Live › vulnerability › CVE-2015-4495
Go to dashboardMozilla Firefox has a security feature bypass that lets a remote attacker get around the Same Origin Policy to read arbitrary local files or gain privileges. It is listed in CISA's known-exploited catalog, so attacks have been seen in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| mozilla firefox | vendor | < 39.0.3 | 39.0.3 |
| mozilla firefox | vendor | >= 38.0, < 38.1.1 | 38.1.1 |
| mozilla firefox os | vendor | < 2.2 | 2.2 |
| oracle solaris | vendor | = 11.3 | – |
| canonical ubuntu linux | vendor | = 12.04 | – |
| canonical ubuntu linux | vendor | = 14.04 | – |
| canonical ubuntu linux | vendor | = 15.04 | – |
| redhat enterprise linux desktop | vendor | = 5.0 | – |
| redhat enterprise linux desktop | vendor | = 6.0 | – |
| redhat enterprise linux desktop | vendor | = 7.0 | – |
| redhat enterprise linux eus | vendor | = 6.7 | – |
| redhat enterprise linux eus | vendor | = 7.1 | – |
| redhat enterprise linux eus | vendor | = 7.2 | – |
| redhat enterprise linux eus | vendor | = 7.3 | – |
| redhat enterprise linux eus | vendor | = 7.4 | – |
| redhat enterprise linux eus | vendor | = 7.5 | – |
| redhat enterprise linux eus | vendor | = 7.6 | – |
| redhat enterprise linux eus | vendor | = 7.7 | – |
| redhat enterprise linux server | vendor | = 5.0 | – |
| redhat enterprise linux server | vendor | = 6.0 | – |
| redhat enterprise linux server | vendor | = 7.0 | – |
| redhat enterprise linux server aus | vendor | = 7.3 | – |
| redhat enterprise linux server aus | vendor | = 7.4 | – |
| redhat enterprise linux server aus | vendor | = 7.6 | – |
| redhat enterprise linux server aus | vendor | = 7.7 | – |
| redhat enterprise linux server tus | vendor | = 7.3 | – |
| redhat enterprise linux server tus | vendor | = 7.6 | – |
| redhat enterprise linux server tus | vendor | = 7.7 | – |
| redhat enterprise linux workstation | vendor | = 5.0 | – |
| redhat enterprise linux workstation | vendor | = 6.0 | – |
| redhat enterprise linux workstation | vendor | = 7.0 | – |
| suse linux enterprise debuginfo | vendor | = 11 | – |
| opensuse | vendor | = 13.1 | – |
| opensuse | vendor | = 13.2 | – |
| suse linux enterprise desktop | vendor | = 11 | – |
| suse linux enterprise desktop | vendor | = 12 | – |
| suse linux enterprise server | vendor | = 11 | – |
| suse linux enterprise server | vendor | = 12 | – |
| suse linux enterprise software development kit | vendor | = 11 | – |
| suse linux enterprise software development kit | vendor | = 12 | – |
| Mozilla Firefox | vendor | – | – |
Check the installed Firefox version (Help > About Firefox) against the fixed release in Mozilla's advisory; unknown from the sources which versions are affected.
Update Firefox to the latest release per Mozilla's vendor instructions (CISA required action: apply updates).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.
This page as .md · .json · in your agent: get_signal("CVE-2015-4495")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.