Mozilla Firefox PDF Viewer安全绕过漏洞

详细信息

漏洞类型

信息泄露

漏洞描述

Mozilla Firefox、Firefox ESR和Firefox OS都是由美国Mozilla基金会开发。Firefox是一款开源Web浏览器；Firefox ESR是Firefox的一个延长支持版本；Firefox OS是一套基于Linux内核并应用于智能手机和平板电脑中的移动操作系统。 多款Mozilla产品中的PDF阅读器存在安全漏洞。远程攻击者可借助特制的JavaScript代码和本机调节器利用该漏洞绕过同源策略，读取任意文件或获取权限。以下产品及版本受到影响：Mozilla Firefox 39.0.3之前版本，Firefox ESR Mozilla Firefox before 39.0.3,Firefox ESR 38.x before 38.1.1,and Firefox OS before 2.2之前38.x版本，Firefox OS 2.2之前版本。说明：该漏洞在2015年8月被广泛利用。

修复建议

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： https://www.mozilla.org/en-US/security/advisories/mfsa2015-78/

参考链接

• https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/

  NVD · x_refsource_CONFIRM

• http://www.mozilla.org/security/announce/2015/mfsa2015-78.html

  NVD · x_refsource_CONFIRM

• https://bugzilla.mozilla.org/show_bug.cgi?id=1178058

  NVD · x_refsource_CONFIRM

• https://bugzilla.mozilla.org/show_bug.cgi?id=1179262

  NVD · x_refsource_CONFIRM

• https://www.exploit-db.com/exploits/37772/

  NVD · exploit · x_refsource_EXPLOIT-DB

• http://rhn.redhat.com/errata/RHSA-2015-1581.html

  NVD · vendor-advisory · x_refsource_REDHAT

• http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html

  NVD · vendor-advisory · x_refsource_SUSE

• http://www.ubuntu.com/usn/USN-2707-1

  NVD · vendor-advisory · x_refsource_UBUNTU

• http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html

  NVD · vendor-advisory · x_refsource_SUSE

• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

  NVD · x_refsource_CONFIRM

• http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html

  NVD · vendor-advisory · x_refsource_SUSE

• http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html

  NVD · vendor-advisory · x_refsource_SUSE

• http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html

  NVD · vendor-advisory · x_refsource_SUSE

• http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html

  NVD · vendor-advisory · x_refsource_SUSE

• https://security.gentoo.org/glsa/201512-10

  NVD · vendor-advisory · x_refsource_GENTOO

• https://security-tracker.debian.org/tracker/CVE-2015-4495

  OSV

• https://osv.dev/vulnerability/CVE-2015-4495

  OSV

• https://ubuntu.com/security/CVE-2015-4495

  OSV

• https://www.mozilla.org/en-US/security/advisories/mfsa2015-78/

  OSV

• https://ubuntu.com/security/notices/USN-2707-1

  OSV

• https://www.cve.org/CVERecord?id=CVE-2015-4495

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  OSV

• https://osv.dev/vulnerability/UBUNTU-CVE-2015-4495

  OSV

• https://osv.dev/vulnerability/DEBIAN-CVE-2015-4495

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4495

  NVD · US Government Resource