CVEvulnerability
CVE-2015-4481
3.3 LOW
Official page ↗
- Status
- Modified
- Published
- 2015-08-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 3.3 LOW — AV:L/AC:M/Au:N/C:N/I:P/A:P
- Weaknesses
- CWE-362
Description
Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update.
Affected configurations
• mozilla firefox (<= 39.0.3)
• mozilla firefox 38.0
• mozilla firefox 38.0.1
• mozilla firefox 38.0.5
• mozilla firefox 38.1.0
• opensuse opensuse 13.1
• opensuse opensuse 13.2
• oracle solaris 11.3
Related
Weakness · CWE (1)
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-08/msg00030.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-updates/2015-08/msg00031.html lists.opensuse.org
- http://www.mozilla.org/security/announce/2015/mfsa2015-84.html Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html Third Party Advisory
- http://www.securitytracker.com/id/1033247 www.securitytracker.com
- http://www.securitytracker.com/id/1033372 www.securitytracker.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=1171518 Issue Tracking
- https://security.gentoo.org/glsa/201605-06 security.gentoo.org
- https://www.exploit-db.com/exploits/37925/ www.exploit-db.com
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-08/msg00030.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-updates/2015-08/msg00031.html lists.opensuse.org
- http://www.mozilla.org/security/announce/2015/mfsa2015-84.html Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html Third Party Advisory
- http://www.securitytracker.com/id/1033247 www.securitytracker.com
- http://www.securitytracker.com/id/1033372 www.securitytracker.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=1171518 Issue Tracking
- https://security.gentoo.org/glsa/201605-06 security.gentoo.org
- https://www.exploit-db.com/exploits/37925/ www.exploit-db.com