CVE-2015-4495
CVE-2015-4495
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.
CVSS 8.8 · Élevée · EPSS 68,6% · Dans le catalogue KEV · Code d’exploitation public · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system
Produits et versions concernés
n/a
- Versions du logiciel
- n/a: Concernée
Aucun correctif publié
pdf.js Debian:12
- Plages de versions concernées
- ECOSYSTEM: < 1.1.366+dfsg-1
Mettez à jour vers 1.1.366+dfsg-1
pdf.js Debian:13
- Plages de versions concernées
- ECOSYSTEM: < 1.1.366+dfsg-1
Mettez à jour vers 1.1.366+dfsg-1
pdf.js Debian:14
- Plages de versions concernées
- ECOSYSTEM: < 1.1.366+dfsg-1
Mettez à jour vers 1.1.366+dfsg-1
firefox Ubuntu:14.04:LTS
- Versions du logiciel
- 24.0+build1-0ubuntu1
- 25.0+build3-0ubuntu0.13.10.1
- 28.0~b2+build1-0ubuntu2
- 28.0+build1-0ubuntu1
- 28.0+build2-0ubuntu1
- 28.0+build2-0ubuntu2
- 29.0+build1-0ubuntu0.14.04.2
- 30.0+build1-0ubuntu0.14.04.3
- 31.0+build1-0ubuntu0.14.04.1
- 32.0+build1-0ubuntu0.14.04.1
- 32.0.3+build1-0ubuntu0.14.04.1
- 33.0+build2-0ubuntu0.14.04.1
- 34.0+build2-0ubuntu0.14.04.1
- 35.0+build3-0ubuntu0.14.04.2
- 35.0.1+build1-0ubuntu0.14.04.1
- 36.0+build2-0ubuntu0.14.04.4
- 36.0.1+build2-0ubuntu0.14.04.1
- 36.0.4+build1-0ubuntu0.14.04.1
- 37.0+build2-0ubuntu0.14.04.1
- 37.0.1+build1-0ubuntu0.14.04.1
- 37.0.2+build1-0ubuntu0.14.04.1
- 38.0+build3-0ubuntu0.14.04.1
- 39.0+build5-0ubuntu0.14.04.1
- Plages de versions concernées
- ECOSYSTEM: < 39.0.3+build2-0ubuntu0.14.04.1
Mettez à jour vers 39.0.3+build2-0ubuntu0.14.04.1
Sources originales
- https://bugzilla.mozilla.org/show_bug.cgi?id=1179262
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html
- http://www.securityfocus.com/bid/76249
- https://www.exploit-db.com/exploits/37772/
- http://rhn.redhat.com/errata/RHSA-2015-1581.html
- https://security.gentoo.org/glsa/201512-10
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html
- http://www.ubuntu.com/usn/USN-2707-1
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1178058
- https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/
- http://www.mozilla.org/security/announce/2015/mfsa2015-78.html
- http://www.securitytracker.com/id/1033216
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4495
- https://nvd.nist.gov/vuln/detail/CVE-2015-4495