{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-07-02T00:00:00", "descriptions": [{"lang": "en", "value": "PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables excessive privileges for internal Workers, which might allow remote attackers to execute arbitrary code by leveraging a Same Origin Policy bypass."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-12-23T18:57:01", "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla"}, "references": [{"name": "openSUSE-SU-2015:1229", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html"}, {"name": "SUSE-SU-2015:1268", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html"}, {"name": "GLSA-201512-10", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201512-10"}, {"name": "75541", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/75541"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"}, {"name": "RHSA-2015:1207", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2015-1207.html"}, {"name": "SUSE-SU-2015:1269", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html"}, {"name": "openSUSE-SU-2015:1266", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.mozilla.org/security/announce/2015/mfsa2015-69.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1163109"}, {"name": "USN-2656-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-2656-1"}, {"name": "SUSE-SU-2015:1449", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html"}, {"name": "1032783", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1032783"}, {"name": "DSA-3300", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2015/dsa-3300"}, {"name": "USN-2656-2", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-2656-2"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@mozilla.org", "ID": "CVE-2015-2743", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables excessive privileges for internal Workers, which might allow remote attackers to execute arbitrary code by leveraging a Same Origin Policy bypass."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "openSUSE-SU-2015:1229", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html"}, {"name": "SUSE-SU-2015:1268", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html"}, {"name": "GLSA-201512-10", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201512-10"}, {"name": "75541", "refsource": "BID", "url": "http://www.securityfocus.com/bid/75541"}, {"name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"}, {"name": "RHSA-2015:1207", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2015-1207.html"}, {"name": "SUSE-SU-2015:1269", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html"}, {"name": "openSUSE-SU-2015:1266", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"}, {"name": "http://www.mozilla.org/security/announce/2015/mfsa2015-69.html", "refsource": "CONFIRM", "url": "http://www.mozilla.org/security/announce/2015/mfsa2015-69.html"}, {"name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1163109", "refsource": "CONFIRM", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1163109"}, {"name": "USN-2656-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-2656-1"}, {"name": "SUSE-SU-2015:1449", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html"}, {"name": "1032783", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1032783"}, {"name": "DSA-3300", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2015/dsa-3300"}, {"name": "USN-2656-2", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-2656-2"}, {"name": "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T05:24:38.425Z"}, "title": "CVE Program Container", "references": [{"name": "openSUSE-SU-2015:1229", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html"}, {"name": "SUSE-SU-2015:1268", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html"}, {"name": "GLSA-201512-10", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201512-10"}, {"name": "75541", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/75541"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"}, {"name": "RHSA-2015:1207", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2015-1207.html"}, {"name": "SUSE-SU-2015:1269", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html"}, {"name": "openSUSE-SU-2015:1266", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.mozilla.org/security/announce/2015/mfsa2015-69.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1163109"}, {"name": "USN-2656-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-2656-1"}, {"name": "SUSE-SU-2015:1449", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html"}, {"name": "1032783", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1032783"}, {"name": "DSA-3300", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2015/dsa-3300"}, {"name": "USN-2656-2", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-2656-2"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html"}]}]}, "cveMetadata": {"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "assignerShortName": "mozilla", "cveId": "CVE-2015-2743", "datePublished": "2015-07-06T01:00:00", "dateReserved": "2015-03-25T00:00:00", "dateUpdated": "2024-08-06T05:24:38.425Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:31.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11F024A-A8B7-405B-8A13-4BF406FBDB22", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:31.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "D81A3698-797C-4CD9-BB02-A9182E0A6E11", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:31.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "84E8D7C7-B578-4623-9EA2-D13965DBE1F3", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:31.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "C3E5D043-71F8-4A61-BEA4-176153E26FD6", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:31.