PT-2015-1040 · Mozilla+5 · Firefox+8
Marius Mlynski
·
Publicado
2015-03-31
·
Atualizado
2024-12-12
·
CVE-2015-0816
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Mozilla Firefox versions prior to 37.0
Firefox ESR versions 31.x prior to 31.6
Thunderbird versions prior to 31.6
Description
The issue is related to the incorrect restriction of resource: URLs, allowing a remote attacker to execute arbitrary JavaScript code with chrome privileges by bypassing the Same Origin Policy. This can be achieved through a resource: URL associated with PDF.js. The estimated number of potentially affected devices is not specified.
Recommendations
For Mozilla Firefox versions prior to 37.0, update to version 37.0 or later.
For Firefox ESR versions 31.x prior to 31.6, update to version 31.6 or later.
For Thunderbird versions prior to 31.6, update to version 31.6 or later.
As a temporary workaround, consider restricting access to the
resource: URL associated with PDF.js to minimize the risk of exploitation.Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Firefox Esr
Firefox
Pdf.Js
Red Hat
Suse
Thunderbird
Ubuntu