CVE-2015-0822

What it actually does

The Form Autocompletion feature allows remote attackers to read arbitrary local files via crafted JavaScript code.

Why it matters to the business

Attackers may access sensitive files on user systems, resulting in data exposure and privacy violations on outdated installations.

How an attack unfolds

An attacker crafts JavaScript that abuses form autocompletion to read and exfiltrate arbitrary files from the victim's machine when the page is visited.

How to fix it

Upgrade Mozilla Firefox to 36.0 or later, Firefox ESR to 31.5 or later, and Thunderbird to 31.5 or later. Apply the listed fixed package versions for libksba on Debian and Ubuntu systems.

How to confirm the fix worked

Verify installed browser and libksba versions match or exceed the fixed releases; test that autocompletion no longer permits file reads from crafted pages.

Typical attack path

1. Serve a malicious webpage containing crafted JavaScript
2. Victim browser loads the page and triggers autocompletion
3. JavaScript reads arbitrary local files
4. Exfiltrate file contents to attacker-controlled server

How to detect it

Review web proxy logs and browser history for visits to unexpected domains; inspect for JavaScript that interacts with file inputs or form autocompletion events.

What your security team should do

• Prioritize patching browsers and Thunderbird on all endpoints
• Scan for and remove outdated libksba packages matching the affected list
• Monitor for any remaining unpatched systems given the 2015 disclosure date