← CVE Radar
CVE-2015-4495Mozilla Firefox Security Feature Bypass Vulnerability
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.
8.8 HIGHEPSS 68.55%⚡ Known Exploited (CISA KEV)NVD: Published
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.8 | HIGH | 3.1CISA-ADP | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2015-4495
- Status
- Published
- Assigner (CNA)
- mozilla
- Published
- Aug 8, 2015
- Last modified
- 2025-10-21 23:55 UTC
- Weaknesses
Affected Products
No affected products have been published for this CVE yet.
References
- bugzilla.mozilla.org https://bugzilla.mozilla.org/show_bug.cgi?id=1179262
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html
- securityfocus.com http://www.securityfocus.com/bid/76249
- exploit-db.com https://www.exploit-db.com/exploits/37772/
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1581.html
- security.gentoo.org https://security.gentoo.org/glsa/201512-10
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html
- ubuntu.com http://www.ubuntu.com/usn/USN-2707-1
- oracle.com http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html
- bugzilla.mozilla.org https://bugzilla.mozilla.org/show_bug.cgi?id=1178058
- blog.mozilla.org https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/
- mozilla.org http://www.mozilla.org/security/announce/2015/mfsa2015-78.html
- securitytracker.com http://www.securitytracker.com/id/1033216
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html
Sources
- NVD (unavailable at last refresh)
- CVE.org
- CISA KEV
- FIRST EPSS