Lucene search

K

[email protected]NVD:CVE-2015-4495

HistoryAug 08, 2015 - 12:59 a.m.

CVE-2015-4495

2015-08-0800:59:04

CWE-200

[email protected]

web.nvd.nist.gov

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.7 Medium

AI Score

Confidence

Low

0.968 High

EPSS

Percentile

99.7%

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

Affected configurations

NVD

Node

mozillafirefoxRange≤39.0

OR

mozillafirefox_esrMatch38.0

OR

mozillafirefox_esrMatch38.0.1

OR

mozillafirefox_esrMatch38.0.5

OR

mozillafirefox_esrMatch38.1.0

Node

mozillafirefox_osRange≤2.1.0

Node

novellsuse_linux_enterprise_software_development_kitMatch12.0

OR

canonicalubuntu_linuxMatch12.04lts

OR

canonicalubuntu_linuxMatch14.04lts

OR

canonicalubuntu_linuxMatch15.04

OR

novellsuse_linux_enterprise_desktopMatch12.0

OR

novellsuse_linux_enterprise_serverMatch12.0

OR

opensuseopensuseMatch13.1

OR

opensuseopensuseMatch13.2

Node

oraclesolarisMatch11.3

References

lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html

lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html

lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html

lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html

lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html

lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html

rhn.redhat.com/errata/RHSA-2015-1581.html

www.mozilla.org/security/announce/2015/mfsa2015-78.html

www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

www.securityfocus.com/bid/76249

www.securitytracker.com/id/1033216

www.ubuntu.com/usn/USN-2707-1

blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/

bugzilla.mozilla.org/show_bug.cgi?id=1178058

bugzilla.mozilla.org/show_bug.cgi?id=1179262

security.gentoo.org/glsa/201512-10

www.exploit-db.com/exploits/37772/

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.7 Medium

AI Score

Confidence

Low

0.968 High

EPSS

Percentile

99.7%