CVE-2015-4495
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
Firefox's PDF reader had a security flaw that allowed attackers to bypass protections meant to prevent websites from accessing files outside their domain. A malicious website could use specially crafted code to read your files or gain unauthorized access to your browser.
CVE-2015-4495 exploits a Same Origin Policy bypass in Firefox's PDF handling through crafted JavaScript interacting with native setters. The attack vector involves hosting malicious JavaScript that leverages the PDF reader's insufficient origin validation, potentially allowing file disclosure and privilege escalation without user interaction beyond visiting a compromised site.
The full analysis of this CVE is available in Portuguese →