CVE-2015-4498

Published: Aug 29, 2015Modified: May 6, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

The add-on installation feature in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to bypass an intended user-confirmation requirement by constructing a crafted data: URL and triggering navigation to an arbitrary http: or https: URL at a certain early point in the installation process.

Affected (6)

Products: Mozilla: Firefox

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 40.0.2
Mozilla Firefox	Version 38.0.1
Mozilla Firefox	Version 38.0.5
Mozilla Firefox	Version 38.0
Mozilla Firefox	Version 38.1.0
Mozilla Firefox	Version 38.2.0

Related CWEs

References (22)

http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00013.html

Source: security@mozilla.org

http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html

Source: security@mozilla.org

http://lists.opensuse.org/opensuse-updates/2015-09/msg00000.html

Source: security@mozilla.org

http://rhn.redhat.com/errata/RHSA-2015-1693.html

Source: security@mozilla.org

http://www.debian.org/security/2015/dsa-3345

Source: security@mozilla.org

http://www.mozilla.org/security/announce/2015/mfsa2015-95.html

Source: security@mozilla.org

Vendor Advisory

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: security@mozilla.org

http://www.securityfocus.com/bid/76505

Source: security@mozilla.org

http://www.securitytracker.com/id/1033396

Source: security@mozilla.org

http://www.ubuntu.com/usn/USN-2723-1

Source: security@mozilla.org

https://bugzilla.mozilla.org/show_bug.cgi?id=1042699

Source: security@mozilla.org

http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00013.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2015-09/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2015-1693.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2015/dsa-3345

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mozilla.org/security/announce/2015/mfsa2015-95.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/76505

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1033396

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2723-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.mozilla.org/show_bug.cgi?id=1042699

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.