CVE-2015-4481
Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR...
Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update.
Exploit likelihood
What each source reports
NVD Score used
Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update.
- Record
CVE-2015-4481- CVSS 2.0
- 3.3 Low
AV:L/AC:M/Au:N/C:N/I:P/A:P - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update.
- Record
CVE-2015-4481- Updated
- 2026-11-02
EUVDEUVD-2015-4501 No score
Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update.
- Record
EUVD-2015-4501- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fpjx-8wc2-5w5g No score
Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR...
Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update.
- Record
GHSA-fpjx-8wc2-5w5g- Weakness
- CWE-362
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10071-1 No score
MozillaFirefox-50.1.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10071-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10230-1 No score
MozillaThunderbird-45.5.1-1.1 on GA media
These are all security issues fixed in the MozillaThunderbird-45.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10230-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 899 CVEs |
before 50.1.0-1.1 | 50.1.0-1.1 |
MozillaThunderbirdopenSUSE:Tumbleweed From an advisory covering 560 CVEs |
before 45.5.1-1.1 | 45.5.1-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 1860 CVEs |
before 128.5.1-1.1 | 128.5.1-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Mozilla - Maintenance Service Log File Overwrite Privilege Escalation | 2015-08-21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-4481 is a low vulnerability (CVSS 3.3) in Mozilla Firefox, published August 16, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 56th percentile. No source names a fixed version.
References
bugzilla.mozilla.org/show_bug.cgi?id=1171518
lists.opensuse.org/opensuse-updates/2015-08/msg00031.html
mozilla.org/security/announce/2015/mfsa2015-84.html
exploit-db.com/exploits/37925
Show 194 moreShow less
oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
securitytracker.com/id/1033247
security.gentoo.org/glsa/201605-06
nvd.nist.gov/vuln/detail/CVE-2015-4481
github.com/advisories/GHSA-fpjx-8wc2-5w5g
suse.com/security/cve/CVE-2008-5913
Left out here: 1,893 references. The JSON record has them.