Every CVE Search/ Get API key

CVE-2015-2716

Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7,...

7.5 HighFix available

Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.

Exploit likelihood

7.23%Down 7.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.

Record
CVE-2015-2716
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.

Record
CVE-2015-2716
Updated
2026-11-02
EUVDEUVD-2015-2806 No score

Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.

Record
EUVD-2015-2806
Updated
2026-11-03
GitHub AdvisoriesGHSA-3pwf-x7h5-r7pj No score

Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7,...

Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.

Record
GHSA-3pwf-x7h5-r7pj
Weakness
CWE-119
Updated
2026-11-02
OSVMGASA-2015-0234 No score

Updated Firefox, Thunderbird & sqlite3 packages fix security vulnerabilities

Updated firefox, thunderbird, and sqlite3 packages fix security vulnerabilities:

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox or Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running it (CVE-2015-2708, CVE-2015-2710, CVE-2015-2713).

A heap-based buffer overflow flaw was found in the way Firefox and Thunderbird processed compressed XML data. An attacker could create specially crafted compressed XML content that, when processed by Firefox or Thunderbird, could cause it to crash or execute arbitrary code with the privileges of the user running it (CVE-2015-2716).

SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE at the end of a SELECT statement (CVE-2015-3414).

The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement (CVE-2015-3415).

The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement (CVE-2015-3416).

The sqlite3 package has been updated to version 3.10.8, fixing the CVE-2015-3414, CVE-2015-3415, and CVE-2015-3416 security issues, also fixing heap overflow and other possible issues found by fuzzing, as well as containing many other bug fixes and enhancements.

The nss package has been updated to version 3.19, containing multiple root certificate updates, security enhancements, and other bug fixes.

Record
MGASA-2015-0234
Updated
2026-11-02
OSVMGASA-2015-0342 No score

Updated iceape packages fix security vulnerabilities

Updated iceape packages fix security issues:

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2015-0814, CVE-2015-0815)

Use-after-free vulnerability in the AppendElements function in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 on Linux, when the Fluendo MP3 plugin for GStreamer is used, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted MP3 file. (CVE-2015-0813)

Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an intended user-confirmation requirement by deploying a crafted web site and conducting a DNS spoofing attack against a mozilla.org subdomain. (CVE-2015-0812)

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js. (CVE-2015-0816)

The QCMS implementation in Mozilla Firefox before 37.0 allows remote attackers to obtain sensitive information from process heap memory or cause a denial of service (out-of-bounds read) via an image that is improperly handled during transformation. (CVE-2015-0811)

The webrtc::VPMContentAnalysis::Release function in the WebRTC implementation in Mozilla Firefox before 37.0 uses incompatible approaches to the deallocation of memory for simple-type arrays, which might allow remote attackers to cause a denial of service (memory corruption) via unspecified vectors. (CVE-2015-0808)

The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site, a similar issue to CVE-2014-8638. (CVE-2015-0807)

The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 makes an incorrect memset call during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors that trigger rendering of 2D graphics content. (CVE-2015-0805)

The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 attempts to use memset for a memory region of negative length during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors that trigger rendering of 2D graphics content. (CVE-2015-0806)

The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does not properly constrain the original data type of a casted value during the setting of a SOURCE element's attributes, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document. (CVE-2015-0803)

The HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does not properly constrain a data type after omitting namespace validation during certain tree-binding operations, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document containing a SOURCE…

Record
MGASA-2015-0342
Updated
2026-11-02
Show 8 moreShow less
OSVopenSUSE-SU-2024:10071-1 No score

MozillaFirefox-50.1.0-1.1 on GA media

These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10071-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10230-1 No score

MozillaThunderbird-45.5.1-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-45.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10230-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02
OSVSUSE-SU-2015:0960-1 No score

Security update for MozillaFirefox

This update to Firefox 31.7.0 ESR (bsc#930622) fixes the following issues:

