CVE-2015-0802
First published: Wed Apr 01 2015(Updated: )
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| openSUSE | =13.1 | |
| openSUSE | =13.2 | |
| Ubuntu Linux | =12.04 | |
| Ubuntu Linux | =14.04 | |
| Ubuntu Linux | =14.10 | |
| Mozilla Firefox | <=36.0.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-42.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securitytracker.com/id/1031996
- http://www.ubuntu.com/usn/USN-2550-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1124898
- https://security.gentoo.org/glsa/201512-10
- https://www.exploit-db.com/exploits/37958/
- agent/references
- agent/type
- agent/author
- agent/severity
- agent/weakness
- agent/description
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/opensuse
- canonical/opensuse
- version/opensuse/13.1
- version/opensuse/13.2
- vendor/canonical
- canonical/ubuntu linux
- version/ubuntu linux/12.04
- version/ubuntu linux/14.04
- version/ubuntu linux/14.10
- vendor/mozilla
- canonical/mozilla firefox
- version/mozilla firefox/36.0.4