CVE-2015-4495

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the...

Basic Information

CVE State: PUBLISHED
Reserved Date: June 10, 2015
Published Date: August 08, 2015
Last Updated: February 07, 2025
Vendor: n/a
Product: n/a
Description: The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

CVSS Scores

CVSS v3.1

8.8 - HIGH

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC Information

Exploitation: active
Technical Impact: total

Exploit Status

Exploited in the Wild: Yes (added 2022-05-25 00:00:00 UTC) Source
Proof of Concept Available: Yes (added 2015-08-10 22:46:46 UTC) Source

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1179262 http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html http://www.securityfocus.com/bid/76249 https://www.exploit-db.com/exploits/37772/ http://rhn.redhat.com/errata/RHSA-2015-1581.html https://security.gentoo.org/glsa/201512-10 http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html http://www.ubuntu.com/usn/USN-2707-1 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html https://bugzilla.mozilla.org/show_bug.cgi?id=1178058 https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/ http://www.mozilla.org/security/announce/2015/mfsa2015-78.html http://www.securitytracker.com/id/1033216 http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html

Known Exploited Vulnerability Information

Source	Added Date
CISA	2022-05-25 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

vincd/CVE-2015-4495

Type: github • Created: 2015-08-10 22:46:46 UTC • Stars: 1

Exploit for CVE-2015-4495 / mfsa2015-78