5

CVE-2015-0802: canonical ubuntu_linux

Modified
AliasesUBUNTU-CVE-2015-0802
Published 01-04-2015Last modified 06-08-2024

Vulnerability summary

CVE-2015-0802 is a medium (CVSS 5.0) vulnerability in canonical ubuntu_linux. EPSS estimates a 65.87% chance of exploitation in the next 30 days, higher than 99.2% of scored vulnerabilities. 3 public exploits are recorded.

Priority
Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 24-08-2015)

Source freshness unavailable

How is this decided?
CVSS score
5.0/10
010
Medium · v2.0 (NVD)
EPSS score
65.87%
0%100%
Critical · -1.39 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits3exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 4 · Related 3
MGASA-2015-0342OPENSUSE-SU-2024:10071-1OPENSUSE-SU-2024:14572-1USN-2550-1

Timeline

  1. 01-04-2015
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

65.87%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

Decrease -1.39 pp

From 67.27% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

3 found
  • exploit-databaseremotemultipleVerified

    Mozilla Firefox - 'pdf.js' Privileged JavaScript Injection (Metasploit)

    Maturity: weaponized

  • MetasploitMetasploitremoteUnverified

    Firefox PDF.js Privileged Javascript Injection

    exploit/multi/browser/firefox_pdfjs_privilege_escalation

    Maturity: poc

  • MetasploitMetasploitremoteUnverified

    Firefox Proxy Prototype Privileged Javascript Injection

    exploit/multi/browser/firefox_proxy_prototype

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Canonical1 product
Mozilla1 product
Opensuse1 product
Ubuntu1 product
  • firefox< 37.0+build2-0ubuntu0.14.04.1

4 vendors · 4 products

References

11 links
Show all 11 references