CVE-2015-4481 Race condition in n/a
Local attackers can exploit a race condition in the Firefox Maintenance Service to write arbitrary files and escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-4481?
CVE-2015-4481 is a low-severity vulnerability in Mozilla Firefox, published on 16 Aug 2015. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update.
Weakness: CWE-362
Which versions are affected by CVE-2015-4481?
It affects 3 products.
Products include Mozilla Firefox, Opensuse Opensuse, Oracle Solaris.
How do I fix CVE-2015-4481?
Upgrade to a fixed version.
Is CVE-2015-4481 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2015-4481 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-fpjx-8wc2-5w5g.