Published: 16/08/2015 Updated: 30/10/2018

CVSS v2 Base Score: 3.3 | Impact Score: 4.9 | Exploitability Score: 3.4

VMScore: 335

Vector: AV:L/AC:M/Au:N/C:N/I:P/A:P

Race condition in the Mozilla Maintenance Service in Mozilla Firefox prior to 40.0 and Firefox ESR 38.x prior to 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox
mozilla firefox_esr 38.0
mozilla firefox_esr 38.0.1
mozilla firefox_esr 38.0.5
mozilla firefox_esr 38.1.0
opensuse opensuse 13.1
opensuse opensuse 13.2
oracle solaris 11.3

Mozilla Foundation Security Advisory 2015-84 Arbitrary file overwriting through Mozilla Maintenance Service with hard links Announced August 11, 2015 Reporter James Forshaw Impact High Products Firefox, Firefox ESR, SeaMonkey ...

Source: codegooglecom/p/google-security-research/issues/detail?id=427&can=1 Mozilla Maintenance Service: Log File Overwrite Elevation of Privilege Platform: Windows Version: Mozilla Firefox 3805 Class: Elevation of Privilege Summary: The maintenance service creates a log file in a user writable location It’s possible to change ...

CWE-362 http://www.mozilla.org/security/announce/2015/mfsa2015-84.html https://bugzilla.mozilla.org/show_bug.cgi?id=1171518 http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html https://security.gentoo.org/glsa/201605-06 http://www.securitytracker.com/id/1033372 http://lists.opensuse.org/opensuse-updates/2015-08/msg00031.html http://lists.opensuse.org/opensuse-updates/2015-08/msg00030.html http://www.securitytracker.com/id/1033247 https://www.exploit-db.com/exploits/37925/https://nvd.nist.gov https://www.exploit-db.com/exploits/37925/https://www.mozilla.org/en-US/security/advisories/mfsa2015-84/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2015-4481

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect