Every CVE Search/ Get API key

CVE-2015-4495

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS...

8.8 HighIn KEVPublic exploitFix available

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

68.6%Down 23.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 8.8

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

Record
CVE-2015-4495
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-346
Updated
2026-11-02
CVE List 8.8

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

Record
CVE-2015-4495
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-346
Updated
2026-11-02
EUVDEUVD-2015-4515 8.8

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

Record
EUVD-2015-4515
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-cpx9-g67g-v8c5 8.8

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS...

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

Record
GHSA-cpx9-g67g-v8c5
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-200, CWE-346
Updated
2026-11-02
CISA KEV No score

Mozilla Firefox Security Feature Bypass Vulnerability

Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.

Record
CVE-2015-4495
Weakness
CWE-200
Updated
2026-11-02
OSV 8.8

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

Record
CVE-2015-4495
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 11 moreShow less
OSVDEBIAN-CVE-2015-4495 8.8

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

Record
DEBIAN-CVE-2015-4495
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2015-4495 8.8

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

Record
UBUNTU-CVE-2015-4495
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2015-0305 No score

Updated firefox package fixes CVE-2015-4495

Updated firefox packages fix security vulnerability:

Security researcher Cody Crews reported on a way to violate the same origin policy and inject script into a non-privileged part of the built-in PDF Viewer in Firefox. This would allow an attacker to read and steal sensitive local files on the victim's computer (CVE-2015-4495).

Record
MGASA-2015-0305
Updated
2026-11-02
OSVopenSUSE-SU-2024:10071-1 No score

MozillaFirefox-50.1.0-1.1 on GA media

These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10071-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02
OSVSUSE-SU-2015:1379-1 No score

Security update for MozillaFirefox

This security update (bsc#940918) fixes the following issues:

  • MFSA 2015-78: (CVE-2015-4495, bmo#1178058): Same origin violation
  • Remove PlayPreview registration from PDF Viewer (bmo#1179262)
Record
SUSE-SU-2015:1379-1
Updated
2026-11-02
OSVSUSE-SU-2015:1380-1 No score

Security update for MozillaFirefox

This security update (bsc#940918) fixes the following issues:

  • MFSA 2015-78 (CVE-2015-4495, bmo#1178058): Same origin violation
  • Remove PlayPreview registration from PDF Viewer (bmo#1179262)
Record
SUSE-SU-2015:1380-1
Updated
2026-11-02
OSVSUSE-SU-2015:1449-1 No score

Security update for MozillaFirefox, mozilla-nss

Mozilla Firefox is being updated to the current Firefox 38ESR branch (specifically the 38.2.0ESR release).

Security issues fixed:

  • MFSA 2015-78 / CVE-2015-4495: Same origin violation and local file stealing via PDF reader
  • MFSA 2015-79 / CVE-2015-4473/CVE-2015-4474: Miscellaneous memory safety hazards (rv:40.0 / rv:38.2)
  • MFSA 2015-80 / CVE-2015-4475: Out-of-bounds read with malformed MP3 file
  • MFSA 2015-82 / CVE-2015-4478: Redefinition of non-configurable JavaScript object properties
  • MFSA 2015-83 / CVE-2015-4479: Overflow issues in libstagefright
  • MFSA 2015-87 / CVE-2015-4484: Crash when using shared memory in JavaScript
  • MFSA 2015-88 / CVE-2015-4491: Heap overflow in gdk-pixbuf when scaling bitmap images
  • MFSA 2015-89 / CVE-2015-4485/CVE-2015-4486: Buffer overflows on Libvpx when decoding WebM video
  • MFSA 2015-90 / CVE-2015-4487/CVE-2015-4488/CVE-2015-4489: Vulnerabilities found through code inspection
  • MFSA 2015-92 / CVE-2015-4492: Use-after-free in XMLHttpRequest with shared workers

The following vulnerabilities were fixed in ESR31 and are also included here:

