ISOMAN

CVE

CVE-2015-4490

The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not implement the Content Security Policy Level 2 exceptions for the blob, data, and filesystem URL schemes during wildcard source-expression matching, which might make it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging unexpected policy-enforcement behavior.

Severity
MEDIUM
CVSS
4.3
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu14.04.6 amd64 desktopunknownsource
Ubuntu14.04.6 i386 desktopunknownsource
Ubuntu14.04.6 amd64 serverunknownsource
Ubuntu14.04.6 i386 serverunknownsource

References

  1. http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html
  2. http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html
  3. http://www.mozilla.org/security/announce/2015/mfsa2015-91.html
  4. http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
  5. http://www.securitytracker.com/id/1033247
  6. http://www.ubuntu.com/usn/USN-2702-1
  7. http://www.ubuntu.com/usn/USN-2702-2
  8. http://www.ubuntu.com/usn/USN-2702-3
  9. https://bugzilla.mozilla.org/show_bug.cgi?id=1086999
  10. https://security.gentoo.org/glsa/201605-06
  11. http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html
  12. http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html
  13. http://www.mozilla.org/security/announce/2015/mfsa2015-91.html
  14. http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
  15. http://www.securitytracker.com/id/1033247
  16. http://www.ubuntu.com/usn/USN-2702-1
  17. http://www.ubuntu.com/usn/USN-2702-2
  18. http://www.ubuntu.com/usn/USN-2702-3
  19. https://bugzilla.mozilla.org/show_bug.cgi?id=1086999
  20. https://security.gentoo.org/glsa/201605-06