CVE-2015-4495

Katalog CVE

CVSS 8.8 · High KEV · sudah dieksploitasi EPSS 68,6%

Kerentanan Origin Validation Error pada mozilla firefox, mozilla firefox os +13 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD. Masuk katalog KEV CISA pada 25 Mei 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

Rincian

Terbit di NVD

8 Agustus 2015

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-346: Origin Validation Error

EPSS (30 hari)

68,6% peluang dieksploitasi; lebih tinggi dari 99,3% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Mozilla Firefox Security Feature Bypass Vulnerability

Masuk KEV

25 Mei 2022

Tenggat CISA

15 Juni 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.mozilla.org/security/announce/2015/mfsa2015-78.html advisory vendor
• https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/ issue tracking · advisory vendor
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html patch · advisory pihak ketiga
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4495 pemerintah AS
• http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html mailing list · advisory pihak ketiga
• http://rhn.redhat.com/errata/RHSA-2015-1581.html advisory pihak ketiga
• http://www.securityfocus.com/bid/76249 broken link · advisory pihak ketiga · vdb entry
• http://www.securitytracker.com/id/1033216 broken link · advisory pihak ketiga · vdb entry
• http://www.ubuntu.com/usn/USN-2707-1 advisory pihak ketiga
• https://security.gentoo.org/glsa/201512-10 advisory pihak ketiga
• https://www.exploit-db.com/exploits/37772/ exploit · advisory pihak ketiga · vdb entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1178058 issue tracking
• https://bugzilla.mozilla.org/show_bug.cgi?id=1179262 issue tracking