Direct naar de inhoud
⚡ Kritieke cyberalerts voor jouw sector & systemen — direct in je inbox. Aanmelden →
cybernieuws.nl Cybersecurity en informatiebeveiling nieuws alerts live · 7 min 162 bronnen 13 vandaag
CVE's Videos Dagbriefing

← Terug naar CVE-database

CVE-2015-0816

MEDIUM · 5.0 CVSS Gepubliceerd: CWE-264

Beschrijving

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js.

Vendors

Mozilla

Affected products

Firefox Thunderbird

References