CVE-2015-0816
CVE-2015-0816
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js.
Affected products
n/a · n/apublic PoCs found — 2
cve_referencewww.exploit-db.com/exploits/37958/unverifiedexploitdbwww.exploit-db.com/exploits/37958unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-04/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0766.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0771.htmlhttps://bugzilla.mozilla.org/show_bug.cgi?id=1144991https://security.gentoo.org/glsa/201512-10https://www.exploit-db.com/exploits/37958/http://www.debian.org/security/2015/dsa-3211http://www.debian.org/security/2015/dsa-3212http://www.mozilla.org/security/announce/2015/mfsa2015-33.html