CVE-2015-7207

MEDIUM 5.0CVE-2015-7207 · Published 16/12/2015 · updated 17/06/2026

In short

CVE-2015-7207 is a MEDIUM (CVSS 5.0) vulnerability affecting firefox (mozilla).
Chance of exploitation in the next 30 days (EPSS): 2.8%, higher than 86.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
firefox mozilla	`≤ 42.0`	No fix yet

Description

Mozilla Firefox before 43.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls, a related issue to CVE-2015-1300.

References

lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.html
lists.fedoraproject.org/pipermail/package-announce/2015-December/174253.html
lists.opensuse.org/opensuse-security-announce/2016-03/msg00089.html
lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.html
lists.opensuse.org/opensuse-updates/2015-12/msg00104.html
lists.opensuse.org/opensuse-updates/2016-02/msg00007.html
lists.opensuse.org/opensuse-updates/2016-02/msg00008.html
mozilla.org/security/announce/2015/mfsa2015-136.html · Vendor Advisory
securityfocus.com/bid/79280
securitytracker.com/id/1034426
ubuntu.com/usn/USN-2833-1
bugzilla.mozilla.org/show_bug.cgi
w3c/resource-timing · Vendor Advisory
security.gentoo.org/glsa/201512-10

More vulnerabilities in firefox

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free