CVE-2015-0816 Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScri...
MediumCVSS 5.0
EPSS 64.6%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla Firefox | <= 31.5.3 | No fix listed |
| mozilla Firefox | <= 36.0.4 | No fix listed |
| mozilla Thunderbird | <= 31.5 | No fix listed |
References
- openSUSE-SU-2015:0677 vendor-advisory
- SUSE-SU-2015:0704 vendor-advisory
- openSUSE-SU-2015:0892 vendor-advisory
- openSUSE-SU-2015:1266 vendor-advisory
- RHSA-2015:0766 vendor-advisory
- RHSA-2015:0771 vendor-advisory
- DSA-3211 vendor-advisory
- DSA-3212 vendor-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com
- 73461 vdb-entry
- 1031996 vdb-entry
- 1032000 vdb-entry
- USN-2550-1 vendor-advisory
- USN-2552-1 vendor-advisory
- bugzilla.mozilla.org
- GLSA-201512-10 vendor-advisory
- 37958 exploit