CVE-2015-0816

中 5.0CVE-2015-0816 · 01/04/2015 公開 · 17/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
firefox mozilla	`≤ 31.5.3≤ 36.0.4`	修正版なし
thunderbird mozilla	`≤ 31.5`	修正版なし

概要

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js.

参考情報

lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html
lists.opensuse.org/opensuse-security-announce/2015-04/msg00006.html
lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.html
lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html
rhn.redhat.com/errata/RHSA-2015-0766.html
rhn.redhat.com/errata/RHSA-2015-0771.html
debian.org/security/2015/dsa-3211
debian.org/security/2015/dsa-3212
mozilla.org/security/announce/2015/mfsa2015-33.html · Vendor Advisory
oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
securityfocus.com/bid/73461
securitytracker.com/id/1031996
securitytracker.com/id/1032000
ubuntu.com/usn/USN-2550-1
ubuntu.com/usn/USN-2552-1
bugzilla.mozilla.org/show_bug.cgi
security.gentoo.org/glsa/201512-10
exploit-db.com/exploits/37958

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン