CVE-2015-7200
HighSummary
The CryptoKey interface implementation in Mozilla Firefox before version 42.0 and Firefox ESR 38.x before version 38.4 lacks status checking, which may allow attackers to have an unspecified impact via vectors related to a cryptographic key.
Risk Assessment
The lack of proper status checking for cryptographic keys may lead to unauthorized access or data manipulation, posing a serious security threat to the organization.
Recommendation
It is recommended to update Mozilla Firefox to the latest version to mitigate this vulnerability and ensure proper cryptographic security.
Other vulnerabilities in Mozilla Firefox, Firefox ESR
See all- CVE-2016-5258High
A use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session.
- CVE-2016-2838High
A heap-based buffer overflow in the nsBidi::BracketData::AddOpening function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via directional content in an SVG document.
- CVE-2016-2836High
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.
- CVE-2016-2821High
A use-after-free vulnerability in the mozilla::dom::Element class in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2, when contenteditable mode is enabled, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by triggering deletion of DOM elements that were created in the editor.
- CVE-2016-2818High
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.
- CVE-2016-2808High
The watch implementation in the JavaScript engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site.
- CVE-2016-2807High
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 may allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code.
- CVE-2016-2806High
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0 and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- CVE-2016-1966High
The nsNPObjWrapper::GetNewOrUsed function in Mozilla Firefox before version 45.0 and Firefox ESR 38.x before version 38.7 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted NPAPI plugin.
- CVE-2016-1964High
A use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging mishandling of XML transformations.
Original NVD description (English source)
The CryptoKey interface implementation in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lacks status checking, which allows attackers to have an unspecified impact via vectors related to a cryptographic key.