⚠ Actively exploited
Added to CISA KEV on 2022-05-25. Federal agencies required to patch by 2022-06-15. Required action: Apply updates per vendor instructions..
CVE-2015-4495
Severity
8.8HIGH
EPSS
71.6%
top 1.27%
CISA KEV
KEV
Added 2022-05-25
Due 2022-06-15
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedAug 8
KEV addedMay 25
KEV dueJun 15
CISA Required Action: Apply updates per vendor instructions.
Description
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages13 packages
Also affects: Ubuntu Linux 12.04, 14.04, 15.04, Enterprise Linux 6.7, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.7
Patches
🔴Vulnerability Details
5💥Exploits & PoCs
1🔍Detection Rules
2📋Vendor Advisories
4Red Hat
▶
Debian▶
CVE-2015-4495: pdf.js - The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1,...↗2015
💬Community
1Bugzilla▶
CVE-2015-4495 Mozilla: Same origin violation and local file stealing via PDF reader (MFSA 2015-78)↗2015-08-07