CVE-2015-0798
The Reader mode feature in Mozilla Firefox before 37.0.1 on Android, and Desktop Firefox pre-release, does not properly handle privileged URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by…
Does this matter?
Lower severity and a low EPSS score (2.22%). Track it; it rarely justifies an emergency change on its own.
Description
The Reader mode feature in Mozilla Firefox before 37.0.1 on Android, and Desktop Firefox pre-release, does not properly handle privileged URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
- EPSS
- 2.22% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- oracle/solaris · mozilla/firefox
- Source
- security@mozilla.org
References
- http://www.mozilla.org/security/announce/2015/mfsa2015-43.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
- http://www.securitytracker.com/id/1032029Third Party Advisory, VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1147597Issue Tracking
- https://security.gentoo.org/glsa/201512-10Third Party Advisory, VDB Entry
- http://www.mozilla.org/security/announce/2015/mfsa2015-43.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
- http://www.securitytracker.com/id/1032029Third Party Advisory, VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1147597Issue Tracking
- https://security.gentoo.org/glsa/201512-10Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.