Fluid Attacks Database

Description

Mozilla Firefox 38.0 and Firefox ESR 38.0 allow user-assisted remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges via a crafted web site that is accessed with unspecified mouse and keyboard actions. NOTE: this vulnerability exists because of a CVE-2015-0821 regression.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel5	firefox	<0:38.1.0-1.el5_11	0:38.1.0-1.el5_11
rpm rhel6	firefox	<0:38.1.0-1.el6_6	0:38.1.0-1.el6_6
rpm rhel7	firefox	<0:38.1.0-1.el7_1	0:38.1.0-1.el7_1

Aliases

1. CVE-2015-27272. NVD-2015-27273. OSV-2015-2727

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.