8.8Yüksek
Use-after-free in the Audio/Video component
Mozilla Firefox
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45.
8.8Yüksek
KEV
CVE-2015-4495Mozilla Firefox Security Feature Bypass Vulnerability
Aktif olarak istismar ediliyor — Mozilla Firefox Security Feature Bypass Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 25.05.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 15.06.2022.
Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2015-4495
Açıklama
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.
Zayıflık türü (CWE):
CWE-346
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| canonical | ubuntu linux | 12.04 | |
| mozilla | firefox | < 39.0.3 | |
| mozilla | firefox os | < 2.2 | |
| opensuse | opensuse | 13.1 | |
| oracle | solaris | 11.3 | |
| redhat | enterprise linux desktop | 5.0 | |
| redhat | enterprise linux eus | 6.7 | |
| redhat | enterprise linux server | 5.0 | |
| redhat | enterprise linux server aus | 7.3 | |
| redhat | enterprise linux server tus | 7.3 | |
| redhat | enterprise linux workstation | 5.0 | |
| suse | linux enterprise debuginfo | 11 | |
| suse | linux enterprise desktop | 11 | |
| suse | linux enterprise server | 11 | |
| suse | linux enterprise software development kit | 11 |
Kaynaklar ve yamalar
- https://bugzilla.mozilla.org/show_bug.cgi?id=1179262 Issue Tracking
- SUSE-SU-2015:1379 vendor-advisoryMailing ListThird Party Advisory
- SUSE-SU-2015:1380 vendor-advisoryMailing ListThird Party Advisory
- 76249 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 37772 exploitExploitThird Party AdvisoryVDB Entry
- RHSA-2015:1581 vendor-advisoryThird Party Advisory
- GLSA-201512-10 vendor-advisoryThird Party Advisory
- openSUSE-SU-2015:1389 vendor-advisoryMailing ListThird Party Advisory
- USN-2707-1 vendor-advisoryThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html PatchThird Party Advisory
- SUSE-SU-2015:1528 vendor-advisoryMailing ListThird Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1178058 Issue Tracking
- https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/ Issue TrackingVendor Advisory
- http://www.mozilla.org/security/announce/2015/mfsa2015-78.html Vendor Advisory
- 1033216 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- SUSE-SU-2015:1449 vendor-advisoryMailing ListThird Party Advisory
- openSUSE-SU-2015:1390 vendor-advisoryMailing ListThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4495 US Government Resource
CPE eşleşmeleri (NVD) (49)
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*< 39.0.3cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*≥ 38.0 < 38.1.1cpe:2.3:o:mozilla:firefox_os:*:*:*:*:*:*:*:*< 2.2cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:7.1:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp1:*:*:*:*:*:*cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp2:*:*:*:*:*:*cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3:*:*:*:*:*:*cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:ltss:*:*:*cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:*cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-:*:*:*:*:*:*