Vulnerability Description
The importScripts function in the Web Workers API implementation in Mozilla Firefox before 43.0 allows remote attackers to bypass the Same Origin Policy by triggering use of the no-cors mode in the fetch API to attempt resource access that throws an exception, leading to information disclosure after a rethrow.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fedoraproject | Fedora | 22 |
| Opensuse | Leap | 42.1 |
| Opensuse | Opensuse | 13.1 |
| Mozilla | Firefox | <= 42.0 |
Related Weaknesses (CWE)
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.h
- http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174253.h
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00104.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-140.htmlVendor Advisory
- http://www.securityfocus.com/bid/79280
- http://www.securitytracker.com/id/1034426
- http://www.ubuntu.com/usn/USN-2833-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1160890
- https://github.com/whatwg/html/issues/164
- https://github.com/whatwg/html/pull/166
- https://security.gentoo.org/glsa/201512-10
- https://www.w3.org/Bugs/Public/show_bug.cgi?id=28961Vendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174083.h
FAQ
What is CVE-2015-7215?
CVE-2015-7215 is a vulnerability with a CVSS score of 5.0 (MEDIUM). The importScripts function in the Web Workers API implementation in Mozilla Firefox before 43.0 allows remote attackers to bypass the Same Origin Policy by triggering use of the no-cors mode in the fe...
How severe is CVE-2015-7215?
CVE-2015-7215 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-7215?
Check the references section above for vendor advisories and patch information. Affected products include: Fedoraproject Fedora, Opensuse Leap, Opensuse Opensuse, Mozilla Firefox.