CVE-2015-0818
Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow...
Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving SVG hash navigation.
Exploit likelihood
What each source reports
NVD Score used
Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving SVG hash navigation.
- Record
CVE-2015-0818- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving SVG hash navigation.
- Record
CVE-2015-0818- Updated
- 2026-11-02
EUVDEUVD-2015-0831 No score
Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving SVG hash navigation.
- Record
EUVD-2015-0831- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rr7h-5qv5-g84f No score
Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow...
Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving SVG hash navigation.
- Record
GHSA-rr7h-5qv5-g84f- Updated
- 2026-11-02
OSVMGASA-2015-0115 No score
Updated firefox packages fix security vulnerabilities
A flaw was discovered in the implementation of typed array bounds checking in the Javascript just-in-time compilation. If a user were tricked in to opening a specially crafted website, an attacked could exploit this to execute arbitrary code with the privileges of the user invoking Firefox (CVE-2015-0817).
Mariusz Mlynski discovered a flaw in the processing of SVG format content navigation. If a user were tricked in to opening a specially crafted website, an attacker could exploit this to run arbitrary script in a privileged context (CVE-2015-0818).
The firefox package has been updated to version 31.5.3 to fix these issues.
Also, the nss package has been updated to version 3.18, which enables TLS and DTLS 1.2, increases the default RSA key size created by certutil to 2048 bits, and has some CA root certificate updates.
- Record
MGASA-2015-0115- Updated
- 2026-11-02
OSVMGASA-2015-0126 No score
Updated iceape packages fix security vulnerabilities
Updated iceape packages fix security issues:
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2015-0835)
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2015-0836)
Mozilla Firefox before 36.0 does not properly recognize the equivalence of domain names with and without a trailing . (dot) character, which allows man-in-the-middle attackers to bypass the HPKP and HSTS protection mechanisms by constructing a URL with this character and leveraging access to an X.509 certificate for a domain with this character. (CVE-2015-0832)
The WebGL implementation in Mozilla Firefox before 36.0 does not properly allocate memory for copying an unspecified string to a shader's compilation log, which allows remote attackers to cause a denial of service (application crash) via crafted WebGL content. (CVE-2015-0830)
Use-after-free vulnerability in the mozilla::dom::IndexedDB::IDBObjectStore::CreateIndex function in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted content that is improperly handled during IndexedDB index creation. (CVE-2015-0831)
Buffer overflow in libstagefright in Mozilla Firefox before 36.0 allows remote attackers to execute arbitrary code via a crafted MP4 video that is improperly handled during playback. (CVE-2015-0829)
Double free vulnerability in the nsXMLHttpRequest::GetResponse function in Mozilla Firefox before 36.0, when a nonstandard memory allocator is used, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted JavaScript code that makes an XMLHttpRequest call with zero bytes of data. (CVE-2015-0828)
Heap-based buffer overflow in the mozilla::gfx::CopyRect function in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to obtain sensitive information from uninitialized process memory via a malformed SVG graphic. (CVE-2015-0827)
The nsTransformedTextRun::SetCapitalization function in Mozilla Firefox before 36.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read of heap memory) via a crafted Cascading Style Sheets (CSS) token sequence that triggers a restyle or reflow operation. (CVE-2015-0826)
Stack-based buffer underflow in the mozilla::MP3FrameParser::ParseBuffer function in Mozilla Firefox before 36.0 allows remote attackers to obtain sensitive information from process memory via a malformed MP3 file that improperly interacts with memory allocation during playback. (CVE-2015-0825)
The mozilla::layers::BufferTextureClient::AllocateForSurface function in Mozilla Firefox before 36.0 allows remote attackers to cause a denial of service (out-of-bounds write of zero values, and application crash) via vectors that trigger use of DrawTarget and the Cairo library for image drawing. (CVE-2015-0824)
The Form Autocompletion feature in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to read arbitrary files via crafted JavaScript code. (CVE-2015-0822)
Mozilla Firefox before 36.0 allows user-assisted remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges via a crafted web site that is accessed with unspecified mouse and keyboard actions. (CVE-2015-0821)
Mozilla Firefox before 36.0 does not properly restrict…
- Record
MGASA-2015-0126- Updated
- 2026-11-02
Show 8 moreShow less
OSVopenSUSE-SU-2024:10071-1 No score
MozillaFirefox-50.1.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10071-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10218-1 No score
seamonkey-2.40-6.1 on GA media
These are all security issues fixed in the seamonkey-2.40-6.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10218-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0593-1 No score
Security update for Mozilla Firefox
MozillaFirefox was updated to the 31.5.3ESR release to fix two security vulnerabilities:
*
MFSA 2015-29 / CVE-2015-0817: Security researcher ilxu1a reported,
through HP Zero Day Initiative's Pwn2Own contest, a flaw in Mozilla's
implementation of typed array bounds checking in JavaScript
just-in-time compilation (JIT) and its management of bounds checking
for heap access. This flaw can be leveraged into the reading and
writing of memory allowing for arbitary code execution on the local
system.
