Actively exploited · Published Aug 8, 2015 · Assigned by mozilla
CVE-2015-4495
High 8.8 Exploited
In plain English
A high-severity security flaw in Firefox from Mozilla. Attackers are actively exploiting it in the wild (listed by CISA on May 25, 2022). The chance it is exploited in the next 30 days is estimated at 68.6% (higher than 99.3% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 15, 2022.
Official description
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | pdf.js | 1.1.366+dfsg-1 | DEBIAN-CVE-2015-4495 |
| Debian:13 | pdf.js | 1.1.366+dfsg-1 | DEBIAN-CVE-2015-4495 |
| Debian:14 | pdf.js | 1.1.366+dfsg-1 | DEBIAN-CVE-2015-4495 |
Affected products (as reported)
Weakness: CWE-346 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1179262 x_refsource_CONFIRM
- SUSE-SU-2015:1379 vendor-advisory, x_refsource_SUSE
- SUSE-SU-2015:1380 vendor-advisory, x_refsource_SUSE
- 76249 vdb-entry, x_refsource_BID
- 37772 exploit, x_refsource_EXPLOIT-DB
- RHSA-2015:1581 vendor-advisory, x_refsource_REDHAT
- GLSA-201512-10 vendor-advisory, x_refsource_GENTOO
- openSUSE-SU-2015:1389 vendor-advisory, x_refsource_SUSE
- USN-2707-1 vendor-advisory, x_refsource_UBUNTU
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html x_refsource_CONFIRM
- SUSE-SU-2015:1528 vendor-advisory, x_refsource_SUSE
- https://bugzilla.mozilla.org/show_bug.cgi?id=1178058 x_refsource_CONFIRM
- https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/ x_refsource_CONFIRM
- http://www.mozilla.org/security/announce/2015/mfsa2015-78.html x_refsource_CONFIRM
- 1033216 vdb-entry, x_refsource_SECTRACK
- SUSE-SU-2015:1449 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2015:1390 vendor-advisory, x_refsource_SUSE
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4495 government-resource