Ohne Score
Frame poisoning in the Layout component
Mozilla Firefox
Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44.
8.8Hoch
KEV
CVE-2015-4495Mozilla Firefox Security Feature Bypass Vulnerability
Bekannt ausgenutzt — Mozilla Firefox Security Feature Bypass Vulnerability
CISA hat am 25.05.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 15.06.2022.
Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2015-4495
Beschreibung
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.
Schwachstellentyp (CWE):
CWE-346
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| canonical | ubuntu linux | 12.04 | |
| mozilla | firefox | < 39.0.3 | |
| mozilla | firefox os | < 2.2 | |
| opensuse | opensuse | 13.1 | |
| oracle | solaris | 11.3 | |
| redhat | enterprise linux desktop | 5.0 | |
| redhat | enterprise linux eus | 6.7 | |
| redhat | enterprise linux server | 5.0 | |
| redhat | enterprise linux server aus | 7.3 | |
| redhat | enterprise linux server tus | 7.3 | |
| redhat | enterprise linux workstation | 5.0 | |
| suse | linux enterprise debuginfo | 11 | |
| suse | linux enterprise desktop | 11 | |
| suse | linux enterprise server | 11 | |
| suse | linux enterprise software development kit | 11 |
Referenzen und Patches
- https://bugzilla.mozilla.org/show_bug.cgi?id=1179262 Issue Tracking
- SUSE-SU-2015:1379 vendor-advisoryMailing ListThird Party Advisory
- SUSE-SU-2015:1380 vendor-advisoryMailing ListThird Party Advisory
- 76249 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 37772 exploitExploitThird Party AdvisoryVDB Entry
- RHSA-2015:1581 vendor-advisoryThird Party Advisory
- GLSA-201512-10 vendor-advisoryThird Party Advisory
- openSUSE-SU-2015:1389 vendor-advisoryMailing ListThird Party Advisory
- USN-2707-1 vendor-advisoryThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html PatchThird Party Advisory
- SUSE-SU-2015:1528 vendor-advisoryMailing ListThird Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1178058 Issue Tracking
- https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/ Issue TrackingVendor Advisory
- http://www.mozilla.org/security/announce/2015/mfsa2015-78.html Vendor Advisory
- 1033216 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- SUSE-SU-2015:1449 vendor-advisoryMailing ListThird Party Advisory
- openSUSE-SU-2015:1390 vendor-advisoryMailing ListThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4495 US Government Resource
CPE-Treffer (NVD) (49)
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*< 39.0.3cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*≥ 38.0 < 38.1.1cpe:2.3:o:mozilla:firefox_os:*:*:*:*:*:*:*:*< 2.2cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:7.1:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp1:*:*:*:*:*:*cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp2:*:*:*:*:*:*cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3:*:*:*:*:*:*cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:ltss:*:*:*cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:*cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-:*:*:*:*:*:*