*
MFSA 2015-28 / CVE-2015-0818: Security researcher Mariusz Mlynski
reported, through HP Zero Day Initiative's Pwn2Own contest, a method
to run arbitrary scripts in a privileged context. This bypassed the
same-origin policy protections by using a flaw in the processing of
SVG format content navigation.
Security Issues:
* CVE-2015-0817
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0817>
* CVE-2015-0818
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0818>
- Record
SUSE-SU-2015:0593-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0593-2 No score
Security update for MozillaFirefox
MozillaFirefox was updated to the 31.5.3ESR release to fix two security vulnerabilities:
*
MFSA 2015-29 / CVE-2015-0817: Security researcher ilxu1a reported,
through HP Zero Day Initiative's Pwn2Own contest, a flaw in Mozilla's
implementation of typed array bounds checking in JavaScript
just-in-time compilation (JIT) and its management of bounds checking
for heap access. This flaw can be leveraged into the reading and
writing of memory allowing for arbitrary code execution on the local
system.
*
MFSA 2015-28 / CVE-2015-0818: Security researcher Mariusz Mlynski
reported, through HP Zero Day Initiative's Pwn2Own contest, a method
to run arbitrary scripts in a privileged context. This bypassed the
same-origin policy protections by using a flaw in the processing of
SVG format content navigation.
Security Issues:
* CVE-2015-0817
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0817>
* CVE-2015-0818
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0818>
- Record
SUSE-SU-2015:0593-2- Updated
- 2026-11-02
OSVSUSE-SU-2015:0630-1 No score
Security update for MozillaFirefox
MozillaFirefox was updated to the 31.5.3ESR release to fix two security vulnerabilities:
MFSA 2015-29 / CVE-2015-0817: Security researcher ilxu1a reported, through HP Zero Day Initiative's Pwn2Own contest, a flaw in Mozilla's implementation of typed array bounds checking in JavaScript just-in-time compilation (JIT) and its management of bounds checking for heap access. This flaw can be leveraged into the reading and writing of memory allowing for arbitary code execution on the local system.
MFSA 2015-28 / CVE-2015-0818: Security researcher Mariusz Mlynski reported, through HP Zero Day Initiative's Pwn2Own contest, a method to run arbitrary scripts in a privileged context. This bypassed the same-origin policy protections by using a flaw in the processing of SVG format content navigation.
- Record
SUSE-SU-2015:0630-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-0818 No score
Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving SVG hash navigation.
