Published: 29/08/2015 Updated: 22/12/2016

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

The add-on installation feature in Mozilla Firefox prior to 40.0.3 and Firefox ESR 38.x prior to 38.2.1 allows remote malicious users to bypass an intended user-confirmation requirement by constructing a crafted data: URL and triggering navigation to an arbitrary http: or https: URL at a certain early point in the installation process.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox esr 38.2.0
mozilla firefox
mozilla firefox esr 38.0
mozilla firefox esr 38.0.1
mozilla firefox esr 38.0.5
mozilla firefox esr 38.1.0

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2015-4497 Jean-Max Reymond and Ucha Gobejishvili discovered a use-after-free vulnerability which occurs when resizing of a canvas element is ...

Mozilla Foundation Security Advisory 2015-95 Add-on notification bypass through data URLs Announced August 27, 2015 Reporter Bas Venis Impact High Products Firefox, Firefox ESR, SeaMonkey Fixed in ...

A flaw was found in the way Firefox handled installation of add-ons An attacker could use this flaw to bypass the add-on installation prompt, and trick the user into installing an add-on from a malicious source ...

CWE-254 http://www.mozilla.org/security/announce/2015/mfsa2015-95.html https://bugzilla.mozilla.org/show_bug.cgi?id=1042699 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securityfocus.com/bid/76505 http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html http://www.ubuntu.com/usn/USN-2723-1 http://www.securitytracker.com/id/1033396 http://www.debian.org/security/2015/dsa-3345 http://rhn.redhat.com/errata/RHSA-2015-1693.html http://lists.opensuse.org/opensuse-updates/2015-09/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00013.html https://usn.ubuntu.com/2723-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2015-4498

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2015-4498

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect