Published: 16/12/2015 Updated: 30/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

The importScripts function in the Web Workers API implementation in Mozilla Firefox prior to 43.0 allows remote malicious users to bypass the Same Origin Policy by triggering use of the no-cors mode in the fetch API to attempt resource access that throws an exception, leading to information disclosure after a rethrow.

Vulnerable Product	Search on Vulmon	Subscribe to Product
fedoraproject fedora 23
fedoraproject fedora 22
opensuse leap 42.1
opensuse opensuse 13.2
opensuse opensuse 13.1
mozilla firefox

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

Mozilla Foundation Security Advisory 2015-140 Cross-origin information leak through web workers error events Announced December 15, 2015 Reporter Masato Kinugawa Impact High Products Firefox Fixed in ...

The importScripts function in the Web Workers API implementation in Mozilla Firefox before 430 allows remote attackers to bypass the Same Origin Policy by triggering use of the no-cors mode in the fetch API to attempt resource access that throws an exception, leading to information disclosure after a rethrow ...

CWE-200 https://github.com/whatwg/html/pull/166 https://bugzilla.mozilla.org/show_bug.cgi?id=1160890 https://github.com/whatwg/html/issues/164 http://www.mozilla.org/security/announce/2015/mfsa2015-140.html https://www.w3.org/Bugs/Public/show_bug.cgi?id=28961 http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174253.html http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html http://www.securityfocus.com/bid/79280 http://www.securitytracker.com/id/1034426 https://security.gentoo.org/glsa/201512-10 http://www.ubuntu.com/usn/USN-2833-1 http://lists.opensuse.org/opensuse-updates/2015-12/msg00104.html https://usn.ubuntu.com/2833-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2015-7215

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2015-7215

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect