Lucene search

[email protected]CVE-2015-4495

HistoryAug 08, 2015 - 12:59 a.m.

CVE-2015-4495

2015-08-0800:59:04

[email protected]

web.nvd.nist.gov

856

In Wild

mozilla firefox

pdf reader

same origin policy

javascript

cve-2015-4495

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

Low

0.89 High

EPSS

Percentile

98.8%

JSON

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

Affected configurations

NVD

Node

mozillafirefoxRange<39.0.3

mozillafirefox_esrRange38.0–38.1.1

Node

mozillafirefox_osRange<2.2

Node

oraclesolarisMatch11.3

Node

canonicalubuntu_linuxMatch12.04-

canonicalubuntu_linuxMatch14.04esm

canonicalubuntu_linuxMatch15.04

Node

redhatenterprise_linux_desktopMatch5.0

redhatenterprise_linux_desktopMatch6.0

redhatenterprise_linux_desktopMatch7.0

redhatenterprise_linux_eusMatch6.7

redhatenterprise_linux_eusMatch7.1

redhatenterprise_linux_eusMatch7.2

redhatenterprise_linux_eusMatch7.3

redhatenterprise_linux_eusMatch7.4

redhatenterprise_linux_eusMatch7.5

redhatenterprise_linux_eusMatch7.6

redhatenterprise_linux_eusMatch7.7

redhatenterprise_linux_serverMatch5.0

redhatenterprise_linux_serverMatch6.0

redhatenterprise_linux_serverMatch7.0

redhatenterprise_linux_server_ausMatch7.3

redhatenterprise_linux_server_ausMatch7.4

redhatenterprise_linux_server_ausMatch7.6

redhatenterprise_linux_server_ausMatch7.7

redhatenterprise_linux_server_tusMatch7.3

redhatenterprise_linux_server_tusMatch7.6

redhatenterprise_linux_server_tusMatch7.7

redhatenterprise_linux_workstationMatch5.0

redhatenterprise_linux_workstationMatch6.0

redhatenterprise_linux_workstationMatch7.0

Node

suselinux_enterprise_debuginfoMatch11sp1

suselinux_enterprise_debuginfoMatch11sp2

suselinux_enterprise_debuginfoMatch11sp3

suselinux_enterprise_debuginfoMatch11sp4

opensuseopensuseMatch13.1

opensuseopensuseMatch13.2

suselinux_enterprise_desktopMatch11sp3

suselinux_enterprise_desktopMatch11sp4

suselinux_enterprise_desktopMatch12-

suselinux_enterprise_serverMatch11sp1ltss

suselinux_enterprise_serverMatch11sp2ltss

suselinux_enterprise_serverMatch11sp3-

suselinux_enterprise_serverMatch11sp3vmware

suselinux_enterprise_serverMatch11sp4

suselinux_enterprise_serverMatch12-

suselinux_enterprise_software_development_kitMatch11sp3

suselinux_enterprise_software_development_kitMatch11sp4

suselinux_enterprise_software_development_kitMatch12-

CPENameOperatorVersion
mozilla:firefoxmozilla firefoxlt39.0.3
mozilla:firefox_esrmozilla firefox esrlt38.1.1

CPE	Name	Operator	Version
mozilla:firefox	mozilla firefox	lt	39.0.3
mozilla:firefox_esr	mozilla firefox esr	lt	38.1.1

References

lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html

lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html

lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html

lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html

lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html

lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html

rhn.redhat.com/errata/RHSA-2015-1581.html

www.mozilla.org/security/announce/2015/mfsa2015-78.html

www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

www.securityfocus.com/bid/76249

www.securitytracker.com/id/1033216

www.ubuntu.com/usn/USN-2707-1

blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/

bugzilla.mozilla.org/show_bug.cgi?id=1178058

bugzilla.mozilla.org/show_bug.cgi?id=1179262

security.gentoo.org/glsa/201512-10

www.exploit-db.com/exploits/37772/

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

Low

0.89 High

EPSS

Percentile

98.8%

JSON

CVE-2015-4495

Affected configurations

References

Related