PT-2015-2175 · Mozilla+3 · Firefox+3
Jeff Walden
+1
·
Published
2015-09-22
·
Updated
2024-12-12
·
CVE-2015-4516
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Mozilla Firefox versions prior to 41.0
Description
The issue allows remote attackers to bypass certain ECMAScript 5 (ES5) API protection mechanisms and modify immutable properties, which can lead to the execution of arbitrary JavaScript code with chrome privileges. This can be achieved through a crafted web page that does not utilize ES5 APIs. The estimated number of potentially affected devices and details about real-world incidents where this issue was exploited are not provided.
Recommendations
For versions prior to 41.0, update to version 41.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ECMAScript 5 API until a patch is applied. Avoid using crafted web pages that do not utilize ES5 APIs to minimize the risk of exploitation.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Firefox
Suse
Ubuntu