Cloudanix VulnDB

CVE-2015-0819

None

CVSS

—

EPSS

2.7%

Published

Feb 25, 2015

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A browser flaw lets attackers make users click or see things they did not intend by bypassing checks on which tab is active.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Data Tampering
Component
Application
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The UITour::onPageEvent function does not validate that API calls originate from a foreground tab, allowing background tabs to invoke UI Tour functionality.

Why it matters to the business

Attackers can perform clickjacking and spoofing against browser users, leading to unintended user actions or interface manipulation with minimal user awareness.

How an attack unfolds

An attacker hosts a site that uses the UI Tour API; when the tab is not foreground or via timing manipulation, the missing check allows spoofed UI elements or forced interactions to trick the user.

How to fix it

Upgrade affected Firefox installations to version 36.0 or later. For Debian and Ubuntu systems using libksba, apply the listed fixed package versions such as 1.3.3-1 or 1.3.0-3ubuntu0.14.04.2.

How to confirm the fix worked

Confirm browser version is at least 36.0; verify package versions match the fixed releases on Debian/Ubuntu systems and test that UI Tour calls from background tabs are rejected.

Typical attack path

  1. Attacker crafts a malicious website using UITour API calls
  2. Victim opens the page, possibly in a background tab
  3. Page invokes onPageEvent without foreground validation
  4. Browser performs UI actions enabling clickjacking or spoofing

How to detect it

Examine web server logs and browser history for visits to suspected UITour-abusing domains; review any reports of unexpected UI dialogs or tab behavior around 2015-era Firefox usage.

What your security team should do

  • Prioritize patching Firefox to 36.0+ on all endpoints due to age and potential for UI manipulation attacks
  • Update libksba packages on Debian 10-13 and Ubuntu 14.04 LTS to the specified fixed versions
  • Review web-facing applications for any reliance on legacy browser UI behaviors

The record

The UITour::onPageEvent function in Mozilla Firefox before 36.0 does not ensure that an API call originates from a foreground tab, which allows remote attackers to conduct spoofing and clickjacking attacks by leveraging access to a UI Tour web site.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:14.04:LTS firefox 0 36.0+build2-0ubuntu0.14.04.4
openSUSE:Tumbleweed MozillaFirefox 0 50.1.0-1.1
openSUSE:Tumbleweed firefox-esr 0 128.5.1-1.1

Related vulnerabilities