CVEvulnerability
CVE-2015-7215
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-12-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The importScripts function in the Web Workers API implementation in Mozilla Firefox before 43.0 allows remote attackers to bypass the Same Origin Policy by triggering use of the no-cors mode in the fetch API to attempt resource access that throws an exception, leading to information disclosure after a rethrow.
Affected configurations
• fedoraproject fedora 22
• fedoraproject fedora 23
• opensuse leap 42.1
• opensuse opensuse 13.1
• opensuse opensuse 13.2
• mozilla firefox (<= 42.0)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174253.html lists.fedoraproject.org
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00104.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html lists.opensuse.org
- http://www.mozilla.org/security/announce/2015/mfsa2015-140.html Vendor Advisory
- http://www.securityfocus.com/bid/79280 www.securityfocus.com
- http://www.securitytracker.com/id/1034426 www.securitytracker.com
- http://www.ubuntu.com/usn/USN-2833-1 www.ubuntu.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=1160890 bugzilla.mozilla.org
- https://github.com/whatwg/html/issues/164 github.com
- https://github.com/whatwg/html/pull/166 github.com
- https://security.gentoo.org/glsa/201512-10 security.gentoo.org
- https://www.w3.org/Bugs/Public/show_bug.cgi?id=28961 Vendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174253.html lists.fedoraproject.org
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00104.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html lists.opensuse.org
- http://www.mozilla.org/security/announce/2015/mfsa2015-140.html Vendor Advisory
- http://www.securityfocus.com/bid/79280 www.securityfocus.com
- http://www.securitytracker.com/id/1034426 www.securitytracker.com
- http://www.ubuntu.com/usn/USN-2833-1 www.ubuntu.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=1160890 bugzilla.mozilla.org
- https://github.com/whatwg/html/issues/164 github.com
- https://github.com/whatwg/html/pull/166 github.com
- https://security.gentoo.org/glsa/201512-10 security.gentoo.org
- https://www.w3.org/Bugs/Public/show_bug.cgi?id=28961 Vendor Advisory