CVE-2015-4490 — Cross-site Scripting in Mozilla Firefox

CWE-79 — Cross-site Scripting12 documents7 sources
Severity
4.3MEDIUMNVD
OSV10.0
EPSS
0.3%
top 43.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Mozilla FirefoxCanonical Ubuntu LinuxOpensuse+1 more
Timeline
PublishedAug 16
Latest updateMay 14

Description

The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not implement the Content Security Policy Level 2 exceptions for the blob, data, and filesystem URL schemes during wildcard source-expression matching, which might make it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging unexpected policy-enforcement behavior.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages4 packages

▶Ubuntumozilla/firefox< 40.0+build4-0ubuntu0.14.04.1+1
▶NVDmozilla/firefox39.0.3
▶NVDoracle/solaris11.3
▶NVDopensuse/opensuse13.1, 13.2+1

Also affects: Ubuntu Linux 12.04, 14.04, 15.04

🔴Vulnerability Details

6
GHSA
GHSA-346h-r83r-9vqj: The nsCSPHostSrc::permits function in dom/security/nsCSPUtils↗2022-05-14
▶
OSV
firefox regression↗2015-08-20
▶
CVEList
CVE-2015-4490: The nsCSPHostSrc::permits function in dom/security/nsCSPUtils↗2015-08-16
▶
OSV
CVE-2015-4490: The nsCSPHostSrc::permits function in dom/security/nsCSPUtils↗2015-08-11
▶
OSV
firefox vulnerabilities↗2015-08-11
▶

📋Vendor Advisories

4
Ubuntu
Firefox regression↗2015-08-20
▶
Ubuntu
Firefox vulnerabilities↗2015-08-11
▶
Ubuntu
Ubufox update↗2015-08-11
▶
Red Hat
Mozilla: Mozilla Content Security Policy allows for asterisk wildcards in violation of CSP specification (MFSA 2015-91)↗2015-08-11
▶

💬Community

1
Bugzilla
CVE-2015-4490 Mozilla: Mozilla Content Security Policy allows for asterisk wildcards in violation of CSP specification (MFSA 2015-91)↗2015-08-11
▶
CVE-2015-4490 — Cross-site Scripting in Mozilla Firefox | cvebase