CVE-2015-4505
published 2015-09-24CVE-2015-4505: updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allows local users to write to arbitrary files by conducting a junction…
PriorityP421medium6.6CVSS 2.0
AVLACLAuNCNICAC
EPSS
0.29%
21.7th percentile
updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allows local users to write to arbitrary files by conducting a junction attack and waiting for an update operation by the Mozilla Maintenance Service.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | <= 40.0.3 | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
CVSS provenance
nvdv2.06.6MEDIUMAV:L/AC:L/Au:N/C:N/I:C/A:C
vendor_redhat6.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Mozilla: Arbitrary file manipulation by local user through Mozilla updater (MFSA 2015-100)
vendor_redhat·2015-09-22·CVSS 6.6
CVE-2015-4505 [MEDIUM] CWE-20 Mozilla: Arbitrary file manipulation by local user through Mozilla updater (MFSA 2015-100)
Mozilla: Arbitrary file manipulation by local user through Mozilla updater (MFSA 2015-100)
updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allows local users to write to arbitrary files by conducting a junction attack and waiting for an update operation by the Mozilla Maintenance Service.
Package: firefox (Red Hat Enterprise Linux 5) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 5) - Not affected
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 6) - Not affected
Package: firefox (Red Hat Enterprise Linux 7) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 7) - Not affected
GHSA
GHSA-wmp9-284v-m552: updater
ghsa_unreviewed·2022-05-17
CVE-2015-4505 [MEDIUM] GHSA-wmp9-284v-m552: updater
updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allows local users to write to arbitrary files by conducting a junction attack and waiting for an update operation by the Mozilla Maintenance Service.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00005.htmlhttp://www.mozilla.org/security/announce/2015/mfsa2015-100.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.securitytracker.com/id/1033640https://bugzilla.mozilla.org/show_bug.cgi?id=1177861http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00005.htmlhttp://www.mozilla.org/security/announce/2015/mfsa2015-100.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.securitytracker.com/id/1033640https://bugzilla.mozilla.org/show_bug.cgi?id=1177861
2015-09-24
Published