Vulnerability Description
Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | <= 39.0.3 |
| Microsoft | Windows | All versions |
| Opensuse | Opensuse | 13.1 |
| Oracle | Solaris | 11.3 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-08/msg00030.html
- http://lists.opensuse.org/opensuse-updates/2015-08/msg00031.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-84.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
- http://www.securitytracker.com/id/1033247
- http://www.securitytracker.com/id/1033372
- https://bugzilla.mozilla.org/show_bug.cgi?id=1171518Issue Tracking
- https://security.gentoo.org/glsa/201605-06
- https://www.exploit-db.com/exploits/37925/
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-08/msg00030.html
- http://lists.opensuse.org/opensuse-updates/2015-08/msg00031.html
FAQ
What is CVE-2015-4481?
CVE-2015-4481 is a vulnerability with a CVSS score of 3.3 (LOW). Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privil...
How severe is CVE-2015-4481?
CVE-2015-4481 has been rated LOW with a CVSS base score of 3.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-4481?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Microsoft Windows, Opensuse Opensuse, Oracle Solaris.