulnerable
Debianiceweasel712.0-1vulnerable
Debianiceweasel712.0-2vulnerable
Debianiceweasel712.0-3vulnerable
Debianiceweasel712.0-4vulnerable
Debianiceweasel712.0-5vulnerable
Debianiceweasel712.0-6vulnerable
Debianiceweasel712.0-7vulnerable
Debianiceweasel713.0-1vulnerable
Debianiceweasel713.0.1-1vulnerable
Debianiceweasel713.0.1-2vulnerable
Debianiceweasel714.0.1-1vulnerable
Debianiceweasel714.0.1-2vulnerable
Debianiceweasel715.0-1vulnerable
Debianiceweasel715.0.1-1vulnerable
Debianiceweasel716.0-1vulnerable
Debianiceweasel716.0.1-1vulnerable
Debianiceweasel716.0.2-1vulnerable
Debianiceweasel717.0-1vulnerable
Debianiceweasel717.0.1-1vulnerable
Debianiceweasel717.0.1-2vulnerable
Debianiceweasel717.0.10esr-1~deb7u1vulnerable
Debianiceweasel717.0.5esr-1vulnerable
Debianiceweasel717.0.6esr-1vulnerable
Debianiceweasel717.0.6esr-1~deb7u1vulnerable
Debianiceweasel717.0.7esr-1vulnerable
Debianiceweasel717.0.7esr-1~deb7u1vulnerable
Debianiceweasel717.0.7esr-2vulnerable
Debianiceweasel717.0.8esr-1vulnerable
Debianiceweasel717.0.8esr-1~deb7u1vulnerable
Debianiceweasel717.0.8esr-2vulnerable
Debianiceweasel717.0.8esr-2~deb7u1vulnerable
Debianiceweasel717.0.9esr-1~deb7u1vulnerable
Debianiceweasel718.0-1vulnerable
Debianiceweasel718.0.1-1vulnerable
Debianiceweasel718.0.2-1vulnerable
Debianiceweasel719.0-1vulnerable
Debianiceweasel719.0.2-1vulnerable
Debianiceweasel720.0-1vulnerable
Debianiceweasel721.0-1vulnerable
Debianiceweasel722.0-1vulnerable
Debianiceweasel723.0-1vulnerable
Debianiceweasel723.0-2vulnerable
Debianiceweasel723.0.1-1vulnerable
Debianiceweasel724.0-1vulnerable
Debianiceweasel724.0-2vulnerable
Debianiceweasel724.0~b4-1vulnerable
Debianiceweasel724.0~b7-1vulnerable
Debianiceweasel724.0~b9-1vulnerable
Debianiceweasel724.1.0esr-1vulnerable
Debianiceweasel724.1.0esr-1+powerpcspe1vulnerable
Debianiceweasel724.2.0esr-1vulnerable
Debianiceweasel724.2.0esr-1+alphavulnerable
Debianiceweasel724.2.0esr-1+powerpcspe1vulnerable
Debianiceweasel724.3.0esr-1vulnerable
Debianiceweasel724.3.0esr-1+alphavulnerable
Debianiceweasel724.3.0esr-1~deb7u1vulnerable
Debianiceweasel724.4.0esr-1vulnerable
Debianiceweasel724.4.0esr-1~deb7u2vulnerable
Debianiceweasel724.5.0esr-1vulnerable
Debianiceweasel724.5.0esr-1~deb7u1vulnerable
Debianiceweasel724.6.0esr-1~deb7u1vulnerable
Debianiceweasel724.7.0esr-1~deb7u1vulnerable
Debianiceweasel724.8.0esr-1~deb7u1vulnerable
Debianiceweasel724.8.1esr-1~deb7u1vulnerable
Debianiceweasel725.0-1vulnerable
Debianiceweasel725.0~b3-1vulnerable
Debianiceweasel725.0~b9-1vulnerable
Debianiceweasel726.0-1vulnerable
Debianiceweasel727.0-1vulnerable
Debianiceweasel727.0-2vulnerable
Debianiceweasel727.0.1-1vulnerable
Debianiceweasel728.0-1vulnerable
