CVE-2015-4495

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

References

http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html

http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html

http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html

http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html

http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html

http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html

http://rhn.redhat.com/errata/RHSA-2015-1581.html

http://www.mozilla.org/security/announce/2015/mfsa2015-78.html

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://www.securityfocus.com/bid/76249

http://www.securitytracker.com/id/1033216

http://www.ubuntu.com/usn/USN-2707-1

https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/

https://bugzilla.mozilla.org/show_bug.cgi?id=1178058

https://bugzilla.mozilla.org/show_bug.cgi?id=1179262

https://security.gentoo.org/glsa/201512-10

https://www.exploit-db.com/exploits/37772/

Details

Source: MITRE

Published: 2015-08-08

Updated: 2018-10-30

Type: CWE-200

Risk Information

CVSS v2

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

Tenable Plugins

View all (20 total)

IDNameProductFamilySeverity
87710GLSA-201512-10 : Mozilla Products: Multiple vulnerabilities (Bar Mitzvah) (Logjam)NessusGentoo Local Security Checks
critical
8878Firefox OS < 2.2 Multiple VulnerabilitiesNessus Network MonitorMobile Devices
critical
85906SUSE SLED11 / SLES11 Security Update : MozillaFirefox, mozilla-nss (SUSE-SU-2015:1528-1)NessusSuSE Local Security Checks
critical
8856Mozilla Firefox < 40.0 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
critical
85763SUSE SLED12 / SLES12 Security Update : MozillaFirefox, mozilla-nss (SUSE-SU-2015:1476-1)NessusSuSE Local Security Checks
critical
85721SUSE SLES11 Security Update : MozillaFirefox, mozilla-nss (SUSE-SU-2015:1449-1) (Logjam)NessusSuSE Local Security Checks
low
85437openSUSE Security Update : MozillaFirefox (openSUSE-2015-548)NessusSuSE Local Security Checks
critical
85436openSUSE Security Update : MozillaFirefox (openSUSE-2015-547)NessusSuSE Local Security Checks
critical
85401SUSE SLED11 / SLES11 Security Update : MozillaFirefox (SUSE-SU-2015:1380-1)NessusSuSE Local Security Checks
medium
85400SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2015:1379-1)NessusSuSE Local Security Checks
medium
85306CentOS 5 / 6 / 7 : firefox (CESA-2015:1581)NessusCentOS Local Security Checks
medium
85297Ubuntu 12.04 LTS / 14.04 LTS / 15.04 : firefox vulnerability (USN-2707-1)NessusUbuntu Local Security Checks
medium
85296Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20150807)NessusScientific Linux Local Security Checks
medium
85295RHEL 5 / 6 / 7 : firefox (RHSA-2015:1581)NessusRed Hat Local Security Checks
medium
85294Oracle Linux 5 / 6 / 7 : firefox (ELSA-2015-1581)NessusOracle Linux Local Security Checks
medium
85293FreeBSD : mozilla -- multiple vulnerabilities (8eee06d4-c21d-4f07-a669-455151ff426f)NessusFreeBSD Local Security Checks
medium
85275Firefox < 39.0.3 PDF Reader Arbitrary File AccessNessusWindows
medium
85274Firefox ESR < 38.1.1 PDF Reader Arbitrary File AccessNessusWindows
medium
85273Firefox < 39.0.3 PDF Reader Arbitrary File Access (Mac OS X)NessusMacOS X Local Security Checks
medium
85272Firefox ESR < 38.1.1 PDF Reader Arbitrary File Access (Mac OS X)NessusMacOS X Local Security Checks
medium