CVEvulnerability
CVE-2015-0802
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-04-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-264
Description
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods.
Affected configurations
• opensuse opensuse 13.1
• opensuse opensuse 13.2
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 14.10
• mozilla firefox (<= 36.0.4)
Related
Weakness · not in database (1)
References
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html lists.opensuse.org
- http://www.mozilla.org/security/announce/2015/mfsa2015-42.html Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html www.oracle.com
- http://www.securitytracker.com/id/1031996 www.securitytracker.com
- http://www.ubuntu.com/usn/USN-2550-1 www.ubuntu.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=1124898 bugzilla.mozilla.org
- https://security.gentoo.org/glsa/201512-10 security.gentoo.org
- https://www.exploit-db.com/exploits/37958/ www.exploit-db.com
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html lists.opensuse.org
- http://www.mozilla.org/security/announce/2015/mfsa2015-42.html Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html www.oracle.com
- http://www.securitytracker.com/id/1031996 www.securitytracker.com
- http://www.ubuntu.com/usn/USN-2550-1 www.ubuntu.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=1124898 bugzilla.mozilla.org
- https://security.gentoo.org/glsa/201512-10 security.gentoo.org
- https://www.exploit-db.com/exploits/37958/ www.exploit-db.com