Attacker Value
Unknown
(1 user assessed)
Exploitability
Unknown
(1 user assessed)
User Interaction
Unknown
Privileges Required
Unknown
Attack Vector
Unknown
2

CVE-2015-4495

Disclosure Date: August 08, 2015
Exploited in the Wild
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

Add Assessment

1
Technical Analysis

Reported as exploited in the wild as part of Google’s 2020 0day vulnerability spreadsheet they made available at https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit#gid=1869060786. Original tweet announcing this spreadsheet with the 2020 findings can be found at https://twitter.com/maddiestone/status/1329837665378725888

CVSS V3 Severity and Metrics
Base Score:
None
Impact Score:
Unknown
Exploitability Score:
Unknown
Vector:
Unknown
Attack Vector (AV):
Unknown
Attack Complexity (AC):
Unknown
Privileges Required (PR):
Unknown
User Interaction (UI):
Unknown
Scope (S):
Unknown
Confidentiality (C):
Unknown
Integrity (I):
Unknown
Availability (A):
Unknown

General Information

Vendors

  • canonical,
  • mozilla,
  • novell,
  • opensuse,
  • oracle

Products

  • firefox,
  • firefox esr 38.0,
  • firefox esr 38.0.1,
  • firefox esr 38.0.5,
  • firefox esr 38.1.0,
  • firefox os,
  • opensuse 13.1,
  • opensuse 13.2,
  • solaris 11.3,
  • suse linux enterprise desktop 12.0,
  • suse linux enterprise server 12.0,
  • suse linux enterprise software development kit 12.0,
  • ubuntu linux 12.04,
  • ubuntu linux 14.04,
  • ubuntu linux 15.04

Exploited in the Wild

Reported by:
Technical Analysis