CVE-2015-0798
Gentoo Linux Security Advisory 201512-10
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The Reader mode feature in Mozilla Firefox before 37.0.1 on Android, and Desktop Firefox pre-release, does not properly handle privileged URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy.
La característica Reader mode en Mozilla Firefox anterior a 37.0.1 en Android, y el prelanzamiento de Desktop Firefox, no maneja correctamente las URLs privilegiadas, lo que facilita a atacantes remotos ejecutar código JavaScript arbitrario con privilegios chrome mediante el aprovechamiento de la habilidad de evadir Same Origin Policy.
Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird, the worst of which may allow user-assisted execution of arbitrary code. Versions less than 38.5.0 are affected.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-01-07 CVE Reserved
- 2015-04-08 CVE Published
- 2024-08-06 CVE Updated
- 2025-02-18 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html | Third Party Advisory |
|
| http://www.securitytracker.com/id/1032029 | Third Party Advisory | |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1147597 | Issue Tracking |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.mozilla.org/security/announce/2015/mfsa2015-43.html | 2016-12-07 | |
| https://security.gentoo.org/glsa/201512-10 | 2016-12-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | <= 37.0 Search vendor "Mozilla" for product "Firefox" and version " <= 37.0" | - |
Affected
| in | Google Search vendor "Google" | Android Search vendor "Google" for product "Android" | * | - |
Safe
|
| Oracle Search vendor "Oracle" | Solaris Search vendor "Oracle" for product "Solaris" | 11.3 Search vendor "Oracle" for product "Solaris" and version "11.3" | - |
Affected
| ||||||