Debianiceweasel729.0-1vulnerable
Debianiceweasel729.0-2vulnerable
Debianiceweasel729.0.1-1vulnerable
Debianiceweasel729.0.1-1+alphavulnerable
Debianiceweasel729.0.1-2vulnerable
Debianiceweasel730.0-1vulnerable
Debianiceweasel730.0-2vulnerable
Debianiceweasel730.0~b3-1vulnerable
Debianiceweasel730.0~b5-1vulnerable
Debianiceweasel730.0~b5-2vulnerable
Debianiceweasel730.0~b5-3vulnerable
Debianiceweasel730.0~b7-1vulnerable
Debianiceweasel731.0-1vulnerable
Debianiceweasel731.0-2vulnerable
Debianiceweasel731.0-3vulnerable
Debianiceweasel731.0~b1-1vulnerable
Debianiceweasel731.0~b3-1vulnerable
Debianiceweasel731.1.0esr-1vulnerable
Debianiceweasel731.2.0esr-1vulnerable
Debianiceweasel731.2.0esr-1~deb7u1vulnerable
Debianiceweasel731.2.0esr-2vulnerable
Debianiceweasel731.2.0esr-2+hurd.0vulnerable
Debianiceweasel731.2.0esr-2~deb7u1vulnerable
Debianiceweasel731.2.0esr-3vulnerable
Debianiceweasel731.2.0esr-3~deb7u1vulnerable
Debianiceweasel731.3.0esr-1vulnerable
Debianiceweasel731.3.0esr-1+powerpcspe1vulnerable
Debianiceweasel731.3.0esr-1~deb7u1vulnerable
Debianiceweasel731.4.0esr-1vulnerable
Debianiceweasel731.4.0esr-1~deb7u1vulnerable
Debianiceweasel731.5.0esr-1vulnerable
Debianiceweasel731.5.0esr-1~deb7u1vulnerable
Debianiceweasel731.5.3esr-1vulnerable
Debianiceweasel731.5.3esr-1~deb7u1vulnerable
Debianiceweasel731.6.0esr-1vulnerable
Debianiceweasel731.6.0esr-1~deb7u1vulnerable
Debianiceweasel731.7.0esr-1~deb7u1vulnerable
Debianiceweasel731.7.0esr-1~deb8u1vulnerable
Debianiceweasel731.8.0esr-1~deb7u1vulnerable
Debianiceweasel731.8.0esr-1~deb8u1vulnerable
Debianiceweasel732.0-1vulnerable
Debianiceweasel732.0.3-1vulnerable
Debianiceweasel732.0~b1-1vulnerable
Debianiceweasel732.0~b3-1vulnerable
Debianiceweasel732.0~b5-1vulnerable
Debianiceweasel733.0-1vulnerable
Debianiceweasel733.0-2vulnerable
Debianiceweasel733.1-1vulnerable
Debianiceweasel734.0-1vulnerable
Debianiceweasel735.0-1vulnerable
Debianiceweasel735.0.1-1vulnerable
Debianiceweasel736.0-1vulnerable
Debianiceweasel736.0-2vulnerable
Debianiceweasel736.0.1-1vulnerable
Debianiceweasel736.0.1-2vulnerable
Debianiceweasel736.0.4-1vulnerable
Debianiceweasel737.0-1vulnerable
Debianiceweasel737.0.1-1vulnerable
Debianiceweasel737.0.2-1vulnerable
Debianiceweasel738.0-1vulnerable
Debianiceweasel738.0-2vulnerable
Debianiceweasel738.0.1-1vulnerable
Debianiceweasel738.0.1-2vulnerable
Debianiceweasel738.0.1-3vulnerable
Debianiceweasel738.0.1-4vulnerable
Debianiceweasel738.0.1-5vulnerable
Debianiceweasel738.1.0esr-1vulnerable
Debianiceweasel738.1.0esr-2vulnerable
Debianiceweasel738.1.0esr-3vulnerable
Debianiceweasel738.1.1esr-1vulnerable
Debianiceweasel738.1.1esr-1~deb9u1vulnerable
Debianiceweasel738.2.0esr-1vulnerable
Debianiceweasel738.2.0esr-1~deb7u1vulnerable
