CVE-2015-4505: Medium severity firefox vulnerability
Published Sep 24, 2015
·Updated
updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allows local users to write to arbitrary files by conducting a junction attack and waiting for an update operation by the Mozilla Maintenance Service.
Affected Software
19 affected components
All of the following
Any of the following
Mozilla Firefox=38.0
Mozilla Firefox=38.0.1
Mozilla Firefox=38.0.5
Mozilla Firefox=38.1.0
Mozilla Firefox=38.1.1
Mozilla Firefox=38.2.0
Mozilla Firefox=38.2.1
Microsoft Windows
All of the following
Mozilla Firefox<=40.0.3
Microsoft Windows
Mozilla Firefox ESR=38.0
Mozilla Firefox ESR=38.0.1
Mozilla Firefox ESR=38.0.5
Mozilla Firefox ESR=38.1.0
Mozilla Firefox ESR=38.1.1
Mozilla Firefox ESR=38.2.0
Mozilla Firefox ESR=38.2.1
Microsoft Windows
Mozilla Firefox<=40.0.3
Event History
Sep 24, 2015
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-4505?
CVE-2015-4505 has a moderate severity rating as it allows local users to exploit junction attacks to write to arbitrary files.
2
How do I fix CVE-2015-4505?
To fix CVE-2015-4505, upgrade to Mozilla Firefox version 41.0 or later.
3
Which versions of Firefox are affected by CVE-2015-4505?
CVE-2015-4505 affects all Mozilla Firefox versions prior to 41.0 and Firefox ESR versions before 38.3.
4
Can CVE-2015-4505 be exploited remotely?
No, CVE-2015-4505 requires local user access to exploit the vulnerability.
5
What type of attack does CVE-2015-4505 involve?
CVE-2015-4505 involves a junction attack that allows local users to manipulate file writes during update operations.