PT-2015-4887 · Mozilla+5 · Firefox+7

Mariusz Mlynski

·

Publicado

2015-03-20

·

Atualizado

2024-12-12

·

CVE-2015-0818

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 36.0.4 Firefox ESR versions prior to 31.5.3 SeaMonkey versions prior to 2.33.1
Description The issue allows remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving SVG hash navigation.
Recommendations For Mozilla Firefox versions prior to 36.0.4, update to version 36.0.4 or later. For Firefox ESR versions prior to 31.5.3, update to version 31.5.3 or later. For SeaMonkey versions prior to 2.33.1, update to version 2.33.1 or later.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2015-1301
ALT-PU-2015-1321
ALT-PU-2015-1464
CESA-2015_0718
CVE-2015-0818
DSA-3201-1
MGASA-2015-0115
MGASA-2015-0126
OPENSUSE-SU-2015_0607-1
OPENSUSE-SU-2015_0636-1
OPENSUSE-SU-2024:10071-1
OPENSUSE-SU-2024:14572-1
RHSA-2015:0718
RHSA-2015_0718
SUSE-SU-2015:0630-1
USN-2538-1
ZDI-15-108

Produtos afetados

Alt Linux
Centos
Firefox Esr
Firefox
Red Hat
Seamonkey
Suse
Ubuntu