CVE-2015-2713: Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute…

Unscored severity · published May 14, 2015

CVE-2015-2713

Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute…

–

CVSS

3.7%

EPSS

On KEV

Description

Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a document containing crafted text in conjunction with a Cascading Style Sheets (CSS) token sequence containing properties related to vertical text.

Exploitation

Is it being used?

Exploit prediction (EPSS)3.7% · higher than 90% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Firefox · Mozilla

through 37.0.2; 31.0; 31.1.0; 31.1.1; 31.3.0; 31.5.1; +2 more · source: NVD

Firefox Esr · Mozilla

31.1; 31.2; 31.3; 31.4; 31.5; 31.6.0 · source: NVD