- Record
UBUNTU-CVE-2015-0818- Updated
- 2026-11-02
OSVUSN-2538-1 No score
firefox vulnerabilities
A flaw was discovered in the implementation of typed array bounds checking in the Javascript just-in-time compilation. If a user were tricked in to opening a specially crafted website, an attacked could exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-0817)
Mariusz Mlynski discovered a flaw in the processing of SVG format content navigation. If a user were tricked in to opening a specially crafted website, an attacker could exploit this to run arbitrary script in a privileged context. (CVE-2015-0818)
- Record
USN-2538-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
iceweaselDebian:7 From an advisory covering 2 CVEs |
before 31.5.3esr-1~deb7u1, plus listed versions 10.0.12esr-110.0.12esr-1+alpha10.0.12esr-1+nmu110.0.12esr-1+nmu1+alpha11.0-1 Show 45 moreShow less11.0-211.0-311.0-411.0~b1-111.0~b1-211.0~b2-111.0~b3-111.0~b4-111.0~b5-111.0~b6-112.0-112.0-212.0-312.0-412.0-512.0-612.0-713.0-113.0.1-113.0.1-214.0.1-114.0.1-215.0-115.0.1-116.0-116.0.1-116.0.2-117.0-117.0.1-117.0.1-217.0.10esr-1~deb7u117.0.5esr-117.0.6esr-117.0.6esr-1~deb7u117.0.7esr-117.0.7esr-1~deb7u117.0.7esr-217.0.8esr-117.0.8esr-1~deb7u117.0.8esr-217.0.8esr-2~deb7u117.0.9esr-1~deb7u118.0-118.0.1-118.0.2-1 |
31.5.3esr-1~deb7u1 |
rootcertsMageia:4 From an advisory covering 2 CVEs |
before 20150226.00-1.mga4 | 20150226.00-1.mga4 |
nssMageia:4 From an advisory covering 2 CVEs |
before 3.18.0-1.mga4 | 3.18.0-1.mga4 |
firefoxMageia:4 From an advisory covering 2 CVEs |
before 31.5.3-1.mga4 | 31.5.3-1.mga4 |
firefox-l10nMageia:4 From an advisory covering 2 CVEs |
before 31.5.3-1.mga4 | 31.5.3-1.mga4 |
iceapeMageia:4 From an advisory covering 16 CVEs |
before 2.33.1-1.mga4 | 2.33.1-1.mga4 |
firefoxRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:31.5.3-1.el5_11 | 0:31.5.3-1.el5_11 |
firefox-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:31.5.3-1.el5_11 | 0:31.5.3-1.el5_11 |
firefoxRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:31.5.3-1.el5_11 | 0:31.5.3-1.el5_11 |
firefox-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:31.5.3-1.el5_11 | 0:31.5.3-1.el5_11 |
Show 22 moreShow less
| Package | Affected | Fixed |
|---|---|---|
firefoxRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:31.5.3-1.el6_6 | 0:31.5.3-1.el6_6 |
firefox-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:31.5.3-1.el6_6 | 0:31.5.3-1.el6_6 |
firefoxRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:31.5.3-1.el6_6 | 0:31.5.3-1.el6_6 |
firefox-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:31.5.3-1.el6_6 | 0:31.5.3-1.el6_6 |
firefoxRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:31.5.3-1.el6_6 | 0:31.5.3-1.el6_6 |
firefox-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:31.5.3-1.el6_6 | 0:31.5.3-1.el6_6 |
firefoxRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:31.5.3-1.el6_6 | 0:31.5.3-1.el6_6 |
firefox-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:31.5.3-1.el6_6 | 0:31.5.3-1.el6_6 |
firefoxRed Hat:enterprise_linux:7::client From an advisory covering 2 CVEs |
before 0:31.5.3-3.el7_1 | 0:31.5.3-3.el7_1 |
firefox-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 2 CVEs |
before 0:31.5.3-3.el7_1 | 0:31.5.3-3.el7_1 |
firefoxRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs |
before 0:31.5.3-3.el7_1 | 0:31.5.3-3.el7_1 |
firefox-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs |