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "51CBE0A9-1D05-4F88-B5B5-1592D4A4687E", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:31.5.2:*:*:*:*:*:*:*", "matchCriteriaId": "902BF23B-C1B9-41F2-BF5D-C1722C3DBFFD", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:31.5.3:*:*:*:*:*:*:*", "matchCriteriaId": "60521E93-3495-40F7-AA72-EE531F8FA09D", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:38.0:*:*:*:*:*:*:*", "matchCriteriaId": "35BF0AFB-26BA-4BEA-B6B8-11CF88E951DE", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:31.1:*:*:*:*:*:*:*", "matchCriteriaId": "6D7AAC77-57A3-4747-B760-0EE3CD53E4DE", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:31.2:*:*:*:*:*:*:*", "matchCriteriaId": "7DCA6959-24B7-4F86-BE25-0A8A7C1A3D13", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:31.3:*:*:*:*:*:*:*", "matchCriteriaId": "697EA344-F982-4E9F-9EC8-CCCB5829582B", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:31.4:*:*:*:*:*:*:*", "matchCriteriaId": "61304847-1DC8-442C-8194-28E52B3C1293", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:31.5:*:*:*:*:*:*:*", "matchCriteriaId": "8DF9724E-93B2-4BC7-8181-6D9521A6CC37", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:31.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "9DAF8682-9B5E-4DE7-AEB0-71D5E4E6E01C", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:31.7.0:*:*:*:*:*:*:*", "matchCriteriaId": "D7AA9780-4512-4B76-BDBB-BB702535ECBD", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*", "matchCriteriaId": "79A602C5-61FE-47BA-9786-F045B6C6DBA8", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "matchCriteriaId": "639EAD72-0505-4B4E-8693-9E653A30A334", "versionEndIncluding": "38.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:novell:suse_linux_enterprise_software_development_kit:12.0:*:*:*:*:*:*:*", "matchCriteriaId": "336EC5B8-6FD8-42BB-9530-58A15238CEE1", "vulnerable": true}, {"criteria": "cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:*:*:*:*:*:*:*", "matchCriteriaId": "EA04C9F1-6257-4D82-BA0B-37DE66D94736", "vulnerable": true}, {"criteria": "cpe:2.3:o:novell:suse_linux_enterprise_server:11:sp4:*:*:*:*:*:*", "matchCriteriaId": "095856BE-4E55-4FEA-BCAC-352C29083545", "vulnerable": true}, {"criteria": "cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:*:*:*:*:*:*:*", "matchCriteriaId": "C384D0B6-8A5C-45CA-8CD9-7F4E967FE4F0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables excessive privileges for internal Workers, which might allow remote attackers to execute arbitrary code by leveraging a Same Origin Policy bypass."}, {"lang": "es", "value": "PDF.js en Mozilla Firefox anterior a 39.0 y Firefox ESR 31.x anterior a 31.8 y 38.x anterior a 38.1 habilita privilegios excesivos para los trabajadores internos, lo que podr\u00eda permitir a atacantes remotos ejecutar c\u00f3digo arbitrario mediante el aprovechamiento de una evasi\u00f3n de Same Origin Policy."}], "id": "CVE-2015-2743", "lastModified": "2024-10-22T13:54:41.943", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2015-07-06T02:01:11.780", "references": [{"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"}, {"source": "security@mozilla.org", "tags": ["Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html"}, {"source": "security@mozilla.org", "tags": ["Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html"}, {"source": "security@mozilla.org", "url": "http://rhn.redhat.com/errata/RHSA-2015-1207.html"}, {"source": "security@mozilla.org", "url": "http://www.debian.org/security/2015/dsa-3300"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "http://www.mozilla.org/security/announce/2015/mfsa2015-69.html"}, {"source": "security@mozilla.org", "tags": ["Third Party Advisory"], "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"}, {"source": "security@mozilla.org", "tags": ["Third Party Advisory"], "url": "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html"}, {"source": "security@mozilla.org", "url": "http://www.securityfocus.com/bid/75541"}, {"source": "security@mozilla.org", "url": "http://www.securitytracker.com/id/1032783"}, {"source": "security@mozilla.org", "url": "http://www.ubuntu.com/usn/USN-2656-1"}, {"source": "security@mozilla.org", "url": "http://www.ubuntu.com/usn/USN-2656-2"}, {"source": "security@mozilla.org", "tags": ["Issue Tracking"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1163109"}, {"source": "security@mozilla.org", "url": "https://security.gentoo.org/glsa/201512-10"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-17"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank Mozilla project for reporting this issue. Upstream acknowledges Jonas Jenwald as the original reporter.", "affected_release": [{"advisory": "RHSA-2015:1207", "cpe": "cpe:/o:redhat:enterprise_linux:5", "package": "firefox-0:38.1.0-1.el5_11", "product_name": "Red Hat Enterprise Linux 5", "release_date": "2015-07-03T00:00:00Z"}, {"advisory": "RHSA-2015:1207", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "firefox-0:38.1.0-1.el6_6", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2015-07-03T00:00:00Z"}, {"advisory": "RHSA-2015:1207", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "firefox-0:38.1.0-1.el7_1", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2015-07-03T00:00:00Z"}], "bugzilla": {"description": "Mozilla: Privilege escalation through internal workers (MFSA 2015-69)", "id": "1236964", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1236964"}, "csaw": false, "cvss": {"cvss_base_score": "5.1", "cvss_scoring_vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "status": "verified"}, "cwe": "CWE-250", "details": ["PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables excessive privileges for internal Workers, which might allow remote attackers to execute arbitrary code by leveraging a Same Origin Policy bypass.", "A flaw was discovered in Mozilla's PDF.js PDF file viewer. When combined with another vulnerability, it could allow execution of arbitrary code with the privileges of the user running Firefox."], "name": "CVE-2015-2743", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2015-07-02T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2015-2743\nhttps://nvd.nist.gov/vuln/detail/CVE-2015-2743\nhttp://www.mozilla.org/security/announce/2015/mfsa2015-69.html"], "statement": "This issue does not affect the version of thunderbird package, as shipped with Red Hat Enterprise Linux 5, 6 and 7.", "threat_severity": "Moderate"}