Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Firefox OS before 2.2 can crash from crafted buffer size

CVE-2015-5962 · published 11 years ago
Summary

Firefox OS versions earlier than 2.2 have a flaw in the graphics component that can be triggered by sending a negative size value. This can corrupt memory and cause the device to stop working. Upgrade to Firefox OS 2.2 or later to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mozilla firefox_os <= 2.1.0
cpe:2.3:o:mozilla:firefox_os:*:*:*:*:*:*:*:*
Original advisory text
Integer signedness error in the SharedBufferManagerParent::RecvAllocateGrallocBuffer function in the buffer-management implementation in the graphics layer in Mozilla Firefox OS before 2.2 might al...
Integer signedness error in the SharedBufferManagerParent::RecvAllocateGrallocBuffer function in the buffer-management implementation in the graphics layer in Mozilla Firefox OS before 2.2 might allow attackers to cause a denial of service (memory corruption) via a negative value of a size parameter.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-189Numeric Errors
Timeline
Published8 Aug 2015
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2015-5962 · NVD
Track software like this
Free during beta