CVE-2015-4495 | BDVDB-2026-70874 Detail
MozillaFirefox
Description#
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-346 Origin Validation Error
References#
- https://bugzilla.mozilla.org/show_bug.cgi?id=1179262
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html
- http://www.securityfocus.com/bid/76249
- https://www.exploit-db.com/exploits/37772/
- http://rhn.redhat.com/errata/RHSA-2015-1581.html
- https://security.gentoo.org/glsa/201512-10
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html
- http://www.ubuntu.com/usn/USN-2707-1
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1178058
- https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/
- http://www.mozilla.org/security/announce/2015/mfsa2015-78.html
- http://www.securitytracker.com/id/1033216
Exploit#
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.