  • CVE-2015-2724/CVE-2015-2725/CVE-2015-2726: Miscellaneous memory safety hazards (bsc#935979).
  • CVE-2015-2728: Type confusion in Indexed Database Manager (bsc#935979).
  • CVE-2015-2730: ECDSA signature validation fails to handle some signatures correctly (bsc#935979).
  • CVE-2015-2722/CVE-2015-2733: Use-after-free in workers while using XMLHttpRequest (bsc#935979).
  • CVE-2015-2734/CVE-2015-2735/CVE-2015-2736/CVE-2015-2737/CVE-2015-2738/CVE-2015-2739/CVE-2015-2740: Vulnerabilities found through code inspection (bsc#935979).
  • CVE-2015-2743: Privilege escalation in PDF.js (bsc#935979).
  • CVE-2015-4000: NSS accepts export-length DHE keys with regular DHE cipher suites (bsc#935033).
  • CVE-2015-2721: NSS incorrectly permits skipping of ServerKeyExchange (bsc#935979).

This update also contains a lot of feature improvements and bug fixes from 31ESR to 38ESR.

Also the Mozilla NSS library switched its CKBI API from 1.98 to 2.4, which is what Firefox 38ESR uses.

Mozilla Firefox and mozilla-nss were updated to fix 17 security issues.

Record
SUSE-SU-2015:1449-1
Updated
2026-11-02
OSVSUSE-SU-2015:1476-1 No score

Security update for MozillaFirefox, mozilla-nss

Mozilla Firefox was updated to version 38.2.1 ESR to fix several critical and non critical security vulnerabilities.

  • Firefox was updated to 38.2.1 ESR (bsc#943608)

    • MFSA 2015-94/CVE-2015-4497 (bsc#943557) Use-after-free when resizing canvas element during restyling
    • MFSA 2015-95/CVE-2015-4498 (bsc#943558) Add-on notification bypass through data URLs

  • Firefox was updated to 38.2.0 ESR (bsc#940806)

    • MFSA 2015-78/CVE-2015-4495 (bmo#1178058, bmo#1179262) Same origin violation and local file stealing via PDF reader
    • MFSA 2015-79/CVE-2015-4473/CVE-2015-4474 (bmo#1143130, bmo#1161719, bmo#1177501, bmo#1181204, bmo#1184068, bmo#1188590, bmo#1146213, bmo#1178890, bmo#1182711) Miscellaneous memory safety hazards (rv:40.0 / rv:38.2)
    • MFSA 2015-80/CVE-2015-4475 (bmo#1175396) Out-of-bounds read with malformed MP3 file
    • MFSA 2015-82/CVE-2015-4478 (bmo#1105914) Redefinition of non-configurable JavaScript object properties
    • MFSA 2015-83/CVE-2015-4479 (bmo#1185115, bmo#1144107, bmo#1170344, bmo#1186718) Overflow issues in libstagefright
    • MFSA 2015-87/CVE-2015-4484 (bmo#1171540) Crash when using shared memory in JavaScript
    • MFSA 2015-88/CVE-2015-4491 (bmo#1184009) Heap overflow in gdk-pixbuf when scaling bitmap images
    • MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948, bmo#1178148) Buffer overflows on Libvpx when decoding WebM video
    • MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489 (bmo#1176270, bmo#1182723, bmo#1171603) Vulnerabilities found through code inspection
    • MFSA 2015-92/CVE-2015-4492 (bmo#1185820) Use-after-free in XMLHttpRequest with shared workers

Mozilla NSS switched the CKBI ABI from 1.98 to 2.4, which is what Firefox 38ESR uses.

Record
SUSE-SU-2015:1476-1
Updated
2026-11-02
OSVSUSE-SU-2015:1528-1 No score

Security update for MozillaFirefox, mozilla-nss

Mozilla Firefox is being updated to the current Firefox 38ESR branch (specifically the 38.2.0ESR release).

Security issues fixed:

  • MFSA 2015-78 / CVE-2015-4495: Same origin violation and local file stealing via PDF reader
  • MFSA 2015-79 / CVE-2015-4473/CVE-2015-4474: Miscellaneous memory safety hazards (rv:40.0 / rv:38.2)
  • MFSA 2015-80 / CVE-2015-4475: Out-of-bounds read with malformed MP3 file
  • MFSA 2015-82 / CVE-2015-4478: Redefinition of non-configurable JavaScript object properties
  • MFSA 2015-83 / CVE-2015-4479: Overflow issues in libstagefright
  • MFSA 2015-87 / CVE-2015-4484: Crash when using shared memory in JavaScript
  • MFSA 2015-88 / CVE-2015-4491: Heap overflow in gdk-pixbuf when scaling bitmap images
  • MFSA 2015-89 / CVE-2015-4485/CVE-2015-4486: Buffer overflows on Libvpx when decoding WebM video
  • MFSA 2015-90 / CVE-2015-4487/CVE-2015-4488/CVE-2015-4489: Vulnerabilities found through code inspection
  • MFSA 2015-92 / CVE-2015-4492: Use-after-free in XMLHttpRequest with shared workers

This update also contains a lot of feature improvements and bug fixes from 31ESR to 38ESR.

Also the Mozilla NSS library switched its CKBI API from 1.98 to 2.4, which is what Firefox 38ESR uses.

Record
SUSE-SU-2015:1528-1
Updated
2026-11-02
OSVUSN-2707-1 No score

firefox vulnerability

Cody Crews discovered a way to violate the same-origin policy to inject script in to a non-privileged part of the PDF viewer. If a user were tricked in to opening a specially crafted website, an attacker could exploit this to read sensitive information from local files. (CVE-2015-4495)

Record
USN-2707-1
Updated
2026-11-02

Affected products

Show 3 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
pdf.js
Debian:12
 before 1.1.366+dfsg-1
1.1.366+dfsg-1
pdf.js
Debian:13
 before 1.1.366+dfsg-1
1.1.366+dfsg-1
pdf.js
Debian:14
 before 1.1.366+dfsg-1
1.1.366+dfsg-1
firefox
Mageia:4
 before 38.1.1-1.mga4
38.1.1-1.mga4
firefox-l10n
Mageia:4
 before 38.1.1-1.mga4
38.1.1-1.mga4
firefox
Mageia:5
 before 38.1.1-1.mga5
38.1.1-1.mga5
firefox-l10n
Mageia:5
 before 38.1.1-1.mga5
38.1.1-1.mga5
firefox
Red Hat:enterprise_linux:5::client
 before 0:38.1.1-1.el5_11
0:38.1.1-1.el5_11
firefox-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:38.1.1-1.el5_11
0:38.1.1-1.el5_11
firefox
Red Hat:enterprise_linux:5::server
 before 0:38.1.1-1.el5_11
0:38.1.1-1.el5_11
Show 79 moreShow less
Affected packages
PackageAffectedFixed
firefox-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:38.1.1-1.el5_11
0:38.1.1-1.el5_11
firefox
Red Hat:enterprise_linux:6::client
 before 0:38.1.1-1.el6_7
0:38.1.1-1.el6_7
firefox-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:38.1.1-1.el6_7
0:38.1.1-1.el6_7
firefox
Red Hat:enterprise_linux:6::computenode
 before 0:38.1.1-1.el6_7
0:38.1.1-1.el6_7
firefox-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:38.1.1-1.el6_7
0:38.1.1-1.el6_7
firefox
Red Hat:enterprise_linux:6::server
 before 0:38.1.1-1.el6_7
0:38.1.1-1.el6_7
firefox-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:38.1.1-1.el6_7
0:38.1.1-1.el6_7
firefox
Red Hat:enterprise_linux:6::workstation
 before 0:38.1.1-1.el6_7
0:38.1.1-1.el6_7
firefox-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:38.1.1-1.el6_7
0:38.1.1-1.el6_7
firefox
Red Hat:enterprise_linux:7::client
 before 0:38.1.1-1.el7_1
0:38.1.1-1.el7_1
firefox-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:38.1.1-1.el7_1
0:38.1.1-1.el7_1
firefox
Red Hat:enterprise_linux:7::server
 before 0:38.1.1-1.el7_1
0:38.1.1-1.el7_1
firefox-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:38.1.1-1.el7_1
0:38.1.1-1.el7_1
firefox
Red Hat:enterprise_linux:7::workstation
 before 0:38.1.1-1.el7_1
0:38.1.1-1.el7_1
firefox-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:38.1.1-1.el7_1
0:38.1.1-1.el7_1
MozillaFirefox
SUSE:Linux Enterprise Desktop 12
 before 31.8.0esr-40.1
31.8.0esr-40.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12
 before 31.8.0esr-40.1
31.8.0esr-40.1
MozillaFirefox
SUSE:Linux Enterprise Server 12
 before 31.8.0esr-40.1
31.8.0esr-40.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12
 before 31.8.0esr-40.1
31.8.0esr-40.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 11 SP3
 before 31.8.0esr-0.13.2
31.8.0esr-0.13.2
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 11 SP4
 before 31.8.0esr-0.13.2
31.8.0esr-0.13.2
MozillaFirefox
SUSE:Linux Enterprise Desktop 11 SP3
 before 31.8.0esr-0.13.2
31.8.0esr-0.13.2
MozillaFirefox
SUSE:Linux Enterprise Desktop 11 SP4
 before 31.8.0esr-0.13.2
31.8.0esr-0.13.2
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP3
 before 31.8.0esr-0.13.2
31.8.0esr-0.13.2
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP3-TERADATA
 before 31.8.0esr-0.13.2
31.8.0esr-0.13.2
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 11 SP3
 before 31.8.0esr-0.13.2
31.8.0esr-0.13.2
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP4
 before 31.8.0esr-0.13.2
31.8.0esr-0.13.2
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 31.8.0esr-0.13.2
31.8.0esr-0.13.2
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP1-LTSS
From an advisory covering 31 CVEs
 before 38.2.0esr-10.1
38.2.0esr-10.1
MozillaFirefox-branding-SLED
SUSE:Linux Enterprise Server 11 SP1-LTSS
From an advisory covering 31 CVEs
 before 31.0-0.5.7.11
31.0-0.5.7.11
firefox-gcc47
SUSE:Linux Enterprise Server 11 SP1-LTSS
From an advisory covering 31 CVEs
 before 4.7.2_20130108-0.37.2
4.7.2_20130108-0.37.2
mozilla-nss
SUSE:Linux Enterprise Server 11 SP1-LTSS
From an advisory covering 31 CVEs
 before 3.19.2.0-0.7.1
3.19.2.0-0.7.1
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP1-TERADATA
From an advisory covering 31 CVEs
 before 38.2.0esr-10.1
38.2.0esr-10.1
MozillaFirefox-branding-SLED
SUSE:Linux Enterprise Server 11 SP1-TERADATA
From an advisory covering 31 CVEs
 before 31.0-0.5.7.11
31.0-0.5.7.11
firefox-gcc47
SUSE:Linux Enterprise Server 11 SP1-TERADATA
From an advisory covering 31 CVEs
 before 4.7.2_20130108-0.37.2
4.7.2_20130108-0.37.2
mozilla-nss
SUSE:Linux Enterprise Server 11 SP1-TERADATA
From an advisory covering 31 CVEs
 before 3.19.2.0-0.7.1
3.19.2.0-0.7.1
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP2-LTSS
From an advisory covering 31 CVEs
 before 38.2.0esr-10.1
38.2.0esr-10.1
MozillaFirefox-branding-SLED
SUSE:Linux Enterprise Server 11 SP2-LTSS
From an advisory covering 31 CVEs
 before 31.0-0.5.7.11
31.0-0.5.7.11
firefox-gcc47
SUSE:Linux Enterprise Server 11 SP2-LTSS
From an advisory covering 31 CVEs
 before 4.7.2_20130108-0.37.2
4.7.2_20130108-0.37.2
mozilla-nss
SUSE:Linux Enterprise Server 11 SP2-LTSS
From an advisory covering 31 CVEs
 before 3.19.2.0-0.7.1
3.19.2.0-0.7.1
MozillaFirefox
SUSE:Linux Enterprise Desktop 12
From an advisory covering 16 CVEs
 before 38.2.1esr-45.1
38.2.1esr-45.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Desktop 12
From an advisory covering 16 CVEs
 before 31.0-14.1
31.0-14.1
mozilla-nss
SUSE:Linux Enterprise Desktop 12
From an advisory covering 16 CVEs
 before 3.19.2.0-26.2
3.19.2.0-26.2
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12
From an advisory covering 16 CVEs
 before 38.2.1esr-45.1
38.2.1esr-45.1
mozilla-nss
SUSE:Linux Enterprise Software Development Kit 12
From an advisory covering 16 CVEs
 before 3.19.2.0-26.2
3.19.2.0-26.2
MozillaFirefox
SUSE:Linux Enterprise Server 12
From an advisory covering 16 CVEs
 before 38.2.1esr-45.1
38.2.1esr-45.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12
From an advisory covering 16 CVEs
 before 31.0-14.1
31.0-14.1
mozilla-nss
SUSE:Linux Enterprise Server 12
From an advisory covering 16 CVEs
 before 3.19.2.0-26.2
3.19.2.0-26.2
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 16 CVEs
 before 38.2.1esr-45.1
38.2.1esr-45.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 16 CVEs
 before 31.0-14.1
31.0-14.1
mozilla-nss
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 16 CVEs
 before 3.19.2.0-26.2
3.19.2.0-26.2
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 11 SP3
From an advisory covering 14 CVEs
 before 38.2.1esr-19.3
38.2.1esr-19.3
mozilla-nss
SUSE:Linux Enterprise Software Development Kit 11 SP3
From an advisory covering 14 CVEs
 before 3.19.2.0-0.16.1
3.19.2.0-0.16.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 11 SP4
From an advisory covering 14 CVEs
 before 38.2.1esr-19.3
38.2.1esr-19.3
mozilla-nss
SUSE:Linux Enterprise Software Development Kit 11 SP4
From an advisory covering 14 CVEs
 before 3.19.2.0-0.16.1
3.19.2.0-0.16.1
MozillaFirefox
SUSE:Linux Enterprise Desktop 11 SP3
From an advisory covering 14 CVEs
 before 38.2.1esr-19.3
38.2.1esr-19.3
MozillaFirefox-branding-SLED
SUSE:Linux Enterprise Desktop 11 SP3
From an advisory covering 14 CVEs
 before 31.0-0.12.51
31.0-0.12.51
mozilla-nss
SUSE:Linux Enterprise Desktop 11 SP3
From an advisory covering 14 CVEs
 before 3.19.2.0-0.16.1
3.19.2.0-0.16.1
MozillaFirefox
SUSE:Linux Enterprise Desktop 11 SP4
From an advisory covering 14 CVEs
 before 38.2.1esr-19.3
38.2.1esr-19.3
MozillaFirefox-branding-SLED
SUSE:Linux Enterprise Desktop 11 SP4
From an advisory covering 14 CVEs
 before 31.0-0.12.51
31.0-0.12.51
mozilla-nss
SUSE:Linux Enterprise Desktop 11 SP4
From an advisory covering 14 CVEs
 before 3.19.2.0-0.16.1
3.19.2.0-0.16.1
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP3
From an advisory covering 14 CVEs
 before 38.2.1esr-19.3
38.2.1esr-19.3
MozillaFirefox-branding-SLED
SUSE:Linux Enterprise Server 11 SP3
From an advisory covering 14 CVEs
 before 31.0-0.12.51
31.0-0.12.51
mozilla-nss
SUSE:Linux Enterprise Server 11 SP3
From an advisory covering 14 CVEs
 before 3.19.2.0-0.16.1
3.19.2.0-0.16.1
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP3-TERADATA
From an advisory covering 14 CVEs
 before 38.2.1esr-19.3
38.2.1esr-19.3
MozillaFirefox-branding-SLED
SUSE:Linux Enterprise Server 11 SP3-TERADATA
From an advisory covering 14 CVEs
 before 31.0-0.12.51
31.0-0.12.51
mozilla-nss
SUSE:Linux Enterprise Server 11 SP3-TERADATA
From an advisory covering 14 CVEs
 before 3.19.2.0-0.16.1
3.19.2.0-0.16.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 11 SP3
From an advisory covering 14 CVEs
 before 38.2.1esr-19.3
38.2.1esr-19.3
MozillaFirefox-branding-SLED
SUSE:Linux Enterprise Server for SAP Applications 11 SP3
From an advisory covering 14 CVEs
 before 31.0-0.12.51
31.0-0.12.51
mozilla-nss
SUSE:Linux Enterprise Server for SAP Applications 11 SP3
From an advisory covering 14 CVEs
 before 3.19.2.0-0.16.1
3.19.2.0-0.16.1
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 14 CVEs
 before 38.2.1esr-19.3
38.2.1esr-19.3
MozillaFirefox-branding-SLED
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 14 CVEs
 before 31.0-0.12.51
31.0-0.12.51
mozilla-nss
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 14 CVEs
 before 3.19.2.0-0.16.1
3.19.2.0-0.16.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 14 CVEs
 before 38.2.1esr-19.3
38.2.1esr-19.3
MozillaFirefox-branding-SLED
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 14 CVEs
 before 31.0-0.12.51
31.0-0.12.51
mozilla-nss
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 14 CVEs
 before 3.19.2.0-0.16.1
3.19.2.0-0.16.1
firefox
Ubuntu:14.04:LTS
 before 39.0.3+build2-0ubuntu0.14.04.1, plus listed versions
24.0+build1-0ubuntu125.0+build3-0ubuntu0.13.10.128.0~b2+build1-0ubuntu228.0+build1-0ubuntu128.0+build2-0ubuntu1
Show 18 moreShow less
28.0+build2-0ubuntu229.0+build1-0ubuntu0.14.04.230.0+build1-0ubuntu0.14.04.331.0+build1-0ubuntu0.14.04.132.0+build1-0ubuntu0.14.04.132.0.3+build1-0ubuntu0.14.04.133.0+build2-0ubuntu0.14.04.134.0+build2-0ubuntu0.14.04.135.0+build3-0ubuntu0.14.04.235.0.1+build1-0ubuntu0.14.04.136.0+build2-0ubuntu0.14.04.436.0.1+build2-0ubuntu0.14.04.136.0.4+build1-0ubuntu0.14.04.137.0+build2-0ubuntu0.14.04.137.0.1+build1-0ubuntu0.14.04.137.0.2+build1-0ubuntu0.14.04.138.0+build3-0ubuntu0.14.04.139.0+build5-0ubuntu0.14.04.1
39.0.3+build2-0ubuntu0.14.04.1
MozillaFirefox
openSUSE:Tumbleweed
From an advisory covering 899 CVEs
 before 50.1.0-1.1
50.1.0-1.1
firefox-esr
openSUSE:Tumbleweed
From an advisory covering 1860 CVEs
 before 128.5.1-1.1
128.5.1-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubvincd/CVE-2015-44952015-08-10
Exploit-DBMozilla Firefox < 39.03 - 'pdf.js' Same Origin Policy2015-08-15
MetasploitFirefox PDF.js Browser File Theft

History

History
RecordedChangedSources
affected
exploitation, exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-4495 is a high vulnerability (CVSS 8.8) in Mozilla Firefox, published August 7, 2015. CISA lists it as known to be exploited, since May 25, 2022. EUVD reports exploitation since May 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 68.6%, the 99th percentile. Fixed in pdf.js 1.1.366+dfsg-1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,902 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open