CVE-2015-4495
8.8 · HIGH Actively ExploitedOverview
CVE-2015-4495 is a high-severity vulnerability affecting mozilla firefox. It was published on August 8, 2015 and has a CVSS 3.1 base score of 8.8 (HIGH). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
This vulnerability has a CVSS 3.1 base score of 8.8, rated HIGH. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
Technical Description
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.
Remediation
Check the references section for vendor advisories and patches from mozilla. Update firefox to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
Affected Products
| Vendor | Product | Versions | Status |
|---|---|---|---|
| mozilla | firefox | >= 0, < 39.0.3 | Affected |
| mozilla | firefox_os | >= 0, < 2.2 | Affected |
References
Frequently Asked Questions
What is CVE-2015-4495?
CVE-2015-4495 is a high-severity vulnerability affecting mozilla firefox. It was published on August 8, 2015 and has a CVSS 3.1 base score of 8.8 (HIGH). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
How severe is CVE-2015-4495?
This vulnerability has a CVSS 3.1 base score of 8.8, rated HIGH. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
How do I fix or remediate CVE-2015-4495?
Check the references section for vendor advisories and patches from mozilla. Update firefox to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
How can CyberStrike help with CVE-2015-4495?
CyberStrike's AI-powered security agents can automatically detect CVE-2015-4495 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.
How CyberStrike Helps
AI agents map your attack surface to find vulnerabilities like this one.
Automated penetration testing that runs continuously, not just quarterly.
AI-driven PR review catches vulnerable dependencies before they ship.
Browser-based exploitation validates findings with real proof-of-concept.
Related HIGH CVEs from 2015
View all →Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before
Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x b
The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote att
Cross-site request forgery (CSRF) vulnerability in SearchBlox before 8.2 allows remote attackers to
Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a cr
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista
JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code
Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial o
Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista S
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause
eWON devices with firmware before 10.1s0 do not trigger the discarding of browser session data in re