5

CVE-2015-0802

Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Opensuse ≫ Opensuse Version 13.1
Opensuse ≫ Opensuse Version 13.2
Canonical ≫ Ubuntu Linux Version 12.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 14.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 14.10
Mozilla ≫ Firefox Version <= 36.0.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 67.27% 0.992
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
https://security.gentoo.org/glsa/201512-10
http://www.securitytracker.com/id/1031996
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html
http://www.ubuntu.com/usn/USN-2550-1
http://www.mozilla.org/security/announce/2015/mfsa2015-42.html
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1124898
https://www.exploit-db.com/exploits/37958/