PT-2015-1896 · Mozilla+1 · Firefox+2
James Forshaw
·
Published
2015-08-11
·
Updated
2024-12-12
·
CVE-2015-4481
CVSS v2.0
3.3
Low
| Vector | AV:L/AC:M/Au:N/C:N/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Mozilla Firefox versions prior to 40.0
Mozilla Firefox ESR versions prior to 38.2
Description
The issue is caused by a race condition in the Mozilla Maintenance Service, allowing local users to write to arbitrary files and gain privileges. This is achieved through vectors involving a hard link to a log file during an update. The vulnerability is related to synchronization errors when using a shared resource, which can be exploited by a local attacker to manipulate hard links to log files and elevate privileges.
Recommendations
For Mozilla Firefox versions prior to 40.0, update to version 40.0 or later to resolve the issue.
For Mozilla Firefox ESR versions prior to 38.2, update to version 38.2 or later to resolve the issue.
Exploit
Fix
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Firefox
Firefox Esr
Suse