CVE-2015-4495

Published: Aug 8, 2015Modified: Apr 22, 2026CISA KEV

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

Affected (49)

Products: Mozilla: Firefox, Firefox Os · Oracle: Solaris · Canonical: Ubuntu Linux · +3 more

Show all products

2 products

1 product

1 product

6 products

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Tus

Enterprise Linux Workstation

Opensuse

1 product

Opensuse

Suse

4 products

Linux Enterprise Debuginfo

Linux Enterprise Desktop

Linux Enterprise Server

Linux Enterprise Software Development Kit

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Before 39.0.3
Mozilla Firefox	From 38.0 to 38.1.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox Os	Before 2.2

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Oracle Solaris	Version 11.3

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.04

Configuration E

24 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 5.0
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Eus	Version 6.7
Redhat Enterprise Linux Eus	Version 7.1
Redhat Enterprise Linux Eus	Version 7.2
Redhat Enterprise Linux Eus	Version 7.3
Redhat Enterprise Linux Eus	Version 7.4
Redhat Enterprise Linux Eus	Version 7.5
Redhat Enterprise Linux Eus	Version 7.6
Redhat Enterprise Linux Eus	Version 7.7
Redhat Enterprise Linux Server	Version 5.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server Aus	Version 7.3
Redhat Enterprise Linux Server Aus	Version 7.4
Redhat Enterprise Linux Server Aus	Version 7.6
Redhat Enterprise Linux Server Aus	Version 7.7
Redhat Enterprise Linux Server Tus	Version 7.3
Redhat Enterprise Linux Server Tus	Version 7.6
Redhat Enterprise Linux Server Tus	Version 7.7
Redhat Enterprise Linux Workstation	Version 5.0
Redhat Enterprise Linux Workstation	Version 6.0
Redhat Enterprise Linux Workstation	Version 7.0

Configuration F

18 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 13.1
Opensuse Opensuse	Version 13.2
Suse Linux Enterprise Debuginfo	Version 11 sp1
Suse Linux Enterprise Debuginfo	Version 11 sp2
Suse Linux Enterprise Debuginfo	Version 11 sp3
Suse Linux Enterprise Debuginfo	Version 11 sp4
Suse Linux Enterprise Desktop	Version 11 sp3
Suse Linux Enterprise Desktop	Version 11 sp4
Suse Linux Enterprise Desktop	Version 12
Suse Linux Enterprise Server	Version 11 sp1
Suse Linux Enterprise Server	Version 11 sp2
Suse Linux Enterprise Server	Version 11 sp3
Suse Linux Enterprise Server	Version 11 sp3
Suse Linux Enterprise Server	Version 11 sp4
Suse Linux Enterprise Server	Version 12
Suse Linux Enterprise Software Development Kit	Version 11 sp3
Suse Linux Enterprise Software Development Kit	Version 11 sp4
Suse Linux Enterprise Software Development Kit	Version 12

Related CWEs

CWE-346

Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

References (35)

http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html

Source: security@mozilla.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html

Source: security@mozilla.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html

Source: security@mozilla.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html

Source: security@mozilla.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html

Source: security@mozilla.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html

Source: security@mozilla.org

Mailing ListThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-1581.html

Source: security@mozilla.org

Third Party Advisory

http://www.mozilla.org/security/announce/2015/mfsa2015-78.html

Source: security@mozilla.org

Vendor Advisory

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: security@mozilla.org

PatchThird Party Advisory

http://www.securityfocus.com/bid/76249

Source: security@mozilla.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1033216

Source: security@mozilla.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2707-1

Source: security@mozilla.org

Third Party Advisory

https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/

Source: security@mozilla.org

Issue TrackingVendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=1178058

Source: security@mozilla.org

Issue Tracking

https://bugzilla.mozilla.org/show_bug.cgi?id=1179262

Source: security@mozilla.org

Issue Tracking

https://security.gentoo.org/glsa/201512-10

Source: security@mozilla.org

Third Party Advisory

https://www.exploit-db.com/exploits/37772/

Source: security@mozilla.org

ExploitThird Party AdvisoryVDB Entry

http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html