CVE-2015-0816: Medium severity Mozilla Firefox vulnerability
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mozilla Firefoxto a version that resolves this vulnerability.Fixed in 37.0 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 31.6 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 31.6
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0816?
CVE-2015-0816 is considered a high-severity vulnerability due to its potential to allow remote code execution through JavaScript with elevated privileges.
How do I fix CVE-2015-0816?
To fix CVE-2015-0816, update Mozilla Firefox to version 37.0 or later, Firefox ESR to version 31.6 or later, or Thunderbird to version 31.6 or later.
What systems are affected by CVE-2015-0816?
CVE-2015-0816 affects Mozilla Firefox versions prior to 37.0, Firefox ESR versions prior to 31.6, and Thunderbird versions prior to 31.6.
What impact does CVE-2015-0816 have on my system?
CVE-2015-0816 can allow attackers to execute arbitrary JavaScript code, potentially compromising system security and data integrity.
Is CVE-2015-0816 still relevant today?
While CVE-2015-0816 is an older vulnerability, it remains relevant for users who have not updated their affected software.