PT-2015-2626 · Mozilla+3 · Firefox+3

Jason Hamilton

+3

·

Published

2015-11-03

·

Updated

2024-12-12

·

CVE-2015-7187

CVSS v2.0

4.3

Medium

VectorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 42.0
Description The issue is related to errors in security settings within the Add-on SDK of Mozilla Firefox. It allows a remote attacker to conduct cross-site scripting (XSS) attacks using specially crafted JavaScript code. The vulnerability arises from the misinterpretation of a "script: false" panel setting, making it easier for attackers to execute inline JavaScript code within third-party extensions.
Recommendations For versions prior to 42.0, update to version 42.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of third-party extensions until the update is applied.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-254

Related Identifiers

ALT-PU-2015-1974
ALT-PU-2016-1454
BDU:2015-11991
CVE-2015-7187
MGASA-2015-0447
OPENSUSE-SU-2015_1942-1
OPENSUSE-SU-2024:10071-1
OPENSUSE-SU-2024:14572-1
USN-2785-1

Affected Products

Alt Linux
Firefox
Suse
Ubuntu