  • MFSA 2015-46/CVE-2015-2708/CVE-2015-2709 (bmo#1120655, bmo#1143299, bmo#1151139, bmo#1152177, bmo#1111251, bmo#1117977, bmo#1128064, bmo#1135066, bmo#1143194, bmo#1146101, bmo#1149526, bmo#1153688, bmo#1155474) Miscellaneous memory safety hazards (rv:38.0 / rv:31.7)
  • MFSA 2015-47/CVE-2015-0797 (bmo#1080995) Buffer overflow parsing H.264 video with Linux Gstreamer
  • MFSA 2015-48/CVE-2015-2710 (bmo#1149542) Buffer overflow with SVG content and CSS
  • MFSA 2015-51/CVE-2015-2713 (bmo#1153478) Use-after-free during text processing with vertical text enabled
  • MFSA 2015-54/CVE-2015-2716 (bmo#1140537) Buffer overflow when parsing compressed XML
Record
SUSE-SU-2015:0960-1
Updated
2026-11-02
OSVSUSE-SU-2015:0978-1 No score

Security update for MozillaFirefox

This update to Firefox 31.7.0 ESR fixes the following issues:

* 

  MFSA 2015-46 (CVE-2015-2708, CVE-2015-2709): Miscellaneous memory
  safety hazards (rv:38.0 / rv:31.7). Upstream references: bmo#1120655,
  bmo#1143299, bmo#1151139, bmo#1152177, bmo#1111251, bmo#1117977,
  bmo#1128064, bmo#1135066, bmo#1143194, bmo#1146101, bmo#1149526,
  bmo#1153688, bmo#1155474.

* 

  MFSA 2015-47 (CVE-2015-0797): Buffer overflow parsing H.264 video
  with Linux Gstreamer. Upstream references: bmo#1080995.

* 

  MFSA 2015-48 (CVE-2015-2710): Buffer overflow with SVG content and
  CSS. Upstream references: bmo#1149542.

* 

  MFSA 2015-51 (CVE-2015-2713): Use-after-free during text processing
  with vertical text enabled. Upstream references: bmo#1153478.

* 

  MFSA 2015-54 (CVE-2015-2716): Buffer overflow when parsing compressed
  XML. Upstream references: bmo#1140537.

Security Issues:

* CVE-2015-0797
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0797>
* CVE-2015-2708
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2708>
* CVE-2015-2709
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2709>
* CVE-2015-2710
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2710>
* CVE-2015-2713
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2713>
* CVE-2015-2716
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2716>
Record
SUSE-SU-2015:0978-1
Updated
2026-11-02
OSVUBUNTU-CVE-2015-2716 No score

Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.

Record
UBUNTU-CVE-2015-2716
Updated
2026-11-02
OSVUSN-2602-1 No score

firefox vulnerabilities

Jesse Ruderman, Mats Palmgren, Byron Campen, Steve Fink, Gary Kwong, Andrew McCreight, Christian Holler, Jon Coppeard, and Milan Sreckovic discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-2708, CVE-2015-2709)

Atte Kettunen discovered a buffer overflow during the rendering of SVG content with certain CSS properties in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-2710)

Alex Verstak discovered that <meta name="referrer"> is ignored in some circumstances. (CVE-2015-2711)

Dougall Johnson discovered an out of bounds read and write in asm.js. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information, cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-2712)

Scott Bell discovered a use-afer-free during the processing of text when vertical text is enabled. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-2713)

Tyson Smith and Jesse Schwartzentruber discovered a use-after-free during shutdown. An attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-2715)

Ucha Gobejishvili discovered a buffer overflow when parsing compressed XML content. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-2716)

A buffer overflow and out-of-bounds read were discovered when parsing metadata in MP4 files in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-2717)

Mark Hammond discovered that when a trusted page is hosted within an iframe in an untrusted page, the untrusted page can intercept webchannel responses meant for the trusted page in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could exploit this to bypass origin restrictions. (CVE-2015-2718)

Record
USN-2602-1
Updated
2026-11-02
OSVUSN-2603-1 No score

thunderbird vulnerabilities

Jesse Ruderman, Mats Palmgren, Byron Campen, and Steve Fink discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-2708)

Atte Kettunen discovered a buffer overflow during the rendering of SVG content with certain CSS properties in some circumstances. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-2710)

Scott Bell discovered a use-afer-free during the processing of text when vertical text is enabled. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-2713)

Ucha Gobejishvili discovered a buffer overflow when parsing compressed XML content. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-2716)

Record
USN-2603-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
iceweasel
Debian:7
From an advisory covering 6 CVEs
 before 31.7.0esr-1~deb7u1, plus listed versions
10.0.12esr-110.0.12esr-1+alpha10.0.12esr-1+nmu110.0.12esr-1+nmu1+alpha11.0-1
Show 45 moreShow less
11.0-211.0-311.0-411.0~b1-111.0~b1-211.0~b2-111.0~b3-111.0~b4-111.0~b5-111.0~b6-112.0-112.0-212.0-312.0-412.0-512.0-612.0-713.0-113.0.1-113.0.1-214.0.1-114.0.1-215.0-115.0.1-116.0-116.0.1-116.0.2-117.0-117.0.1-117.0.1-217.0.10esr-1~deb7u117.0.5esr-117.0.6esr-117.0.6esr-1~deb7u117.0.7esr-117.0.7esr-1~deb7u117.0.7esr-217.0.8esr-117.0.8esr-1~deb7u117.0.8esr-217.0.8esr-2~deb7u117.0.9esr-1~deb7u118.0-118.0.1-118.0.2-1
31.7.0esr-1~deb7u1
iceweasel
Debian:8
From an advisory covering 6 CVEs
 before 31.7.0esr-1~deb8u1, plus listed versions
31.6.0esr-131.7.0esr-1~deb7u1
31.7.0esr-1~deb8u1
icedove
Debian:7
From an advisory covering 5 CVEs
 before 31.7.0-1~deb7u1, plus listed versions
10.0.12-111.0-116.0.2-117.0-117.0.10-1
Show 45 moreShow less
17.0.10-1+powerpcspe117.0.10-1+powerpcspe217.0.10-1~deb7u117.0.2-117.0.4-117.0.5-117.0.5-217.0.7-117.0.7-1~deb7u117.0.8-117.0.8-1~deb7u117.0.9-117.0.9-1~deb7u117.0.9-224.0-124.0~b3-224.1.1-124.2.0-124.2.0-1+alpha24.2.0-1+powerpcspe124.3.0-124.3.0-224.4.0-124.4.0-1~deb7u124.5.0-124.5.0-1~deb7u124.5.0-224.6.0-1~deb7u124.7.0-1~deb7u124.8.0-1~deb7u124.8.1-1~deb7u130.0~b1-131.0-131.0-231.0-331.0~b1-231.0~b2-131.1.2-131.2.0-131.2.0-1~deb7u131.3.0-131.3.0-1+powerpcspe131.3.0-1~deb7u131.4.0-131.4.0-1~deb7u1
31.7.0-1~deb7u1
icedove
Debian:8
From an advisory covering 5 CVEs
 before 31.7.0-1~deb8u1, plus listed versions
31.6.0-131.7.0-1~deb7u1
31.7.0-1~deb8u1
sqlite3
Mageia:4
From an advisory covering 7 CVEs
 before 3.8.10.1-1.mga4
3.8.10.1-1.mga4
rootcerts
Mageia:4
From an advisory covering 7 CVEs
 before 20150420.00-1.mga4
20150420.00-1.mga4
nss
Mageia:4
From an advisory covering 7 CVEs
 before 3.19.0-1.mga4
3.19.0-1.mga4
firefox
Mageia:4
From an advisory covering 7 CVEs
 before 31.7.0-1.mga4
31.7.0-1.mga4
firefox-l10n
Mageia:4
From an advisory covering 7 CVEs
 before 31.7.0-1.mga4
31.7.0-1.mga4
thunderbird
Mageia:4
From an advisory covering 7 CVEs
 before 31.7.0-1.mga4
31.7.0-1.mga4
Show 72 moreShow less
Affected packages
PackageAffectedFixed
thunderbird-l10n
Mageia:4
From an advisory covering 7 CVEs
 before 31.7.0-1.mga4
31.7.0-1.mga4
iceape
Mageia:4
From an advisory covering 27 CVEs
 before 2.35-1.mga4
2.35-1.mga4
iceape
Mageia:5
From an advisory covering 27 CVEs
 before 2.35-1.mga5
2.35-1.mga5
firefox
Red Hat:enterprise_linux:5::client
From an advisory covering 6 CVEs
 before 0:38.0-4.el5_11
0:38.0-4.el5_11
firefox-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 6 CVEs
 before 0:38.0-4.el5_11
0:38.0-4.el5_11
firefox
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
 before 0:38.0-4.el5_11
0:38.0-4.el5_11
firefox-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
 before 0:38.0-4.el5_11
0:38.0-4.el5_11
firefox
Red Hat:enterprise_linux:6::client
From an advisory covering 6 CVEs
 before 0:38.0-4.el6_6
