CVE-2015-7178

Vulnerability

The vulnerability resides in the ProgramBinary::linkAttributes function of the ANGLE library's libGLES component, which is used by Mozilla Firefox (before 41.0) and Firefox ESR 38.x (before 38.3) on Windows for rendering OpenGL and WebGL content [1]. A missing bounds check when handling shader attributes leads to memory safety errors, allowing writing to unowned memory [2]. This issue is specific to Windows systems and does not affect Linux or OS X [1].

Exploitation

An attacker can exploit this flaw by delivering crafted OpenGL or WebGL content to a vulnerable Firefox or Thunderbird installation on Windows [1]. The attack requires no special authentication or user interaction beyond normal browsing. In Thunderbird, scripting is disabled by default, making exploitation through email less likely, but it is still a risk in browser or browser-like contexts [1]. The missing bounds check can be triggered during shader attribute linking, leading to a buffer overflow condition [2].

Impact

Successful exploitation can result in memory corruption and a potentially exploitable crash, allowing the attacker to execute arbitrary code or cause a denial of service [1]. The impact is rated critical, and the attacker could gain full control over the affected system.

Mitigation

The vulnerability is fixed in Firefox 41 and Firefox ESR 38.3, released on September 22, 2015 [1]. Users should update to these versions or later. Thunderbird and SeaMonkey users who use the affected Windows builds should also upgrade to the fixed versions (Thunderbird 38.3, SeaMonkey 2.38) [1]. No workarounds are available for unpatched versions.