{"schemaVersion":3,"id":"CVE-2015-4495","aliases":["MGASA-2015-0305","SUSE-SU-2015:1379-1","SUSE-SU-2015:1380-1","RHSA-2015:1581","UBUNTU-CVE-2015-4495","USN-2707-1","DEBIAN-CVE-2015-4495"],"status":"published","duplicateOf":null,"title":"Mozilla Firefox Security Feature Bypass Vulnerability","description":"The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.","dates":{"published":"2015-08-08T00:00:00.000Z","modified":"2025-10-21T23:55:58.479Z","reserved":null,"kevAdded":["2022-05-25T00:00:00.000Z"],"kevDue":["2022-06-15T00:00:00.000Z"]},"cvss":{"headline":{"score":8.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.3,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":7.2,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":7.2,"impact":9.8,"computed":true}]},"epss":{"probability":0.68558,"percentile":0.99334,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":-2.787000000000006,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.71345},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.71434,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.71434,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.71434,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.71434,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.71345,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.71345,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.71345,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.71345,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.71345,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.71345,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.68558,"percentile":0.99334}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.71345,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.71345,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.71345,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.71345,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.71345,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.68558,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.68558,"percentile":0.99334}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-05-25T00:00:00.000Z","dueDate":"2022-06-15T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Mozilla Firefox Security Feature Bypass Vulnerability","description":"Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2015-4495","label":"nvd.nist.gov/vuln/detail/CVE-2015-4495"}],"vendor":"Mozilla","product":"Firefox","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-05-25T00:00:00.000Z","dueDate":"2022-06-15T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Mozilla Firefox Security Feature Bypass Vulnerability","description":"Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2015-4495","label":"nvd.nist.gov/vuln/detail/CVE-2015-4495"}],"vendor":"Mozilla","product":"Firefox","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"37772","name":"Mozilla Firefox < 39.03 - 'pdf.js' Same Origin Policy","source":"exploit-database","url":"https://www.exploit-db.com/exploits/37772","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"local","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"local","platform":"multiple","file":"exploits/multiple/local/37772.js","codes":["CVE-2015-4495","OSVDB-125839"]},"metasploit":null},{"id":"MSF_AUXILIARY_GATHER_FIREFOX_PDFJS_FILE_THEFT","name":"Firefox PDF.js Browser File Theft","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"auxiliary/gather/firefox_pdfjs_file_theft","rank":"300","rankName":"normal","postAuth":false,"check":false,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}}],"exploitCount":2,"weaknesses":[{"id":"CWE-346","name":"Origin Validation Error","description":"The product does not properly verify that the source of data or communication is valid.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/346.html"}],"affected":[{"vendor":"canonical","product":"ubuntu_linux","name":"ubuntu linux","label":"ubuntu_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"12.04","noFixRecorded":false,"fixedIn":null},{"text":"14.04","noFixRecorded":false,"fixedIn":null},{"text":"15.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"12.04 | 14.04 | 15.04","eol":{"isEol":true,"eolDate":"2017-04-28T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"12.04","label":"12.04 'Precise Pangolin' (LTS)","eolFrom":"2017-04-28T00:00:00.000Z","isLts":true,"isMaintained":false,"latestVersion":"12.04.5"},"product":{"name":"ubuntu","label":"Ubuntu","category":"os"}},"hubHref":"/vendor/canonical/ubuntu_linux"},{"vendor":"debian","product":"pdf.js","name":"pdf.js","label":"pdf.js","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/pdf.js","purlType":"deb","versions":[{"text":"< 1.1.366+dfsg-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.366+dfsg-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"firefox","name":"firefox","label":"firefox","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/firefox","purlType":"deb","versions":[{"text":"< 39.0.3+build2-0ubuntu0.14.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 39.0.3+build2-0ubuntu0.14.04.1","eol":null,"hubHref":null},{"vendor":"mageia","product":"firefox","name":"firefox","label":"firefox","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/firefox","purlType":"rpm","versions":[{"text":"< 38.1.1-1.mga4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 38.1.1-1.mga4","eol":null,"hubHref":null},{"vendor":"mageia","product":"firefox-l10n","name":"firefox-l10n","label":"firefox-l10n","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/firefox-l10n","purlType":"rpm","versions":[{"text":"< 38.1.1-1.mga4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 38.1.1-1.mga4","eol":null,"hubHref":null},{"vendor":"mageia","product":"firefox","name":"firefox","label":"firefox","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/firefox","purlType":"rpm","versions":[{"text":"< 38.1.1-1.mga5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 38.1.1-1.mga5","eol":null,"hubHref":null},{"vendor":"mageia","product":"firefox-l10n","name":"firefox-l10n","label":"firefox-l10n","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/firefox-l10n","purlType":"rpm","versions":[{"text":"< 38.1.1-1.mga5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 38.1.1-1.mga5","eol":null,"hubHref":null},{"vendor":"mozilla","product":"firefox","name":"Firefox","label":"firefox","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 39.0.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 38.0, < 38.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 39.0.3 | ≥ 38.0, < 38.1.1","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"firefox","label":"Firefox","category":"app"}},"hubHref":"/vendor/mozilla/firefox"},{"vendor":"mozilla","product":"firefox_os","name":"firefox os","label":"firefox_os","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 2.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.2","eol":null,"hubHref":"/vendor/mozilla/firefox_os"},{"vendor":"opensuse","product":"opensuse","name":"opensuse","label":"opensuse","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"13.1","noFixRecorded":false,"fixedIn":null},{"text":"13.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"13.1 | 13.2","eol":{"isEol":true,"eolDate":"2016-02-03T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"13.1","label":"13.1","eolFrom":"2016-02-03T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"opensuse","label":"openSUSE","category":"os"}},"hubHref":"/vendor/opensuse/opensuse"},{"vendor":"oracle","product":"solaris","name":"Solaris","label":"solaris","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"11.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"11.3","eol":{"isEol":true,"eolDate":"2021-01-01T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"11.3","label":"11.3","eolFrom":"2021-01-01T00:00:00.000Z","isLts":false,"isMaintained":true,"latestVersion":null},"product":{"name":"oracle-solaris","label":"Oracle Solaris","category":"os"}},"hubHref":"/vendor/oracle/solaris"},{"vendor":"redhat","product":"enterprise_linux_desktop","name":"enterprise linux desktop","label":"enterprise_linux_desktop","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"5.0","noFixRecorded":false,"fixedIn":null},{"text":"6.0","noFixRecorded":false,"fixedIn":null},{"text":"7.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.0 | 6.0 | 7.0","eol":null,"hubHref":"/vendor/redhat/enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_eus","name":"enterprise linux eus","label":"enterprise_linux_eus","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"6.7","noFixRecorded":false,"fixedIn":null},{"text":"7.1","noFixRecorded":false,"fixedIn":null},{"text":"7.2","noFixRecorded":false,"fixedIn":null},{"text":"7.3","noFixRecorded":false,"fixedIn":null},{"text":"7.4","noFixRecorded":false,"fixedIn":null},{"text":"7.5","noFixRecorded":false,"fixedIn":null},{"text":"7.6","noFixRecorded":false,"fixedIn":null},{"text":"7.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.7 | 7.1 | 7.2 | 7.3 | 7.4 | 7.5 | 7.6 | 7.7","eol":null,"hubHref":"/vendor/redhat/enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server","name":"enterprise linux server","label":"enterprise_linux_server","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"5.0","noFixRecorded":false,"fixedIn":null},{"text":"6.0","noFixRecorded":false,"fixedIn":null},{"text":"7.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.0 | 6.0 | 7.0","eol":null,"hubHref":"/vendor/redhat/enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus","name":"enterprise linux server aus","label":"enterprise_linux_server_aus","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"7.3","noFixRecorded":false,"fixedIn":null},{"text":"7.4","noFixRecorded":false,"fixedIn":null},{"text":"7.6","noFixRecorded":false,"fixedIn":null},{"text":"7.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.3 | 7.4 | 7.6 | 7.7","eol":null,"hubHref":"/vendor/redhat/enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_tus","name":"enterprise linux server tus","label":"enterprise_linux_server_tus","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"7.3","noFixRecorded":false,"fixedIn":null},{"text":"7.6","noFixRecorded":false,"fixedIn":null},{"text":"7.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.3 | 7.6 | 7.7","eol":null,"hubHref":"/vendor/redhat/enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation","name":"enterprise linux workstation","label":"enterprise_linux_workstation","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"5.0","noFixRecorded":false,"fixedIn":null},{"text":"6.0","noFixRecorded":false,"fixedIn":null},{"text":"7.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.0 | 6.0 | 7.0","eol":null,"hubHref":"/vendor/redhat/enterprise_linux_workstation"},{"vendor":"redhat","product":"firefox","name":"firefox","label":"firefox","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/firefox","purlType":"rpm","versions":[{"text":"< 0:38.1.1-1.el5_11","noFixRecorded":false,"fixedIn":null},{"text":"< 0:38.1.1-1.el6_7","noFixRecorded":false,"fixedIn":null},{"text":"< 0:38.1.1-1.el7_1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:38.1.1-1.el5_11 | < 0:38.1.1-1.el6_7 | < 0:38.1.1-1.el7_1","eol":null,"hubHref":null},{"vendor":"redhat","product":"firefox-debuginfo","name":"firefox-debuginfo","label":"firefox-debuginfo","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/firefox-debuginfo","purlType":"rpm","versions":[{"text":"< 0:38.1.1-1.el5_11","noFixRecorded":false,"fixedIn":null},{"text":"< 0:38.1.1-1.el6_7","noFixRecorded":false,"fixedIn":null},{"text":"< 0:38.1.1-1.el7_1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:38.1.1-1.el5_11 | < 0:38.1.1-1.el6_7 | < 0:38.1.1-1.el7_1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Desktop 11 SP3","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Desktop 11 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Desktop 11 SP3","purlType":"rpm","versions":[{"text":"< 31.8.0esr-0.13.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.8.0esr-0.13.2","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Desktop 11 SP4","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Desktop 11 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Desktop 11 SP4","purlType":"rpm","versions":[{"text":"< 31.8.0esr-0.13.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.8.0esr-0.13.2","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Desktop 12","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Desktop 12","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Desktop 12","purlType":"rpm","versions":[{"text":"< 31.8.0esr-40.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.8.0esr-40.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Server 11 SP3","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Server 11 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Server 11 SP3","purlType":"rpm","versions":[{"text":"< 31.8.0esr-0.13.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.8.0esr-0.13.2","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Server 11 SP3-TERADATA","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Server 11 SP3-TERADATA","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Server 11 SP3-TERADATA","purlType":"rpm","versions":[{"text":"< 31.8.0esr-0.13.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.8.0esr-0.13.2","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Server 11 SP4","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Server 11 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Server 11 SP4","purlType":"rpm","versions":[{"text":"< 31.8.0esr-0.13.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.8.0esr-0.13.2","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Server 12","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Server 12","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Server 12","purlType":"rpm","versions":[{"text":"< 31.8.0esr-40.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.8.0esr-40.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP3","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP3","purlType":"rpm","versions":[{"text":"< 31.8.0esr-0.13.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.8.0esr-0.13.2","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4","purlType":"rpm","versions":[{"text":"< 31.8.0esr-0.13.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.8.0esr-0.13.2","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 12","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 12","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 12","purlType":"rpm","versions":[{"text":"< 31.8.0esr-40.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.8.0esr-40.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Software Development Kit 11 SP3","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Software Development Kit 11 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Software Development Kit 11 SP3","purlType":"rpm","versions":[{"text":"< 31.8.0esr-0.13.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.8.0esr-0.13.2","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Software Development Kit 11 SP4","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Software Development Kit 11 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Software Development Kit 11 SP4","purlType":"rpm","versions":[{"text":"< 31.8.0esr-0.13.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.8.0esr-0.13.2","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Software Development Kit 12","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Software Development Kit 12","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Software Development Kit 12","purlType":"rpm","versions":[{"text":"< 31.8.0esr-40.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 31.8.0esr-40.1","eol":null,"hubHref":null},{"vendor":"suse","product":"linux_enterprise_debuginfo","name":"linux enterprise debuginfo","label":"linux_enterprise_debuginfo","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"11:sp1","noFixRecorded":false,"fixedIn":null},{"text":"11:sp2","noFixRecorded":false,"fixedIn":null},{"text":"11:sp3","noFixRecorded":false,"fixedIn":null},{"text":"11:sp4","noFixRecorded":false,"fixedIn":null}],"versionsText":"11:sp1 | 11:sp2 | 11:sp3 | 11:sp4","eol":null,"hubHref":"/vendor/suse/linux_enterprise_debuginfo"},{"vendor":"suse","product":"linux_enterprise_desktop","name":"linux enterprise desktop","label":"linux_enterprise_desktop","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"11:sp3","noFixRecorded":false,"fixedIn":null},{"text":"11:sp4","noFixRecorded":false,"fixedIn":null},{"text":"12","noFixRecorded":false,"fixedIn":null}],"versionsText":"11:sp3 | 11:sp4 | 12","eol":null,"hubHref":"/vendor/suse/linux_enterprise_desktop"},{"vendor":"suse","product":"linux_enterprise_server","name":"linux enterprise server","label":"linux_enterprise_server","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"11:sp1","noFixRecorded":false,"fixedIn":null},{"text":"11:sp2","noFixRecorded":false,"fixedIn":null},{"text":"11:sp3","noFixRecorded":false,"fixedIn":null},{"text":"11:sp4","noFixRecorded":false,"fixedIn":null},{"text":"12","noFixRecorded":false,"fixedIn":null}],"versionsText":"11:sp1 | 11:sp2 | 11:sp3 | 11:sp4 | 12","eol":null,"hubHref":"/vendor/suse/linux_enterprise_server"},{"vendor":"suse","product":"linux_enterprise_software_development_kit","name":"linux enterprise software development kit","label":"linux_enterprise_software_development_kit","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"11:sp3","noFixRecorded":false,"fixedIn":null},{"text":"11:sp4","noFixRecorded":false,"fixedIn":null},{"text":"12","noFixRecorded":false,"fixedIn":null}],"versionsText":"11:sp3 | 11:sp4 | 12","eol":null,"hubHref":"/vendor/suse/linux_enterprise_software_development_kit"}],"affectedCount":36,"eol":{"hasEol":true,"count":3},"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1179262","label":"bugzilla.mozilla.org/show_bug.cgi?id=1179262","hostname":"bugzilla.mozilla.org","tags":["X Refsource CONFIRM","Issue Tracking"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html","label":"lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html","label":"lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Mailing List","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/76249","label":"www.securityfocus.com/bid/76249","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/37772/","label":"www.exploit-db.com/exploits/37772/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1581.html","label":"rhn.redhat.com/errata/RHSA-2015-1581.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201512-10","label":"security.gentoo.org/glsa/201512-10","hostname":"security.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html","label":"lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Mailing List","Third Party Advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2707-1","label":"www.ubuntu.com/usn/USN-2707-1","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","label":"www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","hostname":"www.oracle.com","tags":["X Refsource CONFIRM","Patch","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html","label":"lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Mailing List","Third Party Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1178058","label":"bugzilla.mozilla.org/show_bug.cgi?id=1178058","hostname":"bugzilla.mozilla.org","tags":["X Refsource CONFIRM","Issue Tracking"]},{"url":"https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/","label":"blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/","hostname":"blog.mozilla.org","tags":["X Refsource CONFIRM","Issue Tracking","Vendor Advisory","ARTICLE"]},{"url":"http://www.mozilla.org/security/announce/2015/mfsa2015-78.html","label":"www.mozilla.org/security/announce/2015/mfsa2015-78.html","hostname":"www.mozilla.org","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://www.securitytracker.com/id/1033216","label":"www.securitytracker.com/id/1033216","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html","label":"lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html","label":"lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Mailing List","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4495","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4495","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]},{"url":"https://advisories.mageia.org/MGASA-2015-0305.html","label":"advisories.mageia.org/MGASA-2015-0305.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16550","label":"bugs.mageia.org/show_bug.cgi?id=16550","hostname":"bugs.mageia.org","tags":["REPORT"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2015-78/","label":"www.mozilla.org/en-US/security/advisories/mfsa2015-78/","hostname":"www.mozilla.org","tags":["Advisory","REPORT"]},{"url":"https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/","label":"www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/","hostname":"www.mozilla.org","tags":["WEB"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151379-1/","label":"www.suse.com/support/update/announcement/2015/suse-su-20151379-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/940918","label":"bugzilla.suse.com/940918","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4495","label":"www.suse.com/security/cve/CVE-2015-4495","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151380-1/","label":"www.suse.com/support/update/announcement/2015/suse-su-20151380-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1581","label":"access.redhat.com/errata/RHSA-2015:1581","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","label":"access.redhat.com/security/updates/classification/","hostname":"access.redhat.com","tags":["ARTICLE"]},{"url":"https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/#firefoxesr38.1.1","label":"www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/","hostname":"www.mozilla.org","tags":["ARTICLE"]},{"url":"https://access.redhat.com/articles/1563163","label":"access.redhat.com/articles/1563163","hostname":"access.redhat.com","tags":["ARTICLE"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1251318","label":"bugzilla.redhat.com/show_bug.cgi?id=1251318","hostname":"bugzilla.redhat.com","tags":["REPORT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1581.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1581.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-4495","label":"access.redhat.com/security/cve/CVE-2015-4495","hostname":"access.redhat.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-4495","label":"www.cve.org/CVERecord?id=CVE-2015-4495","hostname":"www.cve.org","tags":["Advisory","REPORT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-4495","label":"nvd.nist.gov/vuln/detail/CVE-2015-4495","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://www.mozilla.org/security/announce/2015/mfsa2015-78.html","label":"www.mozilla.org/security/announce/2015/mfsa2015-78.html","hostname":"www.mozilla.org","tags":["ARTICLE"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog","hostname":"www.cisa.gov","tags":["ARTICLE","REPORT"]},{"url":"https://ubuntu.com/security/CVE-2015-4495","label":"ubuntu.com/security/CVE-2015-4495","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-2707-1","label":"ubuntu.com/security/notices/USN-2707-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-4495","label":"security-tracker.debian.org/tracker/CVE-2015-4495","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2024:10071-1","OPENSUSE-SU-2024:14572-1","SUSE-SU-2015:1449-1","SUSE-SU-2015:1476-1","SUSE-SU-2015:1528-1"],"duplicates":[],"related":["OPENSUSE-SU-2024:10071-1","OPENSUSE-SU-2024:14572-1","SUSE-SU-2015:1449-1","SUSE-SU-2015:1476-1","SUSE-SU-2015:1528-1"]},"timeline":[{"kind":"published","date":"2015-08-08T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-05-25T00:00:00.000Z","label":"Added to CISA KEV","detail":"Mozilla Firefox Security Feature Bypass Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-06-15T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:55:58.479Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T21:21:32.588Z","stale":false,"partial":false}}