CVE-2015-4495
Mozilla Firefox Security Feature Bypass Vulnerability
Description
CVE-2015-4495 is a Same Origin Policy bypass vulnerability in Mozilla Firefox that allows remote attackers to read arbitrary files or gain elevated privileges on the affected system. The vulnerability exists in Firefox's built-in PDF viewer (PDF.js), where a flaw in the interaction between the PDF viewer and the browser's privileged JavaScript context enables an attacker to bypass the Same Origin Policy and access local files. This Mozilla Firefox vulnerability can be exploited through a specially crafted web page containing a malicious PDF. CISA has listed CVE-2015-4495 in the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, and its EPSS percentile of 98.7% indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| mozilla | firefox | < 39.0.3; >= 38.0, < 38.1.1 |
| mozilla | firefox os | < 2.2 |
| oracle | solaris | 11.3 |
| canonical | ubuntu linux | 12.04; 14.04; 15.04 |
| redhat | enterprise linux desktop | 5.0; 6.0; 7.0 |
| redhat | enterprise linux eus | 6.7; 7.1; 7.2; 7.3; 7.4; 7.5; 7.6; 7.7 |
| redhat | enterprise linux server | 5.0; 6.0; 7.0 |
| redhat | enterprise linux server aus | 7.3; 7.4; 7.6; 7.7 |
| redhat | enterprise linux server tus | 7.3; 7.6; 7.7 |
| redhat | enterprise linux workstation | 5.0; 6.0; 7.0 |
| suse | linux enterprise debuginfo | 11 |
| opensuse | opensuse | 13.1; 13.2 |
| suse | linux enterprise desktop | 11; 12 |
| suse | linux enterprise server | 11; 12 |
| suse | linux enterprise software development kit | 11; 12 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00009.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00010.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00016.html(Mailing List, Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2015-1581.html(Third Party Advisory)
- http://www.mozilla.org/security/announce/2015/mfsa2015-78.html(Vendor Advisory)
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html(Patch, Third Party Advisory)
- http://www.securityfocus.com/bid/76249(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1033216(Broken Link, Third Party Advisory, VDB Entry)
- http://www.ubuntu.com/usn/USN-2707-1(Third Party Advisory)
- https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/(Issue Tracking, Vendor Advisory)
- https://bugzilla.mozilla.org/show_bug.cgi?id=1178058(Issue Tracking)
- https://bugzilla.mozilla.org/show_bug.cgi?id=1179262(Issue Tracking)
- https://security.gentoo.org/glsa/201512-10(Third Party Advisory)
- https://www.exploit-db.com/exploits/37772/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4495(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2015-4495 in the NVD database. The vulnerability is a Same Origin Policy bypass in Mozilla Firefox's PDF.js viewer component. The Same Origin Policy is a fundamental browser security mechanism that prevents scripts from one origin from accessing data from another origin. In this case, the PDF.js viewer operates in a privileged context within Firefox, and the vulnerability allows malicious PDF content to escape this boundary and access local file system resources or execute privileged browser operations.
Learn more: CWE Overview
Impact Analysis
CVE-2015-4495 enables Same Origin Policy bypass in Mozilla Firefox, allowing attackers to read arbitrary files from the victim's local file system. The vulnerability is remotely exploitable through a malicious web page, requiring no authentication and only that a user visits the page with Firefox. Confidentiality (High): The most significant impact is on confidentiality. An attacker can read arbitrary files from the user's local file system, including SSH keys, configuration files, browser profile data (passwords, cookies, bookmarks), and any other file accessible to the current user. Integrity: The vulnerability was primarily exploited for data theft, though privilege escalation could potentially enable file modification. Availability: While the primary attack vector is data exfiltration, the gained access could be leveraged for further system manipulation. With an EPSS percentile of 98.7%, this vulnerability has a near-certain probability of active exploitation, with confirmed use in targeted attacks to steal sensitive files from victims' systems.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2015-4495 by listing it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of June 15, 2022. The EPSS percentile of 98.7% indicates near-certain exploitation activity. This vulnerability was exploited as a zero-day in the wild before Mozilla released a patch. The exploit was discovered being served through malicious advertisements on a news website, silently stealing local files from visitors using Firefox. The exploit specifically targeted SSH keys, configuration files, and other sensitive data from the victims' file systems, demonstrating sophisticated and targeted exploitation.
Remediation
- Apply updates per vendor instructions as required by the CISA KEV catalog. Update Mozilla Firefox to a version that patches CVE-2015-4495. Mozilla released an emergency fix in Firefox 39.0.3 and Firefox ESR 38.1.1.
- Ensure automatic updates are enabled for Firefox across the organization to receive security patches promptly. Establish policies that prevent users from running outdated browser versions.
- Disable the built-in PDF viewer (PDF.js) if it is not required, by setting
pdfjs.disabledtotruein Firefox'sabout:config. Use an external PDF reader for documents instead. - Deploy web content filtering to block known malvertising networks and malicious domains that were used to deliver the CVE-2015-4495 exploit through compromised advertisements.
- Audit sensitive files on systems that may have been exposed. If exploitation is suspected, rotate SSH keys, change passwords stored in browser profiles, and review file access logs for unauthorized reads of sensitive configuration files.
Technical Details
CVE-2015-4495 exploits a vulnerability in PDF.js, Mozilla Firefox's built-in PDF viewer implemented in JavaScript. The PDF viewer runs in a privileged context within the browser, with access to internal Firefox APIs that normal web content cannot reach. The vulnerability exists in the interaction between the PDF viewer's JavaScript code and the browser's chrome (privileged) JavaScript context. A specially crafted PDF document can leverage this flaw to execute JavaScript that escapes the PDF viewer's sandbox and gains access to the browser's privileged APIs. With these elevated capabilities, the exploit can read arbitrary files from the local file system using the browser's internal file access mechanisms. The Same Origin Policy, which normally prevents web content from accessing local files, is bypassed because the exploit operates within the trusted PDF.js context that has legitimate file reading capabilities for processing local PDF documents.
Frequently Asked Questions
Is CVE-2015-4495 being actively exploited?
Yes, CVE-2015-4495 was exploited as a zero-day in the wild. CISA confirmed its inclusion in the Known Exploited Vulnerabilities catalog. The EPSS percentile of 98.7% indicates near-certain exploitation activity. The exploit was discovered being served through malicious advertisements to steal local files from Firefox users.
What products are affected by CVE-2015-4495?
CVE-2015-4495 affects Mozilla Firefox through the built-in PDF.js viewer component. Firefox versions prior to 39.0.3 and ESR versions prior to 38.1.1 are vulnerable. The vulnerability exists in the browser's integrated PDF rendering functionality.
How do I fix CVE-2015-4495?
Update Firefox to version 39.0.3 or later (ESR 38.1.1 or later). Enable automatic updates to receive security patches promptly. As an additional mitigation, consider disabling the built-in PDF viewer by setting pdfjs.disabled to true in about:config.
How severe is CVE-2015-4495?
CVE-2015-4495 is a Same Origin Policy bypass vulnerability with an EPSS percentile of 98.7%. It allows attackers to read arbitrary files from the victim's local file system through a malicious web page. The confirmed zero-day exploitation and use in targeted data theft campaigns underscore its severity.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.