Mozilla · Firefox
CVE-2015-4495
Mozilla Firefox Security Feature Bypass Vulnerability
What it is
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.
CISA: Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: June 15, 2022
- Added to the CISA list
- May 25, 2022
- Published
- August 8, 2015
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 69% in the top 0.7% of all known vulnerabilities
- Weakness
- CWE-200
- More details
- NVD · CVE.org · CISA
All references (17)
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html
- http://rhn.redhat.com/errata/RHSA-2015-1581.html
- https://security.gentoo.org/glsa/201512-10
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html
- http://www.ubuntu.com/usn/USN-2707-1
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1179262
- http://www.securityfocus.com/bid/76249
- https://www.exploit-db.com/exploits/37772/
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1178058
- https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/
- http://www.mozilla.org/security/announce/2015/mfsa2015-78.html
- http://www.securitytracker.com/id/1033216
More exploited flaws from Mozilla
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 15, 2024 | Use-After-Free | Firefox | Critical 9.8 | 23% |
| Mar 7, 2022 | Use-After-Free | Firefox | High 8.8 | 14% |
| Mar 7, 2022 | Use-After-Free | Firefox | Critical 9.6 | 2.4% |
| Mar 3, 2022 | Information Disclosure | Firefox | Medium 6.5 | 6.7% |
| Oct 6, 2025 | Remote Code Execution | Multiple Products | Critical 9.8 | 83% |
| Jun 22, 2023 | Use-After-Free | Firefox, Firefox ESR, and Thunderbird | High 7.5 | 87% |
| May 23, 2022 | Type Confusion | Firefox and Thunderbird | High 8.8 | 38% |
| May 23, 2022 | Sandbox Escape | Firefox and Thunderbird | Critical 10.0 | 56% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.