Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Firefox before 40 may crash or be tampered by web page

CVE-2015-4489 · published 11 years ago
Summary

Versions of Mozilla Firefox earlier than 40, Firefox ESR 38 before 38.2, and Firefox OS before 2.2 contain a coding mistake that lets a malicious website cause the browser to stop working or behave unpredictably. The issue is fixed in the latest releases, so updating the browser removes the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
oracle solaris 11.3
cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*
mozilla firefox <= 39.0.3
38.0
38.0.1
38.0.5
38.1.0
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
mozilla firefox_os <= 2.1.0
cpe:2.3:o:mozilla:firefox_os:*:*:*:*:*:*:*:*
canonical ubuntu_linux 12.04
14.04
15.04
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
opensuse opensuse 13.1
13.2
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
Original advisory text
The nsTArray_Impl class in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory corruption) or poss...
The nsTArray_Impl class in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging a self assignment.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
3% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published16 Aug 2015
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2015-4489 · NVD
Track software like this
Free during beta