PT-2015-4887 · Mozilla+5 · Firefox+7

Mariusz Mlynski · Published 2015-03-20 · Updated 2024-12-12 · CVE-2015-0818

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 36.0.4 Firefox ESR versions prior to 31.5.3 SeaMonkey versions prior to 2.33.1

Description The issue allows remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving SVG hash navigation.

Recommendations For Mozilla Firefox versions prior to 36.0.4, update to version 36.0.4 or later. For Firefox ESR versions prior to 31.5.3, update to version 31.5.3 or later. For SeaMonkey versions prior to 2.33.1, update to version 2.33.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2015-1301

ALT-PU-2015-1321

ALT-PU-2015-1464

CESA-2015_0718

CVE-2015-0818

DSA-3201-1

MGASA-2015-0115

MGASA-2015-0126

OPENSUSE-SU-2015_0607-1

OPENSUSE-SU-2015_0636-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

RHSA-2015:0718

RHSA-2015_0718

SUSE-SU-2015:0630-1

USN-2538-1

ZDI-15-108

Affected Products

Alt Linux

Centos

Firefox Esr

Firefox

Red Hat

Seamonkey

Suse

Ubuntu

References · 2249

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_pdfjs_privilege_escalation.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proxy_prototype.rb · Exploit
• https://bdu.fstec.ru/vul/2015-09904 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2015-28 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09888 · Security Note
• https://bdu.fstec.ru/vul/2015-09892 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1584 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2015:0630-1 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2015-27 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1581 · Security Note
• https://mozilla.org/en-US/security/known-vulnerabilities/firefox-esr · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09816 · Security Note
• https://bdu.fstec.ru/vul/2015-09901 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00035.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0824 · Security Note