QwikSec

Security Database

CVE

CWE

Training

CVE-2015-0802

Published: Apr 1, 2015

Modified: Aug 6, 2024

PUBLISHED

Description

Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1124898

x_refsource_CONFIRM

vdb-entry

x_refsource_SECTRACK

vendor-advisory

x_refsource_GENTOO

http://www.mozilla.org/security/announce/2015/mfsa2015-42.html

x_refsource_CONFIRM

exploit

x_refsource_EXPLOIT-DB

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

x_refsource_CONFIRM

vendor-advisory

x_refsource_UBUNTU

openSUSE-SU-2015:0677

vendor-advisory

x_refsource_SUSE

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.