CVE-2015-0802
NoneCVSS
—
EPSS
65.9%
Published
Apr 1, 2015
CISA due date
—
The record
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:4 | iceape | 0 | 2.35-1.mga4 |
| Mageia:5 | iceape | 0 | 2.35-1.mga5 |
| Ubuntu:14.04:LTS | firefox | 0 | 37.0+build2-0ubuntu0.14.04.1 |
| openSUSE:Tumbleweed | MozillaFirefox | 0 | 50.1.0-1.1 |
| openSUSE:Tumbleweed | firefox-esr | 0 | 128.5.1-1.1 |
Related vulnerabilities
- CVE-2015-2708 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before… Also affects iceape
- CVE-2015-2706 Race condition in the AsyncPaintWaitEvent::AsyncPaintWaitEvent function in Mozilla… Also affects iceape
- CVE-2015-0799 The HTTP Alternative Services feature in Mozilla Firefox before 37.0.1 allows… Also affects iceape
- CVE-2015-0816 Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do… Also affects iceape
- CVE-2015-0801 Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6… Also affects iceape
- CVE-2015-0817 The asm.js implementation in Mozilla Firefox before 36.0.3, Firefox ESR 31.x before… Also affects iceape
- CVE-2015-0822 The Form Autocompletion feature in Mozilla Firefox before 36.0, Firefox ESR 31.x before… Also affects iceape
- CVE-2014-8636 The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32… Also affects iceape