0:38.0-4.el6_6
firefox-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 6 CVEs
 before 0:38.0-4.el6_6
0:38.0-4.el6_6
firefox
Red Hat:enterprise_linux:6::computenode
From an advisory covering 6 CVEs
 before 0:38.0-4.el6_6
0:38.0-4.el6_6
firefox-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 6 CVEs
 before 0:38.0-4.el6_6
0:38.0-4.el6_6
firefox
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:38.0-4.el6_6
0:38.0-4.el6_6
firefox-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:38.0-4.el6_6
0:38.0-4.el6_6
firefox
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:38.0-4.el6_6
0:38.0-4.el6_6
firefox-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:38.0-4.el6_6
0:38.0-4.el6_6
firefox
Red Hat:enterprise_linux:7::client
From an advisory covering 6 CVEs
 before 0:38.0-3.el7_1
0:38.0-3.el7_1
firefox-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 6 CVEs
 before 0:38.0-3.el7_1
0:38.0-3.el7_1
firefox
Red Hat:enterprise_linux:7::server
From an advisory covering 6 CVEs
 before 0:38.0-3.el7_1
0:38.0-3.el7_1
firefox-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 6 CVEs
 before 0:38.0-3.el7_1
0:38.0-3.el7_1
firefox
Red Hat:enterprise_linux:7::workstation
From an advisory covering 6 CVEs
 before 0:38.0-3.el7_1
0:38.0-3.el7_1
firefox-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 6 CVEs
 before 0:38.0-3.el7_1
0:38.0-3.el7_1
thunderbird
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
 before 0:31.7.0-1.el5_11
0:31.7.0-1.el5_11
thunderbird-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
 before 0:31.7.0-1.el5_11
0:31.7.0-1.el5_11
thunderbird
Red Hat:rhel_productivity:5
From an advisory covering 4 CVEs
 before 0:31.7.0-1.el5_11
0:31.7.0-1.el5_11
thunderbird-debuginfo
Red Hat:rhel_productivity:5
From an advisory covering 4 CVEs
 before 0:31.7.0-1.el5_11
0:31.7.0-1.el5_11
thunderbird
Red Hat:enterprise_linux:6::client
From an advisory covering 4 CVEs
 before 0:31.7.0-1.el6_6
0:31.7.0-1.el6_6
thunderbird-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 4 CVEs
 before 0:31.7.0-1.el6_6
0:31.7.0-1.el6_6
thunderbird
Red Hat:enterprise_linux:6::server
From an advisory covering 4 CVEs
 before 0:31.7.0-1.el6_6
0:31.7.0-1.el6_6
thunderbird-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 4 CVEs
 before 0:31.7.0-1.el6_6
0:31.7.0-1.el6_6
thunderbird
Red Hat:enterprise_linux:6::workstation
From an advisory covering 4 CVEs
 before 0:31.7.0-1.el6_6
0:31.7.0-1.el6_6
thunderbird-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 4 CVEs
 before 0:31.7.0-1.el6_6
0:31.7.0-1.el6_6
thunderbird
Red Hat:enterprise_linux:7::client
From an advisory covering 4 CVEs
 before 0:31.7.0-1.el7_1
0:31.7.0-1.el7_1
thunderbird-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 4 CVEs
 before 0:31.7.0-1.el7_1
0:31.7.0-1.el7_1
thunderbird
Red Hat:enterprise_linux:7::server
From an advisory covering 4 CVEs
 before 0:31.7.0-1.ael7b_1
0:31.7.0-1.ael7b_1
thunderbird-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 4 CVEs
 before 0:31.7.0-1.ael7b_1
0:31.7.0-1.ael7b_1
thunderbird
Red Hat:enterprise_linux:7::workstation
From an advisory covering 4 CVEs
 before 0:31.7.0-1.el7_1
0:31.7.0-1.el7_1
thunderbird-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 4 CVEs
 before 0:31.7.0-1.el7_1
0:31.7.0-1.el7_1
expat
Red Hat:enterprise_linux:7::client
 before 0:2.1.0-11.el7
0:2.1.0-11.el7
expat-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:2.1.0-11.el7
0:2.1.0-11.el7
expat-devel
Red Hat:enterprise_linux:7::client
 before 0:2.1.0-11.el7
0:2.1.0-11.el7
expat-static
Red Hat:enterprise_linux:7::client
 before 0:2.1.0-11.el7
0:2.1.0-11.el7
expat
Red Hat:enterprise_linux:7::computenode
 before 0:2.1.0-11.el7
0:2.1.0-11.el7
expat-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:2.1.0-11.el7
0:2.1.0-11.el7
expat-devel
Red Hat:enterprise_linux:7::computenode
 before 0:2.1.0-11.el7
0:2.1.0-11.el7
expat-static
Red Hat:enterprise_linux:7::computenode
 before 0:2.1.0-11.el7
0:2.1.0-11.el7
expat
Red Hat:enterprise_linux:7::server
 before 0:2.1.0-11.el7
0:2.1.0-11.el7
expat-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:2.1.0-11.el7
0:2.1.0-11.el7
expat-devel
Red Hat:enterprise_linux:7::server
 before 0:2.1.0-11.el7
0:2.1.0-11.el7
expat-static
Red Hat:enterprise_linux:7::server
 before 0:2.1.0-11.el7
0:2.1.0-11.el7
expat
Red Hat:enterprise_linux:7::workstation
 before 0:2.1.0-11.el7
0:2.1.0-11.el7
expat-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:2.1.0-11.el7
0:2.1.0-11.el7
expat-devel
Red Hat:enterprise_linux:7::workstation
 before 0:2.1.0-11.el7
0:2.1.0-11.el7
expat-static
Red Hat:enterprise_linux:7::workstation
 before 0:2.1.0-11.el7
0:2.1.0-11.el7
expat
Red Hat:rhel_eus:7.7::computenode
 before 0:2.1.0-11.el7_7
0:2.1.0-11.el7_7
expat-debuginfo
Red Hat:rhel_eus:7.7::computenode
 before 0:2.1.0-11.el7_7
0:2.1.0-11.el7_7
expat-devel
Red Hat:rhel_eus:7.7::computenode
 before 0:2.1.0-11.el7_7
0:2.1.0-11.el7_7
expat-static
Red Hat:rhel_eus:7.7::computenode
 before 0:2.1.0-11.el7_7
0:2.1.0-11.el7_7
expat
Red Hat:rhel_eus:7.7::server
 before 0:2.1.0-11.el7_7
0:2.1.0-11.el7_7
expat-debuginfo
Red Hat:rhel_eus:7.7::server
 before 0:2.1.0-11.el7_7
0:2.1.0-11.el7_7
expat-devel
Red Hat:rhel_eus:7.7::server
 before 0:2.1.0-11.el7_7
0:2.1.0-11.el7_7
expat-static
Red Hat:rhel_eus:7.7::server
 before 0:2.1.0-11.el7_7
0:2.1.0-11.el7_7
MozillaFirefox
SUSE:Linux Enterprise Desktop 12
From an advisory covering 6 CVEs
 before 31.7.0esr-34.1
31.7.0esr-34.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12
From an advisory covering 6 CVEs
 before 31.7.0esr-34.1
31.7.0esr-34.1
MozillaFirefox
SUSE:Linux Enterprise Server 12
From an advisory covering 6 CVEs
 before 31.7.0esr-34.1
31.7.0esr-34.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 6 CVEs
 before 31.7.0esr-34.1
31.7.0esr-34.1
firefox
Ubuntu:14.04:LTS
 before 38.0+build3-0ubuntu0.14.04.1, plus listed versions
24.0+build1-0ubuntu125.0+build3-0ubuntu0.13.10.128.0~b2+build1-0ubuntu228.0+build1-0ubuntu128.0+build2-0ubuntu1
Show 16 moreShow less
28.0+build2-0ubuntu229.0+build1-0ubuntu0.14.04.230.0+build1-0ubuntu0.14.04.331.0+build1-0ubuntu0.14.04.132.0+build1-0ubuntu0.14.04.132.0.3+build1-0ubuntu0.14.04.133.0+build2-0ubuntu0.14.04.134.0+build2-0ubuntu0.14.04.135.0+build3-0ubuntu0.14.04.235.0.1+build1-0ubuntu0.14.04.136.0+build2-0ubuntu0.14.04.436.0.1+build2-0ubuntu0.14.04.136.0.4+build1-0ubuntu0.14.04.137.0+build2-0ubuntu0.14.04.137.0.1+build1-0ubuntu0.14.04.137.0.2+build1-0ubuntu0.14.04.1
38.0+build3-0ubuntu0.14.04.1
thunderbird
Ubuntu:14.04:LTS
 before 1:31.7.0+build1-0ubuntu0.14.04.1, plus listed versions
1:24.0+build1-0ubuntu11:24.0+build1-0ubuntu21:24.1.1+build1-0ubuntu0.13.10.11:24.1.1+build1-0ubuntu11:24.2.0+build1-0ubuntu1
Show 11 moreShow less
1:24.4.0+build1-0ubuntu11:24.5.0+build1-0ubuntu0.14.04.11:24.6.0+build1-0ubuntu0.14.04.11:31.0+build1-0ubuntu0.14.04.11:31.1.1+build1-0ubuntu0.14.04.11:31.1.2+build1-0ubuntu0.14.04.11:31.2.0+build2-0ubuntu0.14.04.11:31.3.0+build1-0ubuntu0.14.04.11:31.4.0+build1-0ubuntu0.14.04.11:31.5.0+build1-0ubuntu0.14.04.11:31.6.0+build1-0ubuntu0.14.04.1
1:31.7.0+build1-0ubuntu0.14.04.1
firefox
Ubuntu:14.04:LTS
From an advisory covering 10 CVEs
 before 38.0+build3-0ubuntu0.14.04.1, plus listed versions
24.0+build1-0ubuntu125.0+build3-0ubuntu0.13.10.128.0~b2+build1-0ubuntu228.0+build1-0ubuntu128.0+build2-0ubuntu1
Show 16 moreShow less
28.0+build2-0ubuntu229.0+build1-0ubuntu0.14.04.230.0+build1-0ubuntu0.14.04.331.0+build1-0ubuntu0.14.04.132.0+build1-0ubuntu0.14.04.132.0.3+build1-0ubuntu0.14.04.133.0+build2-0ubuntu0.14.04.134.0+build2-0ubuntu0.14.04.135.0+build3-0ubuntu0.14.04.235.0.1+build1-0ubuntu0.14.04.136.0+build2-0ubuntu0.14.04.436.0.1+build2-0ubuntu0.14.04.136.0.4+build1-0ubuntu0.14.04.137.0+build2-0ubuntu0.14.04.137.0.1+build1-0ubuntu0.14.04.137.0.2+build1-0ubuntu0.14.04.1
38.0+build3-0ubuntu0.14.04.1
thunderbird
Ubuntu:14.04:LTS
From an advisory covering 4 CVEs
 before 1:31.7.0+build1-0ubuntu0.14.04.1, plus listed versions
1:24.0+build1-0ubuntu11:24.0+build1-0ubuntu21:24.1.1+build1-0ubuntu0.13.10.11:24.1.1+build1-0ubuntu11:24.2.0+build1-0ubuntu1
Show 11 moreShow less
1:24.4.0+build1-0ubuntu11:24.5.0+build1-0ubuntu0.14.04.11:24.6.0+build1-0ubuntu0.14.04.11:31.0+build1-0ubuntu0.14.04.11:31.1.1+build1-0ubuntu0.14.04.11:31.1.2+build1-0ubuntu0.14.04.11:31.2.0+build2-0ubuntu0.14.04.11:31.3.0+build1-0ubuntu0.14.04.11:31.4.0+build1-0ubuntu0.14.04.11:31.5.0+build1-0ubuntu0.14.04.11:31.6.0+build1-0ubuntu0.14.04.1
1:31.7.0+build1-0ubuntu0.14.04.1
MozillaFirefox
openSUSE:Tumbleweed
From an advisory covering 899 CVEs
 before 50.1.0-1.1
50.1.0-1.1
MozillaThunderbird
openSUSE:Tumbleweed
From an advisory covering 560 CVEs
 before 45.5.1-1.1
45.5.1-1.1
firefox-esr
openSUSE:Tumbleweed
From an advisory covering 1860 CVEs
 before 128.5.1-1.1
128.5.1-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-2716 is a high vulnerability (CVSS 7.5) in Mozilla Firefox, published May 13, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.23%, the 94th percentile. Fixed in expat 0:2.1.0-11.el7.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 78 versions, 1,991 references and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open