before 0:31.5.3-3.el7_1 | 0:31.5.3-3.el7_1 |
firefoxRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs |
before 0:31.5.3-3.el7_1 | 0:31.5.3-3.el7_1 |
firefox-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs |
before 0:31.5.3-3.el7_1 | 0:31.5.3-3.el7_1 |
MozillaFirefoxSUSE:Linux Enterprise Desktop 12 From an advisory covering 2 CVEs |
before 31.5.3esr-27.1 | 31.5.3esr-27.1 |
MozillaFirefoxSUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 2 CVEs |
before 31.5.3esr-27.1 | 31.5.3esr-27.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 From an advisory covering 2 CVEs |
before 31.5.3esr-27.1 | 31.5.3esr-27.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 2 CVEs |
before 31.5.3esr-27.1 | 31.5.3esr-27.1 |
firefoxUbuntu:14.04:LTS |
before 36.0.4+build1-0ubuntu0.14.04.1, plus listed versions 24.0+build1-0ubuntu125.0+build3-0ubuntu0.13.10.128.0~b2+build1-0ubuntu228.0+build1-0ubuntu128.0+build2-0ubuntu1 Show 12 moreShow less28.0+build2-0ubuntu229.0+build1-0ubuntu0.14.04.230.0+build1-0ubuntu0.14.04.331.0+build1-0ubuntu0.14.04.132.0+build1-0ubuntu0.14.04.132.0.3+build1-0ubuntu0.14.04.133.0+build2-0ubuntu0.14.04.134.0+build2-0ubuntu0.14.04.135.0+build3-0ubuntu0.14.04.235.0.1+build1-0ubuntu0.14.04.136.0+build2-0ubuntu0.14.04.436.0.1+build2-0ubuntu0.14.04.1 |
36.0.4+build1-0ubuntu0.14.04.1 |
firefoxUbuntu:14.04:LTS From an advisory covering 2 CVEs |
before 36.0.4+build1-0ubuntu0.14.04.1, plus listed versions 24.0+build1-0ubuntu125.0+build3-0ubuntu0.13.10.128.0~b2+build1-0ubuntu228.0+build1-0ubuntu128.0+build2-0ubuntu1 Show 12 moreShow less28.0+build2-0ubuntu229.0+build1-0ubuntu0.14.04.230.0+build1-0ubuntu0.14.04.331.0+build1-0ubuntu0.14.04.132.0+build1-0ubuntu0.14.04.132.0.3+build1-0ubuntu0.14.04.133.0+build2-0ubuntu0.14.04.134.0+build2-0ubuntu0.14.04.135.0+build3-0ubuntu0.14.04.235.0.1+build1-0ubuntu0.14.04.136.0+build2-0ubuntu0.14.04.436.0.1+build2-0ubuntu0.14.04.1 |
36.0.4+build1-0ubuntu0.14.04.1 |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 899 CVEs |
before 50.1.0-1.1 | 50.1.0-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 1860 CVEs |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-0818 is a high vulnerability (CVSS 7.5) in Mozilla Firefox, published March 22, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.21%, the 88th percentile. Fixed in firefox 36.0.4+build1-0ubuntu0.14.04.1.
References
lists.opensuse.org/opensuse-updates/2015-03/msg00096.html
security.gentoo.org/glsa/201504-01
securityfocus.com/bid/73265
rhn.redhat.com/errata/RHSA-2015-0718.html
debian.org/security/2015/dsa-3201
Show 194 moreShow less
oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
mozilla.org/security/announce/2015/mfsa2015-28.html
securitytracker.com/id/1031959
bugzilla.mozilla.org/show_bug.cgi?id=1144988
ubuntu.com/usn/USN-2538-1
nvd.nist.gov/vuln/detail/CVE-2015-0818
github.com/advisories/GHSA-rr7h-5qv5-g84f
advisories.mageia.org/MGASA-2015-0115.html
bugs.mageia.org/show_bug.cgi?id=15555
developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.18_release_notes
access.redhat.com/errata/RHSA-2015:0718
bugzilla.redhat.com/show_bug.cgi?id=1204362
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0718.json
cve.org/CVERecord?id=CVE-2015-0817
suse.com/support/update/announcement/2015/suse-su-20150593-1
bugzilla.suse.com/923534
ubuntu.com/security/CVE-2015-0818
Left out here: 69 versions, 1,940 references and the rest of 1 source description. The JSON record has them.