VULNERABILITY INTELLIGENCE
CVE-2015-4495
CVSS score8.8 HIGH
EPSS probability68.56%
CISA KEVKnown exploited vulnerability
Published2015-08-08
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Known Exploited Vulnerability
Mozilla Firefox Security Feature Bypass Vulnerability
Vendor / product: Mozilla / Firefox
Description
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.
Weakness classification
- CWE-346: Origin Validation Error
Primary references
- security@mozilla.org — Mailing List, Third Party Advisory
- security@mozilla.org — Mailing List, Third Party Advisory
- security@mozilla.org — Mailing List, Third Party Advisory
- security@mozilla.org — Mailing List, Third Party Advisory
- security@mozilla.org — Mailing List, Third Party Advisory
- security@mozilla.org — Mailing List, Third Party Advisory
- security@mozilla.org — Third Party Advisory
- security@mozilla.org — Vendor Advisory
- security@mozilla.org — Patch, Third Party Advisory
- security@mozilla.org — Broken Link, Third Party Advisory, VDB Entry
- security@mozilla.org — Broken Link, Third Party Advisory, VDB Entry
- security@mozilla.org — Third Party Advisory