CVE-2015-0816
EUVD-2015-082901.04.2015, 10:59
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| mozilla | firefox | 𝑥 ≤ 31.5.3 |
| mozilla | firefox | 𝑥 ≤ 36.0.4 |
| mozilla | thunderbird | 𝑥 ≤ 31.5 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Ubuntu Product | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| firefox |
| ||||||||
| thunderbird |
|
Common Weakness Enumeration
References