Mozilla Firefox Security Feature Bypass Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-05-25
• EPSS: 69% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

CISA: Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 15 Jun 2022): Apply updates per vendor instructions.

• Patch on oracle.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.htmlMailing ListThird Party Advisory
• lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.htmlMailing ListThird Party Advisory
• lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.htmlMailing ListThird Party Advisory
• lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.htmlMailing ListThird Party Advisory
• lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.htmlMailing ListThird Party Advisory
• lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.htmlMailing ListThird Party Advisory
• rhn.redhat.com/errata/RHSA-2015-1581.htmlThird Party Advisory
• www.mozilla.org/security/announce/2015/mfsa2015-78.htmlVendor Advisory
• www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlPatchThird Party Advisory
• www.securityfocus.com/bid/76249Broken LinkThird Party AdvisoryVDB Entry
• www.securitytracker.com/id/1033216Broken LinkThird Party AdvisoryVDB Entry
• www.ubuntu.com/usn/USN-2707-1Third Party Advisory
• blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wildIssue TrackingVendor Advisory
• bugzilla.mozilla.org/show_bug.cgiIssue Tracking
• bugzilla.mozilla.org/show_bug.cgiIssue Tracking
• security.gentoo.org/glsa/201512-10Third Party Advisory
• www.exploit-db.com/exploits/37772ExploitThird Party AdvisoryVDB Entry
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource