NetSight
IP …
high8.8Known exploitedPublic exploit code

CVE-2015-4495

Mozilla Firefox Security Feature Bypass Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-05-25. Federal due date: 2022-06-15.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

Affected products

VendorProductAffected versions
MozillaFirefox
before 39.0.3
from 38.0 before 38.1.1
MozillaFirefox Os
before 2.2
OracleSolaris
Version 11.3
CanonicalUbuntu Linux
Versions 12.04, 14.04, 15.04
RedhatEnterprise Linux Desktop
Versions 5.0, 6.0, 7.0
RedhatEnterprise Linux Eus
Versions 6.7, 7.1, 7.2, 7.3, 7.4, 7.5
RedhatEnterprise Linux Server
Versions 5.0, 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 7.3, 7.4, 7.6, 7.7
RedhatEnterprise Linux Server Tus
Versions 7.3, 7.6, 7.7
RedhatEnterprise Linux Workstation
Versions 5.0, 6.0, 7.0
SuseLinux Enterprise Debuginfo
Version 11
OpensuseOpensuse
Versions 13.1, 13.2

Weakness classification

CWE-346

References