Veille CVE
CVE-2015-4495
8.8 Élevée Exploitée activementCatalogue CISA KEV — Mozilla Firefox Security Feature Bypass Vulnerability
Ajoutée le 25/05/2022 · Échéance de correction (agences US) : 15/06/2022
Action requise : Apply updates per vendor instructions.
Description
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.
Produits concernés
- Mozilla firefox
- Mozilla firefox os
- Oracle solaris
- Canonical ubuntu linux
- Redhat enterprise linux desktop
- Redhat enterprise linux eus
- Redhat enterprise linux server
- Redhat enterprise linux server aus
- Redhat enterprise linux server tus
- Redhat enterprise linux workstation
- Suse linux enterprise debuginfo
- Opensuse opensuse
- Suse linux enterprise desktop
- Suse linux enterprise server
- Suse linux enterprise software development kit
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 8.8 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | 8.8 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 2.0 | 4.3 Moyenne | nvd@nist.gov (NVD) | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Faiblesses (CWE)
Références
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html Mailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html Mailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html Mailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html Mailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html Mailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html Mailing ListThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1581.html Third Party Advisory
- http://www.mozilla.org/security/announce/2015/mfsa2015-78.html Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html PatchThird Party Advisory
- http://www.securityfocus.com/bid/76249 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1033216 Broken LinkThird Party AdvisoryVDB Entry
- http://www.ubuntu.com/usn/USN-2707-1 Third Party Advisory
- https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/ Issue TrackingVendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1178058 Issue Tracking
- https://bugzilla.mozilla.org/show_bug.cgi?id=1179262 Issue Tracking
- https://security.gentoo.org/glsa/201512-10 Third Party Advisory
- https://www.exploit-db.com/exploits/37772/ ExploitThird Party AdvisoryVDB Entry
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html Mailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html Mailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html Mailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html Mailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html Mailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html Mailing ListThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1581.html Third Party Advisory
- http://www.mozilla.org/security/announce/2015/mfsa2015-78.html Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html PatchThird Party Advisory
- http://www.securityfocus.com/bid/76249 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1033216 Broken LinkThird Party AdvisoryVDB Entry
- http://www.ubuntu.com/usn/USN-2707-1 Third Party Advisory
- https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/ Issue TrackingVendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1178058 Issue Tracking
- https://bugzilla.mozilla.org/show_bug.cgi?id=1179262 Issue Tracking
- https://security.gentoo.org/glsa/201512-10 Third Party Advisory
- https://www.exploit-db.com/exploits/37772/ ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4495 US Government Resource