Debianiceweasel738.2.0esr-1~deb8u1vulnerable
Debianiceweasel738.2.0esr-1~stretchvulnerable
Debianiceweasel738.2.1esr-1~deb7u1fixed
Debianiceweasel831.6.0esr-1vulnerable
Debianiceweasel831.7.0esr-1~deb7u1vulnerable
Debianiceweasel831.7.0esr-1~deb8u1vulnerable
Debianiceweasel831.8.0esr-1~deb7u1vulnerable
Debianiceweasel831.8.0esr-1~deb8u1vulnerable
Debianiceweasel832.0-1vulnerable
Debianiceweasel832.0.3-1vulnerable
Debianiceweasel832.0~b1-1vulnerable
Debianiceweasel832.0~b3-1vulnerable
Debianiceweasel832.0~b5-1vulnerable
Debianiceweasel833.0-1vulnerable
Debianiceweasel833.0-2vulnerable
Debianiceweasel833.1-1vulnerable
Debianiceweasel834.0-1vulnerable
Debianiceweasel835.0-1vulnerable
Debianiceweasel835.0.1-1vulnerable
Debianiceweasel836.0-1vulnerable
Debianiceweasel836.0-2vulnerable
Debianiceweasel836.0.1-1vulnerable
Debianiceweasel836.0.1-2vulnerable
Debianiceweasel836.0.4-1vulnerable
Debianiceweasel837.0-1vulnerable
Debianiceweasel837.0.1-1vulnerable
Debianiceweasel837.0.2-1vulnerable
Debianiceweasel838.0-1vulnerable
Debianiceweasel838.0-2vulnerable
Debianiceweasel838.0.1-1vulnerable
Debianiceweasel838.0.1-2vulnerable
Debianiceweasel838.0.1-3vulnerable
Debianiceweasel838.0.1-4vulnerable
Debianiceweasel838.0.1-5vulnerable
Debianiceweasel838.1.0esr-1vulnerable
Debianiceweasel838.1.0esr-2vulnerable
Debianiceweasel838.1.0esr-3vulnerable
Debianiceweasel838.1.1esr-1vulnerable
Debianiceweasel838.1.1esr-1~deb9u1vulnerable
Debianiceweasel838.2.0esr-1vulnerable
Debianiceweasel838.2.0esr-1~deb7u1vulnerable
Debianiceweasel838.2.0esr-1~deb8u1vulnerable
Debianiceweasel838.2.0esr-1~stretchvulnerable
Debianiceweasel838.2.1esr-1~deb7u1vulnerable
Debianiceweasel838.2.1esr-1~deb8u1fixed
SuseMozillaFirefoxlinux enterprise server 11 sp1-ltss38.2.1esr-17.1fixed
SuseMozillaFirefoxlinux enterprise server 11 sp1-teradata38.2.1esr-17.1fixed
SuseMozillaFirefoxlinux enterprise server 11 sp2-ltss38.2.1esr-17.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Ubuntufirefoxdeb14.0440.0.3+build1-0ubuntu0.14.04.1Not reportedUBUNTU-CVE-2015-4497Not reported
Ubuntufirefoxdeb14.0440.0.3+build1-0ubuntu0.14.04.1Not reportedUSN-2723-1Not reported
Debianiceweaseldeb738.2.1esr-1~deb7u1Not reportedDSA-3345-1Not reported
Debianiceweaseldeb838.2.1esr-1~deb8u1Not reportedDSA-3345-1Not reported
SuseMozillaFirefoxrpmlinux enterprise server 11 sp1-ltss38.2.1esr-17.1Not reportedSUSE-SU-2015:1504-1Not reported
SuseMozillaFirefoxrpmlinux enterprise server 11 sp1-teradata38.2.1esr-17.1Not reportedSUSE-SU-2015:1504-1Not reported
SuseMozillaFirefoxrpmlinux enterprise server 11 sp2-ltss38.2.1esr-17.1Not reportedSUSE-SU-2015:1504-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References