CVE-2015-7221

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

Buffer overflow in the nsDeque::GrowCapacity function in xpcom/glue/nsDeque.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a deque size change.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174253.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-12/msg00104.html
http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.htmlThird Party Advisory
http://www.mozilla.org/security/announce/2015/mfsa2015-144.htmlVendor Advisory
http://www.securityfocus.com/bid/79280
http://www.securitytracker.com/id/1034426
http://www.ubuntu.com/usn/USN-2833-1
https://bugzilla.mozilla.org/show_bug.cgi?id=1199400Issue Tracking
https://hg.mozilla.org/mozilla-central/rev/7fd961937687Issue Tracking, Patch
https://security.gentoo.org/glsa/201512-10
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174253.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-12/msg00104.html
http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.htmlThird Party Advisory
http://www.mozilla.org/security/announce/2015/mfsa2015-144.htmlVendor Advisory
http://www.securityfocus.com/bid/79280
http://www.securitytracker.com/id/1034426
http://www.ubuntu.com/usn/USN-2833-1
https://bugzilla.mozilla.org/show_bug.cgi?id=1199400Issue Tracking
https://hg.mozilla.org/mozilla-central/rev/7fd961937687Issue Tracking, Patch
https://security.gentoo.org/glsa/201512-10

Timeline

Published: Dec 16, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-72226.8Integer underflow in the Metadata::setData function in MetaData.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x be CVE-2015-72234.0The WebExtension APIs in Mozilla Firefox before 43.0 allow remote attackers to gain privileges, and possibly obtain sensitive information or CVE-2015-72249.8puppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by leveraging creation of a database account without a CVE-2015-72255.3Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-tim CVE-2015-72265.0The Administration Views module 7.x-1.x before 7.x-1.5 for Drupal checks access permissions based on the router path from the view instead o CVE-2015-72273.5The Fieldable Panels Panes module 7.x-1.x before 7.x-1.7 for Drupal does not properly check permissions to edit Fieldable Panels Panes entit CVE-2015-72285.0The RESTful module 7.x-1.x before 7.x-1.3 for Drupal does not properly cache pages of authenticated users when using non-cookie authenticati CVE-2015-72293.5The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not properly check access perm CVE-2015-72303.5The Workbench Email module 7.x-3.x before 7.x-3.4 for Drupal allows remote authenticated users with certain permissions to bypass node and f CVE-2015-72315.0The Commerce Commonwealth (CBA) module 7.x-1.x before 7.x-1.5 for Drupal does not properly validate payments, which allows remote attackers CVE-2015-72322.6Cross-site scripting (XSS) vulnerability in unspecified administration pages in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the O CVE-2015-72335.1Cross-site request forgery (CSRF) vulnerability in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Import module is enabled,