PT-2015-1966 · Mozilla+5 · Firefox+6
Bas Venis
·
Publicado
2015-08-27
·
Atualizado
2024-12-12
·
CVE-2015-4498
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Mozilla Firefox versions prior to 40.0.3
Firefox ESR versions prior to 38.2.1
Description
The issue is related to the add-on installation feature, which allows remote attackers to bypass the intended user-confirmation requirement. This can be achieved by constructing a crafted data: URL and triggering navigation to an arbitrary http: or https: URL at a certain point in the installation process. The vulnerability is associated with errors in security settings, enabling a remote attacker to bypass the user confirmation procedure for installing updates using specially formed data.
Recommendations
For Mozilla Firefox versions prior to 40.0.3, update to version 40.0.3 or later.
For Firefox ESR versions prior to 38.2.1, update to version 38.2.1 or later.
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Firefox Esr
Firefox
Red Hat
Suse
Ubuntu