Published: 01/04/2015 Updated: 30/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 505

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Mozilla Firefox prior to 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote malicious users to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods.

Vulnerable Product	Search on Vulmon	Subscribe to Product
opensuse opensuse 13.2
opensuse opensuse 13.1
canonical ubuntu linux 12.04
canonical ubuntu linux 14.04
canonical ubuntu linux 14.10
mozilla firefox

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

Mozilla Foundation Security Advisory 2015-42 Windows can retain access to privileged content on navigation to unprivileged pages Announced March 31, 2015 Reporter Bobby Holley Impact Moderate Products Firefox, Firefox OS, Sea ...

Mozilla Firefox before 370 relies on docshell type information instead of page principal information for Windowwebidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of ...

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ManualRanking include Msf::Exploit::Remote::BrowserExploitServer include Msf::Exploit::Remote::FirefoxPrivilegeEscalation def initi ...

This Metasploit module gains remote code execution on Firefox 35-36 by abusing a privilege escalation bug in resource:// URIs PDFjs is used to exploit the bug This exploit requires the user to click anywhere on the page to trigger the vulnerability ...

CVE-2015-0816 + CVE-2015-0802

Firefox-35-37-Exploit CVE-2015-0816 + CVE-2015-0802 for firefox

CWE-264 https://bugzilla.mozilla.org/show_bug.cgi?id=1124898 http://www.mozilla.org/security/announce/2015/mfsa2015-42.html http://www.ubuntu.com/usn/USN-2550-1 http://www.securitytracker.com/id/1031996 http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html https://security.gentoo.org/glsa/201512-10 https://www.exploit-db.com/exploits/37958/https://usn.ubuntu.com/2550-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/37958/https://access.redhat.com/security/cve/cve-2015-0802

CVE-2015-0802

Vulnerability Summary

Vendor Advisories

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect