Vulnerability in Mozilla Firefox
CVE-2015-4495
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted…
EPSS: 0.702 (99.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Mozilla Firefox
- Mozilla Firefox_os
- Oracle Solaris — versions 11.3
- Canonical Ubuntu_linux — versions 12.04, 14.04, 15.04
- Opensuse — versions 13.1, 13.2
- Redhat Enterprise_linux_desktop — versions 5.0, 6.0, 7.0
- Redhat Enterprise_linux_eus — versions 6.7, 7.1, 7.2
- Redhat Enterprise_linux_server — versions 5.0, 6.0, 7.0
- Redhat Enterprise_linux_server_aus — versions 7.3, 7.4, 7.6
- Redhat Enterprise_linux_server_tus — versions 7.3, 7.6, 7.7
Weakness classification (CWE)
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply updates per vendor instructions.
Public proof-of-concept exploits
References
- security@mozilla.org (x_refsource_CONFIRM, Issue Tracking)
- security@mozilla.org (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
- security@mozilla.org (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
- security@mozilla.org (VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)
- security@mozilla.org (Exploit, VDB Entry, Third Party Advisory, exploit, x_refsource_EXPLOIT-DB)
- security@mozilla.org (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- security@mozilla.org (vendor-advisory, Third Party Advisory, x_refsource_GENTOO)
- security@mozilla.org (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
- security@mozilla.org (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
- security@mozilla.org (x_refsource_CONFIRM, Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2015-4495?
- CVE-2015-4495 is a high-severity vulnerability in Mozilla Firefox, classified under Origin Validation Error. CVSS score: 8.8/10. Published 2015-08-08.
- How severe is CVE-2015-4495?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2015-4495 known to be exploited?
- Yes. CVE-2015-4495 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2022-05-25), indicating it is being actively exploited. 7 public proof-of-concept repositories are indexed.