p PatchFirst

CVE-2015-4518

CVE-2015-4518

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The Reader View implementation in Mozilla Firefox before 42.0 has an improper whitelist, which makes it easier for remote attackers to bypass the Content Security Policy (CSP) protection mechanism and conduct cross-site scripting (XSS) attacks via vectors involving SVG animations and the about:reader URL.

EPSS 2.0% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • firefox Ubuntu:14.04:LTS

    Versions
    • 24.0+build1-0ubuntu1
    • 25.0+build3-0ubuntu0.13.10.1
    • 28.0~b2+build1-0ubuntu2
    • 28.0+build1-0ubuntu1
    • 28.0+build2-0ubuntu1
    • 28.0+build2-0ubuntu2
    • 29.0+build1-0ubuntu0.14.04.2
    • 30.0+build1-0ubuntu0.14.04.3
    • 31.0+build1-0ubuntu0.14.04.1
    • 32.0+build1-0ubuntu0.14.04.1
    • 32.0.3+build1-0ubuntu0.14.04.1
    • 33.0+build2-0ubuntu0.14.04.1
    • 34.0+build2-0ubuntu0.14.04.1
    • 35.0+build3-0ubuntu0.14.04.2
    • 35.0.1+build1-0ubuntu0.14.04.1
    • 36.0+build2-0ubuntu0.14.04.4
    • 36.0.1+build2-0ubuntu0.14.04.1
    • 36.0.4+build1-0ubuntu0.14.04.1
    • 37.0+build2-0ubuntu0.14.04.1
    • 37.0.1+build1-0ubuntu0.14.04.1
    • 37.0.2+build1-0ubuntu0.14.04.1
    • 38.0+build3-0ubuntu0.14.04.1
    • 39.0+build5-0ubuntu0.14.04.1
    • 39.0.3+build2-0ubuntu0.14.04.1
    • 40.0+build4-0ubuntu0.14.04.1
    • 40.0+build4-0ubuntu0.14.04.4
    • 40.0.3+build1-0ubuntu0.14.04.1
    • 41.0+build3-0ubuntu0.14.04.1
    • 41.0.1+build2-0ubuntu0.14.04.1
    • 41.0.2+build2-0ubuntu0.14.04.1
    Affected ranges
    • ECOSYSTEM: < 42.0+build2-0ubuntu0.14.04.1

    Update to 42.0+build2-0ubuntu0.14.04.1

Original sources

Check your server →