CVE-2015-4495

mozilla firefox, mozilla firefox os, oracle solaris

Published 8 Aug 2015 · updated 17 Jun 2026 · Analyzed

8.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 25 May 2022, with a remediation deadline of 15 Jun 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

References

lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html · Mailing List, Third Party Advisory
rhn.redhat.com/errata/RHSA-2015-1581.html · Third Party Advisory
www.mozilla.org/security/announce/2015/mfsa2015-78.html · Vendor Advisory
www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html · Patch, Third Party Advisory
www.securityfocus.com/bid/76249 · Broken Link, Third Party Advisory, VDB Entry
www.securitytracker.com/id/1033216 · Broken Link, Third Party Advisory, VDB Entry
www.ubuntu.com/usn/USN-2707-1 · Third Party Advisory
blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/ · Issue Tracking, Vendor Advisory
bugzilla.mozilla.org/show_bug.cgi?id=1178058 · Issue Tracking
bugzilla.mozilla.org/show_bug.cgi?id=1179262 · Issue Tracking
security.gentoo.org/glsa/201512-10 · Third Party Advisory
www.exploit-db.com/exploits/37772/ · Exploit, Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4495 · US Government Resource