CVE-2015-0816

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js.

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

66.94% chance of exploitation in the next 30 days, 99th percentile

Published

2015-04-01

Updated

2024-08-06

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_pdfjs_priv…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/37958

References

• CVE Record
• NVD entry

Related

• CVE-2015-0802
• CVE-2015-0919
• CVE-2015-0779
• CVE-2015-0921
• CVE-2015-0569
• CVE-2015-0923