CVE-2015-4495 Mozilla Firefox Security Feature Bypass

Exploited in the wild High 8.8 Published 8 Aug 2015 Updated 21 Oct 2025

Remote attackers can bypass Same Origin Policy to read arbitrary files or gain privileges via crafted JavaScript in the PDF reader.

Exploited in the wild: Since 25 May 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2015-4495?

CVE-2015-4495 is a high-severity vulnerability in Canonical Ubuntu Linux, published on 8 Aug 2015. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

Weakness: CWE-346

Which versions are affected by CVE-2015-4495?

It affects 15 products.

Linux distribution packages (31)

`firefox` Red Hat:enterprise_linux:5::client	All versions	`0:38.1.1-1.el5_11`
`firefox-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:38.1.1-1.el5_11`
`firefox` Red Hat:enterprise_linux:5::server	All versions	`0:38.1.1-1.el5_11`
`firefox-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:38.1.1-1.el5_11`
`firefox` Red Hat:enterprise_linux:6::client	All versions	`0:38.1.1-1.el6_7`
`firefox-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`0:38.1.1-1.el6_7`
`firefox` Red Hat:enterprise_linux:6::computenode	All versions	`0:38.1.1-1.el6_7`
`firefox-debuginfo` Red Hat:enterprise_linux:6::computenode	All versions	`0:38.1.1-1.el6_7`
`firefox` Red Hat:enterprise_linux:6::server	All versions	`0:38.1.1-1.el6_7`
`firefox-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:38.1.1-1.el6_7`
`firefox` Red Hat:enterprise_linux:6::workstation	All versions	`0:38.1.1-1.el6_7`
`firefox-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:38.1.1-1.el6_7`
`firefox` Red Hat:enterprise_linux:7::client	All versions	`0:38.1.1-1.el7_1`
`firefox-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:38.1.1-1.el7_1`
`firefox` Red Hat:enterprise_linux:7::server	All versions	`0:38.1.1-1.el7_1`
`firefox-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:38.1.1-1.el7_1`
`firefox` Red Hat:enterprise_linux:7::workstation	All versions	`0:38.1.1-1.el7_1`
`firefox-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:38.1.1-1.el7_1`
`MozillaFirefox` SUSE:Linux Enterprise Desktop 11 SP3	All versions	`31.8.0esr-0.13.2`
`MozillaFirefox` SUSE:Linux Enterprise Desktop 11 SP4	All versions	`31.8.0esr-0.13.2`
`MozillaFirefox` SUSE:Linux Enterprise Desktop 12	All versions	`31.8.0esr-40.1`
`MozillaFirefox` SUSE:Linux Enterprise Server 11 SP3	All versions	`31.8.0esr-0.13.2`
`MozillaFirefox` SUSE:Linux Enterprise Server 11 SP3-TERADATA	All versions	`31.8.0esr-0.13.2`
`MozillaFirefox` SUSE:Linux Enterprise Server 11 SP4	All versions	`31.8.0esr-0.13.2`
`MozillaFirefox` SUSE:Linux Enterprise Server 12	All versions	`31.8.0esr-40.1`
`MozillaFirefox` SUSE:Linux Enterprise Server for SAP Applications 11 SP3	All versions	`31.8.0esr-0.13.2`
`MozillaFirefox` SUSE:Linux Enterprise Server for SAP Applications 11 SP4	All versions	`31.8.0esr-0.13.2`
`MozillaFirefox` SUSE:Linux Enterprise Server for SAP Applications 12	All versions	`31.8.0esr-40.1`
`MozillaFirefox` SUSE:Linux Enterprise Software Development Kit 11 SP3	All versions	`31.8.0esr-0.13.2`
`MozillaFirefox` SUSE:Linux Enterprise Software Development Kit 11 SP4	All versions	`31.8.0esr-0.13.2`
`MozillaFirefox` SUSE:Linux Enterprise Software Development Kit 12	All versions	`31.8.0esr-40.1`

Products include Canonical Ubuntu Linux, Mozilla Firefox, Mozilla Firefox Os, Opensuse Opensuse, Oracle Solaris, Redhat Enterprise Linux Desktop and 9 more.

How do I fix CVE-2015-4495?

Upgrade to a fixed version. US federal agencies must fix it by 15 Jun 2022.

Is CVE-2015-4495 being exploited?

Yes. Attackers have exploited CVE-2015-4495 in the wild since at least 25 May 2022.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 1 proofs of concept on GitHub.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2015-4495, GHSA-cpx9-g67g-v8c5, MGASA-2015-0305, RHSA-2015:1581, SUSE-SU-2015:1379-1, SUSE-SU-2015:1380-1 and 2 more.