CVE-2015-7183

Publication date 4 November 2015

Last updated 24 July 2024

Ubuntu priority

Description

Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
firefox	17.04 zesty	Fixed in 42.0+build2-0ubuntu1
	16.10 yakkety	Fixed in 42.0+build2-0ubuntu1
	16.04 LTS xenial	Fixed in 42.0+build2-0ubuntu1
	15.10 wily	Fixed in 42.0+build2-0ubuntu0.15.10.1
	15.04 vivid	Fixed in 42.0+build2-0ubuntu0.15.04.1
	14.04 LTS trusty	Fixed in 42.0+build2-0ubuntu0.14.04.1
	12.04 LTS precise	Fixed in 42.0+build2-0ubuntu0.12.04.1
nspr	17.04 zesty	Not affected
	16.10 yakkety	Not affected
	16.04 LTS xenial	Not affected
	15.10 wily	Fixed in 2:4.10.10-0ubuntu0.15.10.1
	15.04 vivid	Fixed in 2:4.10.10-0ubuntu0.15.04.1
	14.04 LTS trusty	Fixed in 2:4.10.10-0ubuntu0.14.04.1
	12.04 LTS precise	Fixed in 4.10.10-0ubuntu0.12.04.1
thunderbird	17.04 zesty	Fixed in 1:38.4.0+build3-0ubuntu1
	16.10 yakkety	Fixed in 1:38.4.0+build3-0ubuntu1
	16.04 LTS xenial	Fixed in 1:38.4.0+build3-0ubuntu1
	15.10 wily	Fixed in 1:38.4.0+build3-0ubuntu0.15.10.1
	15.04 vivid	Fixed in 1:38.4.0+build3-0ubuntu0.15.04.1
	14.04 LTS trusty	Fixed in 1:38.4.0+build3-0ubuntu0.14.04.1
	12.04 LTS precise	Fixed in 1:38.4.0+build3-0ubuntu0.12.04.1
virtualbox	17.04 zesty	Not affected
	16.10 yakkety	Not affected
	16.04 LTS xenial	Not affected
	15.10 wily	Fixed in 5.0.14-dfsg-0ubuntu1.15.10.1
	15.04 vivid	Fixed in 4.3.36-dfsg-1+deb8u1ubuntu1.15.04.1
	14.04 LTS trusty	Fixed in 4.3.36-dfsg-1+deb8u1ubuntu1.14.04.1
	12.04 LTS precise	Ignored end of life

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
nspr	Upstream: http://hg.mozilla.org/projects/nspr/rev/c9c965b2b19c Upstream: http://hg.mozilla.org/projects/nspr/rev/bd8fb4498fa6

References

Related Ubuntu Security Notices (USN)

USN-2785-1
Firefox vulnerabilities
4 November 2015

USN-2819-1
Thunderbird vulnerabilities
1 December 2015

USN-2790-1
NSPR vulnerability
4 November 2015